Does SAS 70 Apply to Business Process Outsourcing?
The nature of the business process that is to be outsourced will determine whether or not SAS 70 applies. As mentioned above, the question to ask is, whether or not the business process affects the company’s internal control over financial reporting. Since a wide variety of business processes will affect the processing of financial and related information of a company, it is likely that SAS 70 will apply to a wide variety of business process outsourcing (BPO) arrangements, including the outsourcing of finance and accounting related functions (e.g., payroll and credit processing). Accordingly, SAS 70 is as, if not more, likely to affect BPO arrangements than IT outsourcing arrangements. Are There Any De Minimis Levels? The position that many large companies now take is that all material outsourcings are covered by SAS 70, and so there is a requirement for an SAS 70 audit in respect of all key relevant outsourcings. There are no de minimislevels in determining whether an SAS 70 audit oug
