The cost of a SAS 70 audit/examination largely depends on the amount of time that it takes the service auditor to perform the necessary procedures to render an opinion on the controls placed in operation and the tests of operating effectiveness.

A SAS 70 audit/examination is an in-depth evaluation of a service organization's controls. A SAS 70 examination is not a "checklist" audit. During a SAS 70 examination, the service auditor spends a considerable amount of time reviewing documentation on control processes; conducting inquiries with personnel; observing the existence and performance of controls; and inspecting evidence that supports the operating effectiveness of a control. In addition to performing the necessary audit procedures, the service auditor prepares a summary report that contains the independent service auditor's opinion, the service organization's description of controls, and, in the case of a Type II SAS 70, a summary of the tests performed and the results obtained. Professional service firms that are members of the AICPA also have internal quality control procedures related to the review of working papers and the final audit report that must be completed prior to issuing the service auditor's report to management.

Professional service firms typically bill by the hour based on the level and experience of the Staff conducting the audit. SAS 70 audits usually require experienced professionals that understand auditing, business processes, controls, and technology. Internationally recognized public accounting firms generally have the broadest experience in these areas. There are some regional CPA firms that also have the skill set necessary to conduct a SAS 70 audit.

Service organizations that have to provide the results of a SAS 70 audit to a large number of customer organizations may want to consider passing some of this cost along to the customer organizations as an additional fee.

If you need further information, contact us.

Comments are closed