SAS 70 Certification | Expert Advice on Pricing and Audit Scope | Type I and Type II Audits

SAS 70 certification (more technically known as SAS 70 "compliance") is gaining momentum and recognition in many industries today. The growth of regulatory compliance, security and governance has pushed SAS 70 audits to the forefront of business, and it's not going away.  Rather, we will continue to see a upswing in SAS 70 audits performed on organizations along with growth in almost any type of audit or assessment revolving around internal controls.

Thus, there are some basic elements that you should be aware of regarding SAS 70 audits if your organization is to embark on SAS 70 Type I or Type II compliance.

First and foremost, find a CPA firm that provides a Fixed Fee for the audit; a fee which include all out of pocket and travel related expenses.  

Second, properly identify the scope of the audit, which will entail the following:

1. Is our organization undertaking a Type I or a Type II audit?

2. If a SAS 70 Type II audit, what is the test period?

3. Is the audit simply a general controls SAS 70 audit or are their specific business process provisions that will be included in the scope of the audit?

4. What physical locations will be included in the audit (i.e., other offices around the country, data centers or any other third party providers our organization uses for services)?

5. How will our auditors conduct actual testing and what practices do they employ (audit sampling, what frameworks are utilized for the audit, what input if any will the auditors have in helping to develop our control objectives for the audit).

If you want to receive a sample SAS 70 audit or learn more about the auditing standard, visit the Official SAS 70 Resource Guide.