Can the scope of a SAS 70 audit be changed during the course of the audit?
Defining the scope of a SAS 70 audit is entirely the responsibility of the service organization. Service organizations may change their control objectives at any time during the course of an audit. This includes the addition new control objectives, deletion of existing control objectives, and the modification of current control objectives. Service organizations may also add, modify or delete the control activities included in the scope of the audit at any time prior to the conclusion of the audit. The service auditor’s approval is not required to change the scope of an audit. Normally, a service organization would modify the audit scope in order to increase the relevance of the report to user organizations and to more accurately reflect the state of current controls. Most modifications or additions of controls will result in notations informing the reader of the report that the control was not in place in its current state throughout the entire review period. Other types of scope chang
