Benefits To Service Organizations
Service organizations receive significant benefits and value from having a SAS 70 audit performed. A Service Auditor's Report with an unqualified opinion that is issued by an Independent Accounting Firm differentiates the service organization from its peers by demonstrating the establishment of effectively designed control objectives and control activities. A Service Auditor's Report also helps a service organization build trust with its user organizations (i.e., customers).
Without a current Service Auditor's Report in hand, a service organization may have to entertain multiple audit requests from its customers and their respective auditors. Multiple visits from user auditors can place a strain on the service organization's resources. A Service Auditor's Report ensures that all user organizations and their auditors have access to the same information and in many cases this will satisfy the user auditor's requirements. A Type II service auditor's report will also allow the user organizations and the user auditors to possibly place reliance on the controls at the service organization. This can be a significant component to the user auditor's control evaluations and the user organization's own assessments of internal control over financial reporting.
SAS 70 engagements are generally performed by audit, risk, and control oriented professionals who have experience in accounting, auditing, and information security. A SAS 70 engagement allows a service organization to have its control policies and procedures evaluated and tested (in the case of a Type II engagement) by an independent party. Very often this process results in the identification of opportunities for improvements in many operational areas.