SAS 70 Services

Entities need to accomplish various tasks to run their business, many of which have an effect on their financial statements. Often times, organizations rely upon service organizations to accomplish such activities. Services range from supporting a particular function to replacing entire business units. Auditors of user entities might require information about the type of service and the controls in place in the external service organization in order to gauge the effect that these services have on the financial statements of the entity. This information is provided by means of a SAS 70 review.

So what are the types of service organizations that require SAS 70 reviews to be performed? Broadly stating, a SAS 70 is applicable to any service organization whose service is part of the user entity's information system. ERM can help by providing a comprehensive description of controls related to specific areas of operation and an assessment of the design and operating effectiveness of control structures. Service organizations can then forward our reviews to clients for their use. ERM can also perform these reviews directly for companies who use service organizations to help ensure that controls surrounding the operations of their service providers are working adequately.