SAS 70 Type II Testing Period Considerations
Type II audits include an examination of controls that have been placed in operation and testing of operating effectiveness. Testing of controls is required for Type II audits, with a minimum testing period of at least six months. Testing is conducted throughout various predetermined timeframes throughout the six-month period, and in a manner that significantly mitigates any type of business interruption. However, other factors, circumstances can lead to a smaller testing period, such as four (4) months, or a longer testing period, such as ten (10) months. Many times, the test period is driven by external auditor requirements, user organization demands, along with service organization financial and operational concerns for undertaking the audit itself. For example, many times a user organization is notified by its external auditors (user auditors) that one of their outsourced providers (service organization) conducts transaction processing activities that affect the user organization's "information system". When this happens, a dialogue amongst all parties will ensue, with the testing period being a paramount topic. It's just one of many scenarios that can decide the testing period of the Type II audit.
A Type II report is issued after a generally accepted period has been completed. For example, an accounting firm would examine a company's controls from June 1, 2007 to November 30, 2007 and report on the "controls placed in operations and tests of operating effectiveness" for the six-month test period of the audit. Readers can download a Sample SAS 70 to view and print a sample six-month report.
Type II compliance can be attained by following the most common approach, whereby service organizations undergo a Type I audit, then move towards Type II compliance for subsequent years. However, due to factors stated earlier, such as varying financial statement reporting time periods for publicly traded corporations and a host of other issues, working immediately towards Type II compliance becomes the only option at times. Reading and examining the contents of what's in a report along with understanding important facts will help interested parties gain in-depth knowledge on Statement of Auditing Standards No. 70.