SAS 70 | Important Facts Regarding Type I and Type II SAS 70 Audits
Statement on Auditing Standards No. 70, simply known as SAS 70, was put forth in April of 1992, and since then, has served as the de facto auditing standard for examining a service organization’s internal controls. What’s important to note about SAS 70 is that it has quite a long and rich history, dating back to a number of other previous auditing standards used by auditors over the years. Because of SAS 70’s new found importance, largely due to the passing of the Sarbanes Oxley Act of 2002, it would be wise for service organizations who are considering undertaking this audit to thoroughly understand the unique components of Statement on Auditing Standards No. 70.
So, where to begin?
First and foremost, the formal definition of sas 70 can best be described as an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA), which is used to report on the “processing of transactions by service organizations”, which can be done by completing either a Type I or a Type II audit.”
Second, there are two (2) types of sas 70 audits; a Type I and a Type II. Type I audits are for a specific date in time, such as August 27, 2008, while a Type II audit covers an actual testing period, traditionally anywhere from six (6) to twelve (12) months. It’s important to note that most service organizations undertake a sas 70 readiness assessment before actually conducting a sas 70 audit.
Moreover, the final deliverable for the audit is known as the SAS 70 Service Auditor’s Report, a lengthy document containing information regarding the service organization, its control structure, framework, test of controls (if a Type II audit), along with numerous supporting documentation.
Other important considerations and notable points worth reading up on regarding SAS 70 audits include the following:
- Notable benefits of the auditing standard
- SAS 70 criticism
- What’s in a SAS 70 report
- Industry publications on statement on auditing standards no. 70
- Glossary of terms
