How to Get a SAS 70 Report

SAS 70 reports help prove the security of sensitive information to customers and auditors alike.

The Statement on Auditing Standards Number 70 report, commonly called a SAS 70 report, is an audit report for service companies. It is issued by an independent auditor and provides insight into a company's internal control systems, such as safeguards for confidential customer information. SAS 70 statements are issued as either Type I or Type II reports, with the former validating the existence of internal controls and the latter including the auditor's opinion on whether the controls are being used effectively.

Instructions

1. Hire an independent accounting and auditing firm to complete a SAS 70 pre-assessment. This will expose any flaws in your control systems that may lead to a negative SAS 70 report.

2. Make changes to your internal controls based on the suggestions provided through the pre-assessment.

3. Commission an independent auditor to complete either a Type I or Type II report. The auditor can be, although need not be, the same one that completed the pre-assessment.

Tips & Warnings

• Because auditor fees are usually calculated on a per-hour basis, the cost associated with getting a SAS 70 report will vary.

• SAS 70 reports are set to be replaced by Statement on Standards for Attestation Engagements (SSAE) No. 16 on June 15, 2011.

References

• SAS 70: SAS 70 Overview
• Larson Allen CPAs: SAS 70 FAQs

Resources

• AICPA: Video About Service Organization Control Reports