Does a SAS 70 audit result in a certification?
No, a SAS 70 audit does not result in a certification. To describe a service organization as SAS 70 “certified” would be similar to describing a company that completes a financial statement audit as being financial statement “certified”. A SAS 70 audit report opines on a description of controls for a date in time (i.e., Type 1 SAS 70 audits) or for a period in time (i.e., Type 2 SAS 70 audits). The report makes assertions about the state of controls on dates that have already passed. A SAS 70 audit report makes no assertions regarding future dates and it is entirely possible, if not likely, that controls described in the report will change following the conclusion of the audit. Although it is technically inaccurate to refer to a SAS 70 audit as a “certification”, the term has become generally accepted in the marketplace. Regardless of the service organization’s claims of “certification”, it is important to realize that SAS 70 audit reports are only valuable if they are current and the
