The SAS 70 process is complex and time consuming and must be performed by qualified
and experienced professionals. Like any outsourced service agreement, there are
those who may believe that it was designed to simply create billable hours. For
organizations that are not prepared or who are working with auditing firms with
large overhead, it may feel that way.
However, at IS Partners, we differentiate ourselves by bringing highly qualified
and experienced staff to each engagement. We are not training junior staff on your
time. Our professionals have conducted many SAS 70 audits for organizations of all
industries and sizes.
To minimize cost, meet expectations and avoid disrupting your business, IS Partners
has developed a structured, four-step engagement process that emphasizes efficiency,
commitment, and a keen desire to meet our client's objectives. Each phase is executed
in a thoughtful and diligent manner, producing the results and content ultimately
needed to issue a SAS 70 service auditor's report.
I. Scope Assessment
We actively identify and examine all critical elements necessary for the engagement's
success during this initial phase. A member of our Audit Assurance Team will communicate
upfront with the client to gain an understanding and commitment with respect to
the following issues:
• Inquiry of systems and processes
• Engagement costs
• Employee involvement
• Tentative milestone dates
II. Inquiry and Observation
Our Audit Assurance Team will extensively identify all elements within your organization
bearing a relationship or connection to the activities associated with a SAS 70
engagement. Specifically, we will inquire about the following:
• The organization's control environment and corporate tone
• The Systems Development Life Cycle (SDLC) of the specific
program or platform
that is currently being implemented
• The data center (hosting environment) and surrounding
hardware and software
applications
III. Internal Control Examination
During this phase, we will examine all significant general and application controls
within the supporting systems. After careful observation, the Audit Assurance Team
will create a list of deficiencies, propose remediation for these very controls,
and document all information and activities during this period. If control remediation
is necessary, a period usually lasting no more than one week is allotted to give
your organization the time and resources to correct or strengthen the various internal
controls. Immediately thereafter, a final walk-through and examination of all internal
controls would then be conducted. This would effectively conclude the field work
for a SAS 70 Type I, resulting in an opinion on the description of controls and
an issuance of a Type I Service Auditor's Report.
IV. Design and Testing
If the engagement moves into the next phase, then your organization has requested
a SAS 70 Type II audit, which calls for the design and testing of the general and
application controls within the supporting systems over a six-month period. We will
actively work with your employees to assist in designing controls that require subsequent
testing. This becomes an engaging and interactive session where our firm and your
employees collectively build a true working relationship in assessing all the elements
associated with supporting systems. Following this process, all controls will be
tested for effectiveness and controls requiring remediation will be corrected. All
fieldwork will be documented, which aides the Audit Assurance Team for the issuance
of a SAS 70 Type II Service Auditor's Report.