Is a SAS 70 audit a type of security audit?
The primary purpose of a SAS 70 audit is not to evaluate the information security controls of an organization; however, topics generally considered to be within the domain of information security are normally included in the scope of every SAS 70 audit. A typical SAS 70 audit examines both application controls and general IT controls. Topics such as logical access controls, application and system change control, cryptography, systems availability and monitoring, telecommunications and network security, and physical and environmental security are integral to application control objectives. In addition, information security related control objectives are often selected by the service organization to specifically highlight these topics that are considered to be of great importance by user organizations and their auditors. Service organizations often have a valid need for both a SAS 70 audit and a security audit. It is critical to understand that only a SAS 70 audit report can be relied up
