8.  Can a SAS 70 audit be performed outside of the United States?

Yes, a SAS 70 audit can be performed outside of the United States.  The audit engagement would have to be performed by a firm based in the United States that subscribes to the professional standards as promulgated by the American Institute of Certified Public Accountants (AICPA).  As noted elsewhere on this site, the SAS 70 auditing standard provides specific guidance to the CPA firm conducting the service auditor engagement.

For example, a CPA firm based in New York may provide SAS 70 audit services to a multi-national Company based in the United States.  As part of the engagement, the CPA firm's professionals may have to travel to various international locations to complete the audit procedures.  If the CPA firm had local offices in the international locations, resources from those offices could participate in the engagement as long as the engagement remained under the direction and supervision of the office based in New York.  The SAS 70 guidance would still apply to procedures conducted at the international locations as long as the final report was issued by the New York based CPA firm.

There are many other countries that also have auditing standards similar to SAS 70.  For example, the Canadian Institute of Chartered Accountants (CICA) addresses service auditors' engagements in the CICA Handbook - Assurance Section 5900, "Opinions on Control Procedures at a Service Organization."  Section 5900 would provide guidance to a Canadian "chartered accountant" (similar to CPA) who wants to perform an audit of a service organization's controls.

If you need further information, feel free to send an e-mail to: info@sas70.com.