Can computer software be SAS 70 “certified”?
SAS 70 audits are generally performed for service providers, and primarily outsourcing organizations. In many ways, software companies are manufacturing companies and are not service providers. We are unaware of any manufacturing organizations that have had a SAS 70 audit performed for their product(s). Software companies manufacture software for sale to customers. Once sold, the controls over the administration of the software are designed, implemented and maintained by the company that purchases the software. There is a general assumption that the product works as described. The responsibility for implementing the controls built into the software rests with the purchaser. The best evidence that software is not a candidate for SAS 70 certification can be found with the most well-known ERP software applications. Applications developed by major companies such as Oracle, SAP, PeopleSoft, and Lawson are not SAS 70 “certified”. These are the most widely used ERP systems in the world. Every
