SAS 70 Type I Audits

At the end of the Readiness Review, SC&H will be able to perform a SAS 70 Type I audit for the service organization.  One of the main benefits of a Type I report is to demonstrate to clients and prospects that the service organization has started the process that will lead to the SAS 70 Type II report.  Since the AICPA standard requires that a SAS 70 Type II report must cover a minimum time period of six months, the Type I report is provided to clients and prospects while the Type II time period is taking place. 

In preparation for the SAS 70 Type I audit, SC&H recommends that service organizations ensure that each control activity has a corresponding policy and procedure that details the technical control description, SAS 70 control narrative, control owner, SAS 70 testing procedures, and document management procedures for evidencing that the control is operating effectively.  SC&H assists service organizations to ensure that technology is leveraged in the operation and documentation of the SAS 70 controls to reduce the risk of testing exceptions during the Type II time period.

The service organization’s SAS 70 Type I report documents that the business process and information technology controls are effectively designed and implemented as of a point in time.  SC&H will express an opinion on the fairness of the presentation of the service organization’s description of controls that have been implemented.  SC&H will also express an opinion on whether the controls were effectively designed to achieve specified control objectives at a specific point in time.

For more information on our Readiness Reviews and/or SAS 70 Type II audits, please click the appropriate links.