Can we provide our SAS 70 audit report to any third party, or is the report distribution restricted?
Yes, a service organization is free to give their SAS 70 audit report to any third party. Professional standards do not limit service organizations’ ability to distribute their report. A SAS 70 audit report is a “restricted-use report” which typically means that only the service organization, its user organization and their user auditors can rely on the report. Service organizations are free to give the report to any other third party, but such third parties are not supposed to place any reliance on the report and should only use it for informational purposes. Many SAS 70 audit firms misinform their clients when they suggest that a SAS 70 audit report can not be freely distributed. Some audit firms do this in an effort to reduce their own liability exposure related to unauthorized third parties placing reliance on the report, while others simply do not understand the difference between a restricted-use report and a limited distribution report. The professional standard that addresses t
