5. What are the contents of a SAS 70 report?
SAS 70 reports (Service Auditor's Reports) are generally divided into three or four sections depending on the type of engagement performed. There are two types of Service Auditor's Reports: Type I and Type II.
A Type I report describes the service
organization's description of controls at a specific point in time (e.g.
June 30, 2000). A Type II report not only includes the service organization's
description of controls, but also includes detailed testing of the service
organization's controls over a minimum six month period (e.g. January 1,
2000 to June 30, 2000). The contents of each type of report is described
in the following table:
|
|
|
|
| 1. Independent Service Auditor's Report (i.e. audit opinion) | Included | Included |
| 2. Service organization's description of controls | Included | Included |
| 3. Information provided by the independent service auditor; includes a description of the service auditor's tests of operating effectiveness and the results of those tests. | Optional | Included |
| 4. Other information provided by the service organization | Optional | Optional |
If you need further information, feel
free to send an e-mail to: info@sas70.com.