SAS 70 Type II Audits

After the Type I report date, SC&H will be able to perform a SAS 70 Type II audit for the service organization.  SC&H recommends either a six month or twelve month time period for the Type II report. SC&H will be on-site at scheduled intervals during the Type II time period to perform testing of the service organization’s controls.

In preparation for and during the SAS 70 Type II audit, SC&H recommends that service organizations provide on-going training for the control owners so that they understand the importance of following the implemented policies and procedures, which includes maintaining documentation to evidence that the controls are operating effectively. SC&H’s Type II testing procedures are conducted in accordance with the AICPA auditing standards.
 
The service organization’s SAS 70 Type II report not only includes the information contained from the Type I report, but also an opinion expressed by SC&H on whether the service organization’s controls were operating effectively over the proposed six or twelve month time period.  In the Type II report, SC&H will perform testing of the service organization’s controls in order to determine whether the operational effectiveness of the controls provides reasonable assurance that the control objectives were achieved during the time period specified.

Having an unqualified SAS 70 Type II report provides the following benefits:

• Competitive Advantage: A SAS 70 Type II review with an unqualified opinion will allow service organizations to differentiate themselves from their peers by demonstrating establishment of business process and information technology controls that are designed and operating effectively.
• Reduced Costs: Without a current SAS 70 Type II report, service organizations may have to entertain multiple audit requests from their clients and their client’s external auditors. Multiple visits from auditors can place a strain on the service organization’s resources.
• Customer Benefits: Customers receive a detailed description of the service organization’s controls and an independent assessment of whether the controls were placed in operation and designed and operating effectively.

For more information on our Readiness Reviews and/or SAS 70 Type I audits, please click the appropriate links.