What is the difference between a SAS 70 Type 1 and Type 2 audit?
Type 1: SAS 70 Type 1 is designed to provide an overview of Service Organizations description of internal controls and processes relevant to their customers. The audit is helpful for Service Organizations to gain an understanding of the control and processes that are designed at the Service Organization. A SAS 70 Type 1 audit has an audit opinion and a description of services relevant to the services under review as of a point in time. What does this mean? An Independent Auditor provides an audit opinion describing that you have controls in place that are designed to meet the objectives of your service. Type 2: SAS 70 Type 2 also provides a description of internal controls and processes relevant to their customers however the auditor also tests these controls over a period of time to verify that the internal controls and process actually occurring as the Service Organization intended. How is this different from a Type 2 report? Since your auditors provide an Opinion about the actual op
