Who Can Perform A SAS 70 Audit?
Only a licensed CPA firm can perform a SAS 70 audit. Generally speaking, the CPA firm must be licensed in the state where the audit will be performed in order for the report to be valid. Additionally, the American Institute of Certified Public Accountants (AICPA), as well as the Public Company Accounting Oversight Board (PCAOB), require that the audit firm be reputable, possess the necessary competence to perform a SAS 70 audit, and meet standard independence requirements for independent external auditors. Service organizations are advised to avoid the use of CPA firms that do not have the in-house capabilities to perform a SAS 70 audit. A CPA firm that outsource portions of an attestation engagement to unlicensed third parties introduce legal, liability and professional competence issues that are detrimental to the service organization and that may impact the validity of the SAS 70 audit report.
