What is the usability of third party assurance reports like SAS 70?

In response to the need to understand the service providers’ control environment, companies turn increasingly to requesting a Statement on Auditing Standards number 70 (SAS 70) report.

SAS 70 is based on SAS 55 (Consideration of Internal Control in a Financial Statement Audit) and on the Committee of Sponsoring Organisations of the Treadway Commission (COSO) framework. SAS 70 reports come in two formats: Type I and Type II. Type I is a description of control activities while Type II includes the testing of controls over a period of time (typically six months).

The SAS 70 is actually a hybrid audit that includes many of the audit objectives performed during operational audits with a close secondary focus on the information technology that supports the business process and may even include elements of financial audits.

A SAS 70 can be useful, but only when it is applied with care. Some of the issues are:

• If the service provider defines the scope itself, it is likely to include those controls with which it feels comfortable. So the client itself has to define the scope of controls/assets/processes etc that have to be audited.
• If there are no issues reported in the SAS 70 report it is likely that the service provider selected the scope very carefully and did not include complex process activities as they are more likely to show issues over time (in case of a Type II SAS 70 report).
• Some service providers may market themselves as being SAS 70 compliant but there is no such thing as a SAS 70 compliant organisation. SAS 70 does not pre-define standard controls that should be included in the report, this is up to the service provider and the client. This in contrast to for example ISO27001 but part of the disadvantages of SAS 70 are also applicable to ISO27001.
• The SAS 70 review is a standard guideline, not a standard audit program. The Big 5 do not use rigid review programs with a fixed audit scope. This is why one SAS 70 review may appear different from others.
• SAS70 is typically provided once a year which makes it a very reactive control.

Recommendation
Ensure you are closely involved in scoping or processes, controls, assets, countries et cetera.

Do not rely on the standard report provided by the supplier for high risk area’s (typically type 1 report is for free) and ensure your scope is included in their standard report.

Products and services that are higher in risk require greater control scrutiny, while products and services with low inherent risk may not require as much attention. Define the scope of the SAS70 accordingly.

SAS70 is one of your assurance mechanisms (and an expensive one at that), so use it sensibly. More on the alternatives of SAS70 reports, including my view on ISA 402 and ISEA 3402 here.