What are the two different types of SAS 70 audit reports?
The two different types (commonly referred to as Type I and Type II reports) represent the two levels of assurance the SAS 70 audit provides. The Type I report, named a Report on Controls Placed in Operation, provides user organizations and their auditors limited assurance that the controls of the service organization exist covering the reporting timeframe (also known as the period of review). The Type II report, named a Report on Controls Placed in Operation and Tests of Operating Effectiveness, provides user organizations and auditors information regarding the service organizations controls and that the controls are operating as reported during the period of review.
