What are the contents of a SAS 70 report?
SAS 70 reports (Service Auditor’s Reports) are generally divided into three or four sections depending on the type of engagement performed. There are two types of Service Auditor’s Reports: Type I and Type II. A Type I report describes the service organization’s description of controls at a specific point in time (e.g. June 30, 2000). A Type II report not only includes the service organization’s description of controls, but also includes detailed testing of the service organization’s controls over a minimum six month period (e.g. January 1, 2000 to June 30, 2000).
