SAS 70 CPA

The SAS 70 process is complex and time consuming and must be performed by qualified and experienced professionals. Like any outsourced service agreement, there are those who may believe that it was designed to simply create billable hours. For organizations that are not prepared or who are working with auditing firms with large overhead, it may feel that way.

However, at SAS 70 CPA, we differentiate ourselves by bringing highly qualified and experienced staff to each engagement. We are not training junior staff on your time. Our professionals have conducted many SAS 70 audits for organizations of all industries and sizes.

To minimize cost, meet expectations, and avoid disrupting your business, SAS 70 CPA has developed a structured approach and engagement process that emphasizes efficiency, commitment, and a keen desire to meet our client's objectives. Each phase is executed in a thoughtful and diligent manner, producing the results and content ultimately needed to issue a SAS 70 service auditor's report.

The SAS 70 Approach

We feel that creating lasting relationships with our clients is the most essential aspect of a business. It is important for us to understand each client’s business and support their corporate values.

We work closely with each client to determine the project objectives:

1. Visionary Objectives – What does the client see as a result of the completion of this project?
2. Business Objectives – What are the specific requirements and needs of the client, and how can we assist in exceeding client expectations, accomplishing the audit in the agreed-upon time, and at an extremely competitive price?
3. Setting Stage Goals – How can we work around our client’s schedule to minimize disruption to their staff and day-to-day business activities?

Through communication and collaboration with our clients we are able to develop a specialized plan to successfully complete the project and meet the goals and expectations that were determined.

Phase I – Planning & Inquiry Stage

Kick off - We actively identify and examine all critical elements necessary for the engagement's success during this initial phase. A member of our Audit Team will communicate upfront with the client to gain an understanding and commitment with respect to the following issues:

• Discuss expectations and objectives of auditor and client
• Discuss and finalize client resources and availability
• Review tentative milestone dates
• Conduct inquiry into systems and processes

Scoping Assessment - Our Audit Team will extensively identify all elements within your organization bearing a relationship or connection to the activities associated with your engagement. One of the most important factors of a quality Service Auditor’s report is that it addresses the needs and concerns of your clients. We will examine all significant general and application controls within the supporting systems such as:

• The organization's control environment and corporate tone
• The Systems Development Life Cycle (SDLC) of the specific program or platform that is currently being implemented
• The organization’s operational processes
• The data center (hosting environment) and surrounding hardware and software applications

If your organization has requested a Type II audit, which calls for the design and testing of the general and application controls within the supporting systems over a 6-12-month period, our audit team will work closely with your employees to assist you in designing appropriate controls that require substantive testing. This becomes an engaging and collaborative session where our firm and your team can collectively build a working relationship in determining all the components that are associated with your supporting systems.

Phase II - Preparation Stage

Preparation for Audit Fieldwork

• A draft of control objectives is sent to the client for approval
• Document exchange portal is created with list of approved control objectives
• Tasks are assigned to client for collecting audit artifacts
• Tasks are completed in preparation for onsite fieldwork

Phase III – Fieldwork Stage

• Auditors travel onsite to conduct fieldwork
• After careful observation, the Audit Team will create a list of deficiencies, propose remediation for controls, and document all information and activities during this period. If control remediation is necessary, we will actively work with your employees to assist them. This normally concludes the field work for a Type I.
• If your organization has requested a Type II, the Auditor will conduct the testing of controls. All controls will be tested for effectiveness, and controls requiring remediation will be corrected.

Phase IV – Report Drafting Stage

Report Drafting & Quality Assurance Procedures

• Auditor composes the draft of the Service Auditor’s Report
• Draft is submitted to SAS 70 CPA Management for quality assurance procedures
• SAS 70 CPA Management will review the audit work papers in conjunction with the draft of the report. Once the draft has received final approval from management it is issued to the client for management review.
• The client’s management team is given the opportunity to provide SAS 70 CPA with feedback and requested modifications.

Phase V – Closing Stage

• Report receives final approval from client
• Management Representation Letter is received from the client
• Requested number of reports are printed and shipped with the appropriate Completion Certificate
• A certification seal is sent to client for business development purposes