Are there different types of SAS 70 audits?
There are two different types. Type I is simply a report on controls placed in operation. All it really says is the service company says controls are in place, and the auditor has looked and agrees with them that controls are in place, but no testing has been done. A perfect example is if someone says they have a lock on their server room door. For a SAS 70 Type I audit, the auditor would go over, take a look and say, ‘Yep, there’s a lock on that door.’ The auditor doesn’t try to open the door or come back unescorted to see if the door is open. The auditor just makes sure that there is a lock on the door.
