1. » Client personnel are introduced to SAS 70 Solutions’ methodology and
      operating procedures
2. » Expectations for the future audit, including time commitments that may be
      necessary from key client personnel, are clearly communicated
3. » An internal-use only report is provided to the client that creates the basis for
      improving the overall control environment
4. » The description of controls is drafted and ready to be used for the
      subsequent SAS 70 audit
5. » Strengths and weaknesses in the current control structure are clearly
      communicated to the client, along with detailed recommendations for
      improvements
6. » The client has sufficient time to remediate any gaps in the control structure
7. » The client has access to obtain immediate responses from SAS 70
      Solutions' professionals regarding the impact potential changes to
      services or controls may have on the upcoming audit
8. » The scope of the subsequent audit, and specifically the control objectives
      and related control activities, are refined based upon the Readiness
      Assessment results

Scope

The anticipated scope of the eventual SAS 70 audit is typically used for the purposes of the Readiness Assessment; however, the service organization’s management may elect to modify the scope of the SAS 70 audit based on the results of the readiness assessment and discussions with the audit team.


Project Execution

To review our methodology for delivering services, please click here.


Deliverables

The primary deliverables of a SAS 70 Readiness Assessment include:

1. » Detailed project plan for the project
2. » Comprehensive questionnaires and an information request list allowing
      service organization personnel to gather documentation in advance of
      fieldwork
3. » A Readiness Assessment report containing the description of controls for
      use in the subsequent SAS 70 audit;
4. » Identification of controls currently in place for each in-scope control
      objective
5. » A prioritized listing of controls that should be considered for
      implementation or enhancement prior to the execution of the SAS 70 audit
6. » Detailed management recommendations regarding all issues noted
      during the assessment

1. » The service organization seeks a cost-effective method to assess its
      preparedness for an eventual SAS 70 audit
2. » The service organization has not recently undergone a financial or
      regulatory audit of which IT controls were a component
3. » The service organization prefers an internal-use only report for the
      purposes of identifying any current controls deficiencies
4. » The service organization plans to perform a Type 2 SAS 70 audit as its
      initial audit