Is it possible to “fail” a SAS 70 audit?
A SAS 70 audit does not result in a “passing” or “failing” grade. Rather, every report contains an opinion letter issued by the service auditor. An “unqualified” opinion is issued when the service auditor determines that: • The service organization’s description of its controls presents fairly, in all material respects, the relevant aspects of the service organization’s controls that had been placed in operation as of a specific date; • The controls were suitably designed to achieve specified control objectives; and, • For Type 2 SAS 70 audits only, that the controls that were tested were operating with sufficient effectiveness to provide reasonable, but not absolute, assurance that the control objectives were achieved during the period specified. A “qualified” opinion may be issued when the service auditor determines that one or more of these requirements has not been met. Qualification simply means that an explanatory paragraph is inserted into the standard opinion letter wording des
