Your Data Center’s SAS 70/SSAE 16 Report is Not Enough

Posted by on Nov 8, 2010 in Blog | 0 comments

Recently, my business partner and I attended a national accounting industry conference with quite a few Software-as-a-Service (SaaS) providers exhibiting their services. For curiosity’s sake and since we are always looking for good clients, we asked them if they had a SAS 70 or SSAE 16 report. The initial answers were straight forward enough though after more questioning the answers were...

Read More

SAS 70/SSAE 16 vs FISAP vs ISO 27002

Posted by on Oct 16, 2010 in Blog | 0 comments

Frequently there is a discussion from service organizations regarding which of these an organization should complete.  Many service organizations get a significant amount of requests related to information technology controls and security. The requests come in different forms, whether it be for SAS 70 reports (changing to SSAE 16 reports after June 15, 2011), completed questionnaires, and...

Read More

Qualified Opinions

Posted by on Mar 9, 2010 in Blog | 0 comments

What is a qualified opinion and what does it mean? A qualified opinion means that either the internal controls were not designed (Type I or II) or operating (Type II only) effectively for one or more control objectives.  Qualified opinions (also known as “dirty opinions” in audit jargon) are actually quite common.  Most service organizations that have received a qualified opinion received...

Read More