SAS 70 Readiness Reviews

SC&H recommends that a Readiness Review be performed for service organizations that are new to the SAS 70 audit process. The purpose of a Readiness Review is to define the key control objectives and control activities that will be covered in the upcoming SAS 70 audits, and to identify those control weaknesses that need to be corrected before the SAS 70 Type I and Type II time periods begin.  In almost all cases, service organizations that do not have a Readiness Review performed receive a “qualified opinion” on their SAS 70 Type II report.  A qualified opinion means that significant control weaknesses were noted and a certain number of the control objectives were not met for the period under review.

Many service organizations in their first SAS 70 Type II audit make the mistake of having too many or too vague control objectives and control activities.  This typically leads to testing exceptions and the potential for a qualified opinion.  During SAS 70 Readiness Reviews, SC&H streamlines the control objectives and control activities to only include the key controls that clients and prospects require for their compliance needs (e.g., Sarbanes-Oxley, GLBA, and HIPAA) and operational best practices. As a service organization’s business process and IT control environments mature over time, additional control objectives and control activities can be added to future SAS 70 reports. 

For more information on our SAS 70 Type I and/or SAS 70 Type II audits, please click the appropriate links.