Who uses a SAS 70 audit report?
Traditionally, SAS 70 audit reports are primarily used as auditor-to-auditor communication. The auditors of the service organization’s customers can use the SAS 70 audit report to gain an understanding of the internal controls in operation at the service organization. Additionally, Type 2 SAS 70 audit reports can be used by the user organizations’ auditors to assess internal control risk for the purposes of planning and executing their financial audit, as well as meeting Sarbanes-Oxley compliance requirements. Every SAS 70 audit report contains an auditor’s opinion letter. The opinion letter is required to contain a paragraph that defines the authorized user of the report. Use of the report is typically restricted to the service organization’s management, its customers, and the financial statement auditors of its customers. Typically, a statement in the final paragraph states: “This report is intended solely for use by the management of XYZ Service Organization, its user organizations,
