Using a SAS 70 Readiness Questionnaire for Audit Readiness Activities

A SAS 70 readiness questionnaire will assist service organizations who are unsure of the necessary steps that must be in place before effectively beginning the audit process for compliance, which is essentially the first step in the readiness assessment phase. By making the entity aware of the tasks involved with preparing and ultimately engaging in this type of audit, precious dollars and employee man-hours will be saved, ultimately affecting SAS 70 pricing. Upon examining a service organization’s controls and related activities, the service auditor can then determine if a SAS 70 Type Ior Type II audit is to begin, or if additional internal procedures need to be undertaken before analysis and fieldwork begins.

Goals for a SAS 70 Readiness Questionnaire and Assessment

A SAS 70 readiness questionnaire simply augments the overall engagement process for the actual audit. It provides for a more streamlined, efficient audit, along with aiding in mitigating any business interruption issues when conducting the engagement itself. It should not be looked upon as an additional cost of the engagement, rather, a useful and proactive tool in successfully completing the audit. A SAS 70 Readiness Questionnaire and the assessment itself can be completed in a number of ways, but this is primarily dependent on the approach used by the SAS 70 auditor. Some firms conduct readiness assessments on site, traditionally ranging from 2 to 5 days, while others have employed document exchange portals for sharing information. Each has its drawbacks, but also their benefits. Regardless of which approach is taken, the service auditor’s goal is gain a comprehensive understanding and working knowledge of the service organization and its underlying control environment. Items that should be discussed include, but are not limited to, the following:

• Audit scope and history of entity’s regulatory audit requirements
• Development of control objectives and tests of the controls, commonly known as "control activities"
• Methodology of audit, including issues such as how sampling and testing are defined by the auditor
• Project milestones and deliverables

A readiness should be part of any service organization’s SAS 70 Roadmap for Compliance. Interested readers can also download a Sample SAS 70 to view the a final audit report and its contents.