What are the primary differences between a SAS 70 Type I and Type II engagement?
A Type I report simply is issued for a particular date. For example, an accounting firm would examine a company’s controls and report on the processing of transactions and these controls for a specified point in time, such as June 1, 2007. A Type II report is issued after a minimum six-month testing period has been completed. For example, an accounting firm would examine a company’s controls from June 1, 2007, to November 30, 2007, and report on the controls placed in operations and tests of operating effectiveness for that same period. Unlike a Type I, which consists of inquiry and observation of controls, a Type II would include testing of controls.
