Whats the difference between SAS 70 Type I and Type II audits?
A SAS 70 Type I audit provides the auditor’s opinion on controls that are in place on a specific date in regards to the fairness of control presentation, control design and their suitability for meeting the control objectives defined by the service organization. A SAS 70 Type II audit is conducted over a period of time (minimum six months). Like a SAS 70 Type I, in a SAS 70 Type II audit the auditor evaluates control presentation, design and suitability. However, a SAS 70 Type II goes a step further and includes the auditor’s opinion on the operational effectiveness of the controls over the audit period. Because of this, SAS 70 Type II audits provide a greater level of assurance and are generally preferred over SAS 70 Type I audits. SecureFacts: “Breaches by third-party organizations such as outsourcers, contractors, consultants, and business partners were reported by 44 percent of respondents, up from 40 percent in 2007, up from 29 percent in 2006 and 21 percent in 2005. Per-victim co
