1. » Educate the service organization regarding SAS 70 topics and our services
2. » Consult with the service organization to help identify their individual needs
3. » Agree on the scope of the audit in terms of project type(s), timing, relevant
      control objectives, and fieldwork locations
4. » Finalize an agreement to provide our services

After being engaged by a service organization, the following project stages are utilized for each assessment.


Phase 1:  Planning & Preparation Stage

The planning and preparation stage is the most critical stage of any SAS 70 project.  Our methodology is designed to allow our projects to be as efficient and non-intrusive as possible.  As a result, we are able to reduce our on-site fieldwork time, as well as the time commitments required from our clients' personnel throughout the remainder of the project.  This leads to hard and soft dollar savings for our clients.

This stage normally takes place during the two months preceding the fieldwork stage and is intended to be performed at the client’s leisure.  The key component to a successful project is the conscientious completion of the following steps:

1. » The audit manager contacts client management to discuss roles and set
      expectations for the pending project.
2. » Depending on whether it is a “first-time” audit, the client is asked to
      complete controls questionnaires or to update the prior version of the audit
      report.  In addition, a detailed information request list is completed by the
      client.
3. » The client submits the completed questionnaires (or updated report),
      along with the requested documentation to the SAS 70 Solutions’
      engagement manager.
4. » The engagement manager performs a preliminary review of the submitted
      information and provides feedback, if necessary.
5. » The engagement manager provides the client with a detailed fieldwork
      project plan and makes modifications based on any scheduling or
      resource concerns expressed by the client.

(Standard Duration and Client Time Commitment:  This phase typically spans multiple weeks and requires approximately 16 - 24 hours of collective time commitment from various client personnel.  This time is allocated to the completion of questionnaires or the update to the prior audit report, and for the gathering of requested documentation.)


Phase 2:  Fieldwork Stage

Every SAS 70 project requires on-site fieldwork.  Because a large portion of information and documentation is prepared by the client and provided during the planning and preparation stage, the time requirements placed on client personnel are significantly reduced during the fieldwork stage.  This stage involves an audit team of two or more personnel working on-site for the duration of this phase.  A SAS 70 Solutions audit team is comprised of a shareholder, an engagement manager and one or more senior auditors.

During the fieldwork stage, the following activities are completed:

1. » A kick-off meeting is conducted on the first day of fieldwork between the
      client's key personnel and the SAS 70 Solutions audit team.
2. » Audit team members are assigned one or more control objectives to
      complete during fieldwork.  Audit team members accomplish this task
      according to the project plan and with constant engagement manager
      and shareholder oversight.
3. » As necessary, audit team members perform walk-through and inquiry
      procedures with key client personnel to confirm their understanding of
      the process and control activities related to each of their assigned control
      objective areas.
4. » For an initial audit, audit team members may submit draft control activities
      and the tests (or procedures, in the case of a Type 1 audit) to the key client
      personnel for that control objective area in order to confirm the accuracy of
      their understanding.  Key client personnel confirm that the control activities
      are accurate and comprehensive for the related control objective and that
      proposed testing is appropriate and should be efficient and effective based
      on the client’s knowledge of the controls.
5. » Audit team members assess whether the control activities are suitably
      designed to provide reasonable assurance that the specified control
      objective would be achieved if the controls were complied with
      satisfactorily.
6. » Audit team members perform testing procedures to determine whether the
      controls are in place as of the report date, and for Type 2 audits, whether
      the controls were in place and operating effectively during the review
      period.
7. » Test results are communicated to relevant client personnel, and if
      necessary, discrepancies are resolved.  All testing exceptions are
      confirmed with relevant client personnel prior to the closing meeting in
      order to prevent any surprises to management or misunderstandings on
      our part related to these exceptions.
8. » The audit team conducts a closing meeting with key client personnel on
      the last day of fieldwork.  Issues such as opinion qualifications, testing
      exceptions, recommendations for improvement, outstanding project tasks,
      and the timing of remaining project steps are discussed.

(Standard Duration and Client Time Commitment:  This phase typically spans one to three weeks and requires approximately 20 hours of collective time commitment from various client personnel during each week of on-site fieldwork.  This time is allocated to meetings with audit team members and the gathering of documentation requested for testing purposes.)


Phase 3:  Reporting Stage

SAS 70 Solutions focus on providing SAS 70 services becomes a major differentiator from so many other firms for which such audits are a secondary service line.  We are able to issue final deliverables within four weeks of completing fieldwork, which is significantly faster than the industry norm of two to three months.  We are so confident in our ability to meet this goal that we make it a contractual obligation upon ourselves.

Our ability to provide this level of service involves the following steps:

1. » The SAS 70 audit report is drafted by the audit team following the
      completion of on-site fieldwork.  Extensive quality assurance procedures
      are performed and documented during the drafting process.
2. » The engagement manager reviews the audit workpapers along with the
      draft report and approves it for the engagement shareholder's review.
3. » The engagement shareholder reviews and approves the draft report for
      issuance to the client.  The shareholder  also performs the final review of
      the workpapers during this stage of the project.
4. » The draft report is delivered to the client.  One or more revised drafts are
      issued based on client feedback and requested modifications.
5. » The client approves a final version of the draft report for issuance.
6. » The final report, and any other related deliverables, is issued in various
      formats to the client within five business days of approval.

(Standard Duration and Client Time Commitment:  This phase typically spans four weeks and requires approximately 8-16 hours of collective time commitment from various client personnel.  This time is allocated to the review of the draft report and concludes when approval to issue the final report is communicated to SAS 70 Solutions.)

Ongoing Support

Even though the project is completed, we provide ongoing support services to our clients.  We understand that issues may arise between audit projects.  Our audit team personnel are easily accessible and are quick to respond to client inquiries.  There are no additional fees for consulting with our professionals following the conclusion of a project.  Some of the reasons service organizations choose to use our support services between projects are as follows.

1. » Facilitation of meetings between the service organization and their user
      organizations and user auditors
2. » Consultation regarding the impact of planned operational and system
      changes on future SAS 70 projects
3. » Review of planned or actual changes to controls relevant to the SAS 70
      audit

The vast majority of clients enter into multi-project contracts with our company. For these clients, the methodology for the subsequent audits is virtually the same in all respects as the initial audit.


Please visit our FAQs page to learn more about SAS 70 audit topics.