SAS 70 / SSAE 16 User Control Considerations

Posted by on Jan 24, 2011 in Blog | 0 comments

What are user (also known as client or customer) control considerations and why are they in most SAS 70 / SSAE 16 audit reports? User control considerations or UCCs in the audit jargon are simply controls that reside at the service organization. These controls are usually delineated in the SAS 70 / SSAE 16 reports within their own report sub-section and/or next to the control objectives they...

Read More

SAS 70 / SSAE 16 Audit – Type I vs Type II

Posted by on Jan 12, 2011 in Blog | 0 comments

What are the differences between a Type I and a Type II SAS70 / SSAE 16 audit report? This question often comes up when a service organization is considering their first SAS 70 / SSAE 16 audit. A Type I report is as-of a point in time (eg, September 30th) whereas a Type II report covers a period of time (eg, October 1, 2010 – September 30, 2011).  Also, a Type I report only cover the...

Read More

Testing Exceptions

Posted by on Jan 5, 2011 in Blog | 0 comments

What are testing exceptions and what is their role in the SAS 70/SSAE 16 audit? Testing exceptions are simply deviations from the expected result from testing one or more control activities. Consider the following example: Control Objective: Controls provide reasonable assurance that statement processing is appropriately scheduled and that deviations in processing are identified and...

Read More