Service Organizations

Posted by Newel on Apr 13, 2010 in Blog | 2 comments

What are the types of organizations that will receive a SAS 70 audit?

“If an entity uses another organization to perform services that are a part of the entity’s information system”, these other organizations are referred to as “service organizations” (AICPA 2010 SAS 70 Audit Guide 1.17).  There are all types of service organizations that perform numerous and sundry services.  The following is a short list of common types:

• Data center companies
• Hosted application providers (eg, logistics providers,
• Processing companies (eg, payroll, statement, collections)
• 3^rd Party organizations that provide services to insurance companies
• Application development providers (eg, outsourced coding)
• Asset custodians (eg, financial institutions)
• Mortgage servicing

If an entity wants some sort of independent assurance on the design and effectiveness of internal controls on an organization, a SAS 70 is one of the few options available to gain such assurance.  Whenever an entity outsources an important part of its operations to another organization, the question should be at least be raised of how that particular organization demonstrates that it has an effective control environment. This is where a SAS 70 may come into play and may be a useful mechanism for the organization to communicate aspects of its control environment.

Summary: Not all organizations need to have or are even suitable candidates to receive a SAS 70 examination.  Organizations that perform moderate to extensive functions and are part of an entities information system should at a minimum be considered for an examination.