What is included in a description of controls?
This is normally the longest section of the SAS 70 report. The description of controls is managements discussion of the controls, policies & procedures and organization of the company. The description should provide the reader with enough detail information about the service organizations controls to gain an understanding of how things work. Service organization controls are considered a component of a user organizations internal control, therefore a user auditor is concerned with a service organizations controls.
