INFORMATION SYSTEM AND COMPUTERS

STATEMENT OF AUDITING STANDARDS

FOR SERVICE ORGANISATION

IntroductionStatement on Auditing Standards No.70: Service Organizations, commonly abbreviated as SAS 70 is an auditing statement issued by the Auditing Standards Board of American Institute of Certified Public Accountants(AICPA), officially titled “Reports on the Processing of Transactions by Service Organizations”. SAS 70 defines the professional standards used by a service auditor to assess the internal control of a service organization and issue a service auditor’s report.

Meaning of SASSAS 70 (the Statement on Auditing Standards No. 70) defines the standards an auditor must employ in order to asses the contracted internal controls of a service organization. Service organizations, such as hosted data centers , insurance claims processors and credit processing companies, provide outstanding services that affect the operation of the contracting enterprise.

Under SAS 70 (the Statement on Auditor reports are classified as either Type I or Type II. In a Type I report the auditor evaluates the efforts of a service organization at the time of audit to prevent accounting inconsistencies, errors and misrepresentation. The auditor also evaluate the likelihood that those efforts will produce the future results. A Type II report includes the same information as that contained in a Type I report; in addition, the auditor attempts to determine the effectiveness of agreed-on controls since their implementation. Type II reports also incorporate data complied during a specific time period, usually a minimum of six months.

1. Statement on Auditing Standards (SAS) No. 70, Service Organizations, in an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants(AICPA).

2. SAS 70 provides guidance to enable an independent auditor (“service auditor”) to issue an opinion on a service organization’s description of controls through a Service Auditor’s Report.

3. Service auditors are required to follow the AICPA’s standards for fieldwork, quality control, and reporting.

4. A formal report including the auditor’s opinion (“Service Auditor’s Report”) is issued to the service organization at the conclusion of a 70 examination.

CHARACTERSTICS or STATEMENT OF AUDITING standards for service organizations

5. A SAS 70 examination is not a “checklist” audit. SAS No. 70 is generally applicable when an auditor (“user auditor”) is auditing the financial statements of an entity (“user organization”) that obtains services from another organization (“service organization”). Service organizations that provide such services could be application service providers, bank trust departments, claims processing centers, Internet data centers, or other data processing service bureaus.

6. A SAS 70 audit or service auditor’s examination is widely recognized, because it represents that a service organization has been through an in-depth audit of their control activities which generally include controls over information technology and related processes.

Type I SAS 70 audits opinion on controls that are in place of a date in time. The opinion deals with the fairness of presentation of the controls and the design of the controls in terms of their ability to meet defined control objectives. Since these reports only provide assurance over a single day, they are of limited value to third parties. Type II SAS 70 audits opinion on controls that were in place over a period of time, which is typically a period of six months or more. The opinion deals with fairness of presentation of the controls, the design of the controls in terms of their ability to meet defined control objectives, and the operational effectiveness of those controls over the defined period. Third parties are better able to rely on these reports since verification is provided regarding these matters for a substantial period of time.

TYPE I AND TYPE II AUDIT STANDARDS

1. A service auditor’s report ensure that all user organization and their auditors have access to the same information and in many

cases this will satisfy the user auditor’s requirements.2. SAS 70 engagements are generally performed by control oriented

professionals who have experience in accounting, auditing, and information security.

3. A service auditor’s report with an unqualified opinion that is issued by an independent accounting firm differentiate the service organization from its peers by demonstrating the establishment of

effectively designed control objectives and control activities.4. A SAS 70 engagement allows a service organization who have its

control policies procedures evaluated and tested (in the case of a TYPEII engagement) by an independent party

5. A service auditor’s report also helps a service organization build trust with its users organizations (I.e. Customers).

BENEFITS OF THE SERVICE ORGANIZATION

THANK YOUBy MAMATHA