What is a SAS 70 Audit?

SAS 70 engagements are detailed examinations of the internal controls over the policies and procedures of service organizations. The examination typically covers both operating and information technology controls. User organizations (customers of service companies) or the auditors of user organizations typically require the SAS 70 reports. Recently, we have seen that more companies are taking the initiative to have a SAS 70 engagement performed for internal assurance and as a means to differentiate their service.

One of the most effective ways a service organization can communicate information about its controls is through a Service Auditor’s Report. There are two types of Service Auditor’s Reports: Type I and Type II.