19.  How does a service organization "pass" or "fail" a SAS 70 audit?

At the conclusion of a SAS No. 70 service auditor's examination ("SAS 70 audit"), the service auditor renders an opinion on the following:

1. Whether or not the service organization's description of controls is presented fairly.
2. Whether or not the service organization's controls are designed effectively.
3. Whether or not the service organization's controls are placed in operation as of a specified date.
4. Whether or not the service organization's controls are operating effectively over a specified period of time. (Type 2 only)

When the service auditor concludes that the above items have been accomplished, the service auditor renders what is referred to as an "unqualified opinion."  While a SAS 70 audit is technically not a "pass" or "fail" audit, the receipt of an unqualified opinion from the service auditor is often referred to as "passing" the audit.

When the service auditor's procedures reveal exceptions or control deficiencies, the service auditor may conclude that a control objective could not be achieved due a design deficiency or an operating effectiveness deficiency.  When this occurs, the service auditor will "qualify" the opinion to indicate that a control objective could not be achieved.  The receipt of a qualified opinion from the service auditor is sometimes referred to as "failing" the audit.  This view of audit failure is also technically not accurate, because a qualified opinion does not necessarily imply that other control objectives could not be achieved.  For example, a service organization might have 15 control objectives, and the service auditor may conclude that one (1) of the 15 objectives could not be achieved.  While the opinion would be "qualified", the other 14 objectives would be achieved, and would still be of benefit to the users of the service organization.

If you need further information, feel free to send an e-mail to: info@sas70.com.