If your organisation provides services to an entity that have an effect on the entity's financial statements, then you may be asked to provide a report on internal control for the benefit of the entity's management and their financial statement auditors. A SAS No. 70 audit will be your solution. SAS No. 70 is a formal report on the design, implementation, and operating effectiveness of controls at a service organisation.
Conversely, if your company outsources some or all of its business operations to a service organisation, and these operations have an affect on your financial statements, then a SAS No. 70 audit report may provide you and your independent auditors information about the service organisation’s control environment, their related control objectives, and their affect on your financial statements.
For example, if an Application Service Provider (ASP) is providing you with an application that processes transactions that have an affect on your financial statements, then you and your financial statement auditors may want assurance on the ASP’s controls including the integrity of their transaction processing, logical and physical security etc.
A SAS No. 70 report:
- Is a formal report on the design, implementation, and effectiveness of controls at a service organisation, usually covering a period of not less than six months.
- Is primarily used to support the financial audit process of entities that use outside service organisations.
- Contains an independent accountant’s opinion on the design, implementation, and effectiveness of controls at a service organisation for the audit period.
- Contains a description of the service organisation’s control environment, its control objectives, and the key controls that are in place to achieve those control objectives.
- Contains tests of operating effectiveness performed by the independent accountant, and the results of those tests.
- Contains control considerations that should be employed at entities that use the service organisation.
- Is intended for use by the service organisation, its customers, and the independent accountants of its customers.
