FREQUENTLY ASKED QUESTIONS
1. What is the difference between a SAS 70 Type I, Type II and Readiness-Assessment?
The following outlines the differences between SAS 70 Type I, Type II and Readiness-Assessment:
The following outlines the differences between SAS 70 Type I, Type II and Readiness-Assessment:
|
2. How do I know which type of SAS 70 we need?
A SAS 70 Readiness Assessment is an efficient method by which we help our clients determine their
readiness for a SAS 70 audit. A Readiness Assessment is often a desirable option for service
organizations that have not had a SAS 70 performed or otherwise have concerns about the
preparedness of the organization for a SAS 70 audit. The result of this assessment is a consultative
report that includes issues identified relevant to the control environment and corrective guidance to
prepare for the SAS 70. The Readiness Assessment also enables us to gain knowledge about the
service and detailed information about the control environment that will be used to conduct the actual
SAS 70, thereby offsetting some of the time and cost. SAS 70 Readiness Assessments are generally
conducted for organizations with the following characteristics:
- Management has concerns about the preparedness of the organization for
a SAS 70 audit
- A SAS 70 has never been performed related to the service to be audited
- A prior audit related to the service resulted in significant adverse findings
- Key personnel responsible for control over the service are no longer with
the organization
- There have been significant changes to the processing environment
- The service to be audited was recently integrated as part of an acquisition
or merger
- A SAS 70 was previously performed that was not considered useable by
clients or their auditors
A SAS 70 Type II Service Auditors Report expresses an opinion on a service organization’s controls
as it relates to an audit of the financial statements of its clients, or to specific control objectives
relevant to the service organization. The Type II report determines whether controls were in place
and operated with sufficient effectiveness to provide reasonable assurance that the control
objectives were met during a specific period of time. The Type II report is typically what is expected
by service organizations’ client auditor as the procedures suffice the work they would otherwise have
to perform. SAS 70 Type II assessments are generally conducted for organizations with the following
characteristics:
- The service organization provides or intends to provide significant services
to public companies or companies who are otherwise audited
- The service organization is contractually obligated to have a Type II SAS 70
performed
- The service organization strives for operational excellence and seeks an
independent method of assessing and conveying this to its clients
Similar to a Type II SAS 70 Service Auditors Report, the Type I also expresses an opinion on a
service organization’s controls as it relates to an audit of the financial statements of its clients, or to
specific control objectives relevant to the service organization. However, the Type I goes only so far
as to determine whether it was reasonably assured that controls were designed to meet the control
objectives and were in place as of a specific point in time. No opinion on whether controls operated
effectively over a specific period is provided. In the past, a Type I SAS 70 could be used by the
auditors of a service organization’s clients to suffice certain procedures that they would otherwise
have to conduct. With the Sarbanes-Oxley Act and tighter auditing standards, the use of this type of
report is much more limited because it does not provide test of operating effectiveness of controls.
However, some service organizations may achieve their SAS 70 audit objectives when in the following
circumstances:
- A SAS 70 has never been performed related to the service to be audited
- The service organization is conducting a SAS 70 on an elective basis, with
no contractual or other client audit requirements
- The service organization is conducting a SAS 70 on a behalf of clients whose
auditors do not require a Type II SAS 70
- The service organization strives to set a standard of excellence and seeks an
independent method of assessing and conveying this to its clients
A SAS 70 Readiness Assessment is an efficient method by which we help our clients determine their
readiness for a SAS 70 audit. A Readiness Assessment is often a desirable option for service
organizations that have not had a SAS 70 performed or otherwise have concerns about the
preparedness of the organization for a SAS 70 audit. The result of this assessment is a consultative
report that includes issues identified relevant to the control environment and corrective guidance to
prepare for the SAS 70. The Readiness Assessment also enables us to gain knowledge about the
service and detailed information about the control environment that will be used to conduct the actual
SAS 70, thereby offsetting some of the time and cost. SAS 70 Readiness Assessments are generally
conducted for organizations with the following characteristics:
- Management has concerns about the preparedness of the organization for
a SAS 70 audit
- A SAS 70 has never been performed related to the service to be audited
- A prior audit related to the service resulted in significant adverse findings
- Key personnel responsible for control over the service are no longer with
the organization
- There have been significant changes to the processing environment
- The service to be audited was recently integrated as part of an acquisition
or merger
- A SAS 70 was previously performed that was not considered useable by
clients or their auditors
A SAS 70 Type II Service Auditors Report expresses an opinion on a service organization’s controls
as it relates to an audit of the financial statements of its clients, or to specific control objectives
relevant to the service organization. The Type II report determines whether controls were in place
and operated with sufficient effectiveness to provide reasonable assurance that the control
objectives were met during a specific period of time. The Type II report is typically what is expected
by service organizations’ client auditor as the procedures suffice the work they would otherwise have
to perform. SAS 70 Type II assessments are generally conducted for organizations with the following
characteristics:
- The service organization provides or intends to provide significant services
to public companies or companies who are otherwise audited
- The service organization is contractually obligated to have a Type II SAS 70
performed
- The service organization strives for operational excellence and seeks an
independent method of assessing and conveying this to its clients
Similar to a Type II SAS 70 Service Auditors Report, the Type I also expresses an opinion on a
service organization’s controls as it relates to an audit of the financial statements of its clients, or to
specific control objectives relevant to the service organization. However, the Type I goes only so far
as to determine whether it was reasonably assured that controls were designed to meet the control
objectives and were in place as of a specific point in time. No opinion on whether controls operated
effectively over a specific period is provided. In the past, a Type I SAS 70 could be used by the
auditors of a service organization’s clients to suffice certain procedures that they would otherwise
have to conduct. With the Sarbanes-Oxley Act and tighter auditing standards, the use of this type of
report is much more limited because it does not provide test of operating effectiveness of controls.
However, some service organizations may achieve their SAS 70 audit objectives when in the following
circumstances:
- A SAS 70 has never been performed related to the service to be audited
- The service organization is conducting a SAS 70 on an elective basis, with
no contractual or other client audit requirements
- The service organization is conducting a SAS 70 on a behalf of clients whose
auditors do not require a Type II SAS 70
- The service organization strives to set a standard of excellence and seeks an
independent method of assessing and conveying this to its clients
3. How often must a SAS 70 be conducted?
A SAS 70 is typically conducted one to two times per year, depending on the needs of the service
organizations’ clients. Since a Type II SAS 70 expresses an opinion on the operating effectiveness of
controls over a period of time, it will generally cover a time frame of six months or one year. A Type I
SAS 70 expresses an opinion on the design of internal controls as of a point of time, and will
therefore be as of a specific date (rather than for a specific period).
A SAS 70 is typically conducted one to two times per year, depending on the needs of the service
organizations’ clients. Since a Type II SAS 70 expresses an opinion on the operating effectiveness of
controls over a period of time, it will generally cover a time frame of six months or one year. A Type I
SAS 70 expresses an opinion on the design of internal controls as of a point of time, and will
therefore be as of a specific date (rather than for a specific period).
4. How long does a SAS 70 take and what demand will it put on my organization?
The duration of a SAS 70 is dependent on the type of procedures performed. A SAS 70 Readiness
Assessment will generally take less than a week to complete fieldwork, with a consultative report
delivered to the service organization one to two weeks later. Fieldwork for a Type I SAS 70 generally
takes one to two weeks for most organizations, although highly complex or large organizations may
take longer. A Type II SAS 70 generally takes two to four weeks of fieldwork, again with longer
durations for larger or more complex environments. Both Type I and Type II reports are generally
issued within two to four weeks of completion of fieldwork.
Fieldwork is the period during which our auditors gather information about the service organization’s
control environment and perform tests of controls. We limit the amount of time we spend at the
location of the service organization to that which is necessary to gather the necessary information to
perform procedures. We find that those organizations who are sufficiently prepared with the
information requested prior to our arrival experience limited demand and interruption of day-to-day
activities. Typically once the required information is gathered, final procedures will be conducted off-
site.
The duration of a SAS 70 is dependent on the type of procedures performed. A SAS 70 Readiness
Assessment will generally take less than a week to complete fieldwork, with a consultative report
delivered to the service organization one to two weeks later. Fieldwork for a Type I SAS 70 generally
takes one to two weeks for most organizations, although highly complex or large organizations may
take longer. A Type II SAS 70 generally takes two to four weeks of fieldwork, again with longer
durations for larger or more complex environments. Both Type I and Type II reports are generally
issued within two to four weeks of completion of fieldwork.
Fieldwork is the period during which our auditors gather information about the service organization’s
control environment and perform tests of controls. We limit the amount of time we spend at the
location of the service organization to that which is necessary to gather the necessary information to
perform procedures. We find that those organizations who are sufficiently prepared with the
information requested prior to our arrival experience limited demand and interruption of day-to-day
activities. Typically once the required information is gathered, final procedures will be conducted off-
site.
5. What part of my organization is audited during a SAS 70? How much does it cost?
Only the process and controls directly related to the service for which the SAS 70 is being conducted
are evaluated. Other aspects of the service organization are generally not impacted by the SAS 70
audit.
The cost of a SAS 70 is dependent on the type of assessment performed and the nature of the
service being audited. Readiness Assessments are generally less costly than Type I SAS 70s, which
in turn are generally less costly than Type II SAS 70s. However, if a Readiness Assessment or Type I
SAS 70 is performed, that work can often be leveraged to reduce the fees of moving to the next
level. As one would expect, procedures for larger and more complex organizations are typically more
time intensive, resulting in higher audit fees. Generally first year SAS 70 engagements are more time
intensive. In subsequent years, we are typically able to leverage the knowledge, documentation and
procedures already obtained. Therefore, we are able to offer reduced pricing for our clients who
agree in advance to multi-year services
We offer our clients the option of selecting a fixed price or fees and expenses arrangement. Our
pricing is highly competitive. We work with our clients to create a cost effective SAS 70 solution that
meets the needs of the service organization, their clients and their clients’ auditors.
Only the process and controls directly related to the service for which the SAS 70 is being conducted
are evaluated. Other aspects of the service organization are generally not impacted by the SAS 70
audit.
The cost of a SAS 70 is dependent on the type of assessment performed and the nature of the
service being audited. Readiness Assessments are generally less costly than Type I SAS 70s, which
in turn are generally less costly than Type II SAS 70s. However, if a Readiness Assessment or Type I
SAS 70 is performed, that work can often be leveraged to reduce the fees of moving to the next
level. As one would expect, procedures for larger and more complex organizations are typically more
time intensive, resulting in higher audit fees. Generally first year SAS 70 engagements are more time
intensive. In subsequent years, we are typically able to leverage the knowledge, documentation and
procedures already obtained. Therefore, we are able to offer reduced pricing for our clients who
agree in advance to multi-year services
We offer our clients the option of selecting a fixed price or fees and expenses arrangement. Our
pricing is highly competitive. We work with our clients to create a cost effective SAS 70 solution that
meets the needs of the service organization, their clients and their clients’ auditors.
