Where do service organizations begin if they’ve never had a SAS 70 audit?
Service organizations that have never had a SAS 70 audit usually start off with a pre-assessment consulting engagement. The pre-assessment is designed to determine whether the existing control environment is robust enough to pass the suitably designed component of the auditor’s opinion. Two key components of the pre-assessment include documenting descriptions of the internal controls and identifying control deficiencies. Since many organizations lack extensive written policies and procedures, this is not a trivial task and is typically the most time consuming and expensive part of the SAS 70 audit. Service organizations with a control framework have an advantage because in many cases, it provides the process and control documentation necessary to minimize the effort often required in the pre-assessment phase.
