Yes, a SAS 70 audit can be performed outside of the United States. The audit engagement would have to be performed by a firm based in the United States that subscribes to the professional standards as promulgated by the American Institute of Certified Public Accountants (AICPA). As noted elsewhere on this site, the SAS 70 auditing standard provides specific guidance to the CPA firm conducting the service auditor engagement.

For example, a CPA firm based in New York may provide SAS 70 audit services to a multi-national Company based in the United States. As part of the engagement, the CPA firm's professionals may have to travel to various international locations to complete the audit procedures. If the CPA firm had local offices in the international locations, resources from those offices could participate in the engagement as long as the engagement remained under the direction and supervision of the office based in New York. The SAS 70 guidance would still apply to procedures conducted at the international locations as long as the final report was issued by the New York based CPA firm.

There are many other countries that also have auditing standards similar to SAS 70. For example, the Canadian Institute of Chartered Accountants (CICA) addresses service auditors' engagements in the CICA Handbook - Assurance Section 5900, "Opinions on Control Procedures at a Service Organization." Section 5900 would provide guidance to a Canadian "chartered accountant" (similar to CPA) who wants to perform an audit of a service organization's controls.

If you need further information, contact us.



Comments are closed
Kumar commented on 15-Jan-2011 10:21 PM
What is the auditing standard equivalent to SAS70 for assessing a data center in India.

Or is it mandatory to get a SAS70 done for the data center to give it to the User organization.

Can you suggest few names of the firms who can do this engagement.
Lipeng commented on 11-Apr-2012 11:15 PM
What is the auditing standard equivalent to SAS70 for assessing a data center in China. Or is it mandatory to get a SAS70 done for the data center to give it to the User organization. Can you suggest few names of the firms who can do this engagement.