How is SAS 70 related to the Sarbanes-Oxley Act?
After several public companies were charged with fraud and negligence, the Sarbanes-Oxley Act of 2002 (SOX) was implemented. Section 404 of SOX requires independent auditors to assess and express an opinion on the effectiveness of its clients’ internal controls over financial reporting, including service organization controls. Internal controls are the safeguards companies apply to ensure that financial reporting is reasonably accurate and free of significant misstatements, errors, and fraud. They include business process controls and IT security practices. Many public companies outsource functions of their business to third parties (service organizations). Frequently those functions constitute a key element of the financial reporting process. Therefore, the service organization must be included in the SOX 404 assessment.
