SAS70 & Business Continuity Disaster Recovery (BCDR)

As a SAS70 Auditor, I’m often asked about disaster recovery plans and their overall importance and requirement, if any, in regards to a SAS70 Type I or Type II audit. What’s interesting to note about Business Continuity Disaster Recovery (BCDR) or any variation thereof (Business Continuity Management, etc), is that under the amended SAS70 auditing guidelines put forth by the AICPA publication, a plan is not a control objective. In short, BCDR is not a requirement of SAS70. So, there’s the technical answer.

In theory, many auditors will devise a control objective for BCDR for the SAS70 audit purely based on the importance of the plan itself. It ultimately depends on the CPA firm that is conducting the audit whether they decide to include it or not include it in the scope of the SAS70 audit. If an auditor does not test for it, it can still be included in a section called “additional information provided by the service organization”. This section gives service organizations a chance to discuss or include in the final SAS70 report any other material, documents, etc. they feel are vital to understanding the organization as a whole.

If you want to learn more about SAS70 audits, what SAS70 really is or to receive a free SAS70 Type II audit report, then visit the official SAS70 Resource guide, where a voluminous amount of information can be found on the SAS70 auditing standard. White papers, current industry articles, a glossary of commonly used SAS70 terms-its all there for you in at the most widely recognized sas 70 website on the Internet.