SAS 70 reports (Service Auditor's Reports) are generally divided into three or four sections depending on the type of engagement performed. There are two types of Service Auditor's Reports: Type I and Type II.

A Type I report describes the service organization's description of controls at a specific point in time (e.g. June 30, 2000). A Type II report not only includes the service organization's description of controls, but also includes detailed testing of the service organization's controls over a minimum six month period (e.g. January 1, 2000 to June 30, 2000). The contents of each type of report is described in the following table:

  • Section Contents

  • Type I Report

  • Type II Report

  • 1. Independent Service Auditor's Report (i.e. audit opinion)
  • Included
  • Included
  • 2. Service organization's description of controls
  • Included
  • Included
  • 3. Information provided by the independent service auditor; includes a description of the service auditor's tests of operating effectiveness and the results of those tests.
  • Optional
  • Included
  • 4. Other information provided by the service organization
  • Optional
  • Optional

If you need further information, contact us.

Comments are closed
germana fusco commented on 29-Sep-2010 01:02 AM
I'd like to know more about this topic for SAS70 "EVIDENCE OBTAINED IN PRIOR ENGAGEMENTS".

I've read that a service auditor may use evidence from prior service auditor’s engagements to reduce the nature, timing, and extent of the tests of
operating effectiveness.

What daoes it mean? I'm doing a Sas70 in Italy. So my testing period in scope is 01.11.2009 - 31.10.2010. Can I use evidence of the prior engagement for which the testing period in scope is 01.11.2008 - 31.10.2009?

Can you help me?

Germana Fusco