SAS 70 Solutions

Home > Frequently Asked Questions

E-Mail This Link

FREQUENTLY ASKED QUESTIONS

The following Frequently Asked Questions comprise the most extensive collection of SAS 70 audit discussion material freely available on the Internet. SAS 70 Solutions strives to address the most common questions and misconceptions about SAS 70 audits for the benefit of service organizations, user organizations, and audit firms seeking to expand their knowledge of SAS 70 audit topics.

Every effort is made to ensure the accuracy of the information contained in this section. We welcome any feedback regarding the content of this FAQs section and encourage immediate notification of any issues related to the accuracy of its content. We encourage you to contact us if you have any suggestions for improving the quality of this FAQs section.

ABOUT SAS 70 SOLUTIONS

A1. What are SAS 70 Solutions' reputation, competence level and independence requirements?

A2. Is SAS 70 Solutions a licensed CPA firm?

A3. Is SAS 70 Solutions registered with the Public Company Accounting Oversight Board (PCAOB)?

A4. Once our organization engages SAS 70 Solutions, what is the timeframe for completing the SAS 70 audit and issuing our final audit report?

A5. Does SAS 70 Solutions provide SAS 70 audit services outside of the United States?

FIRST TIME AUDIT CONSIDERATIONS

B1. Our organization needs a SAS 70 audit. Where we do we start?

B2. What is the value proposition of a SAS 70 audit?

B3. How do I know if my organization is prepared to undergo a SAS 70 audit?

B4. Is it possible to "fail" a SAS 70 audit?

B5. What is the time investment associated with a SAS 70 audit?

B6. How often does my organization need to have a SAS 70 audit performed?

B7. What requirements should I implement when engaging a SAS 70 audit firm?

B8. What should I avoid when engaging a SAS 70 audit firm?

B9. What requirements should I have for the audit team members assigned to my audit?

B10. How do I determine the scope of my organization's SAS 70 audit?

B11. Are my organization's financial operations relevant to the scope of my SAS 70 audit?

B12. Is my organization required to use a "Big 4" global accounting firm to perform a SAS 70 audit?

B13. How much does a SAS 70 audit cost?

B14. Will the fees for our subsequent SAS 70 audit be less than those for the initial audit?

B15. Are there process or pricing efficiencies related to using my financial statement auditor as my SAS 70 auditor?

BASIC SAS 70 AUDIT TOPICS

C1. What is a SAS 70 audit?

C2. What is the background of SAS 70?

C3. How are SAS 70 and the Sarbanes-Oxley Act related?

C4. Who can perform a SAS 70 audit?

C5. Who uses a SAS 70 audit report?

C6. What are the commonalities and differences between a Type 1 and a Type 2 SAS 70 audit report?

C7. What is contained within a description of controls?

C8. Are there predefined controls that are required to be included in the scope of every SAS 70 audit?

C9. Is a SAS 70 audit a type of security audit?

C10. Does a SAS 70 audit result in a certification?

C11. Can computer software be SAS 70 "certified"?

C12. How can I obtain a copy of the SAS 70 audit standard?

ADVANCED SAS 70 AUDIT TOPICS

D1. What is the proper report date timing for a Type 1 SAS 70 audit?

D2. What is the proper review period timing and length for a Type 2 SAS 70 audit?

D3. Can the scope of a SAS 70 audit be changed during the course of the audit?

D4. Can we provide our SAS 70 audit report to any third party, or is the report distribution restricted?

D5. Should recommendations issued by a service auditor be included in the SAS 70 audit report?

D6. Can our organization enter into an arrangement whereby a non-CPA firm (i.e., a consulting company) performs a significant portion of the SAS 70 testing procedures and a CPA firm signs the audit opinion?

D7. Can a user auditor rely on a SAS 70 audit report if the SAS 70 audit was performed by the user auditor's firm?

D8. Should prewritten audit workprograms be used to perform portions of a SAS 70 audit?

D9. My organization's services are delivered, in part, by a third party. How might this impact my organization's SAS 70 audit?

D10. What is the difference between Type 2 SAS 70 audits and Trust Services Reviews (i.e. SysTrust & WebTrust)?

D11. What is the difference between a Type 2 SAS 70 audit and an ISO 9001, 27002 or 27001 compliance review?

D12. What is the difference between a Type 2 SAS 70 audit and a BITS Financial Institution Shared Assessments Program (FISAP) evaluation?

D13. I am a service organization located outside of the United States. Is there an equivalent audit available in my country?

Contact Us
To discuss how we can help your organization,
call us toll-free at 1.866.254.0000 or
send us an e-mail.

Request a Consultation

Request a Rapid Quote

Submit an RFP

Client Login | Terms of Use | Privacy Policy | Contact Us