Service Auditors Reports (SAS 70 Report)

Service Auditors Reports, otherwise known as SAS 70 Reports, are the primary service offering of PKM’s IT Assurance Services Group. PKM’s certified IT professionals perform both Type I and Type II SAS 70 audits for clients in numerous industries.

While most SAS 70 service providers began to offer SAS 70 services as a result of Sarbanes-Oxley, PKM has been providing SAS 70 services since the early 1990s as a natural augmentation of our bank audit practice, which provided us with a deep knowledge of the industry. The processing surrounding banks and the agencies that oversee the banking industry have long required SAS 70 Reports for organizations that provide significant data processing services to banks.

The firm’s core IT Assurance Services Group consists of Certified Public Accountants (CPA), Certified Information Systems Auditors (CISA), Certified Information Systems Security Professional (CISSP) and technical security experts with specialized IT knowledge to perform high-quality work for our clients. The firm’s experienced technology professionals have performed numerous SAS 70 examinations and pre-assessment procedures for data centers throughout the country, but particularly within the banking industry.

SAS 70 Overview

Statement on Auditing Standards (SAS) No. 70 for Service Organizations is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). These independent reports are issued at the conclusion of an SAS 70 audit engagement by Certified Public Accountants with experience in accounting, auditing and information systems. SAS 70 Reports come in two types:

• Type I: Outlines an organization’s control description at a specific point in time (such as March 30, 2006).
• Type II: Outlines an organization’s control description as well as detailed testing of the organization’s control over a six-month period (such as June 1, 2006 through December 31, 2006).

Benefits of SAS 70 Reports

Service organizations receive significant value from SAS 70 Reports. A report that demonstrates the establishment of effectively designed control objectives and activities can differentiate the organization from its peers and build trust with its clients and their regulators. In most cases, an SAS 70 Report will also satisfy regulators by serving as a readily available, single source of information. This prevents an organization from having to entertain multiple audit requests from clients and their auditors, thereby eliminating the strain on the organization’s resources imposed by multiple visits. In addition, the SAS 70 process often results in the identification of improvements in operational areas, making the organization more efficient. Making SAS 70 Reports available to your clients provides them with a detailed description of your organization’s controls and an independent assessment of whether the controls were in operation, suitably designed and operating efficiently. As an added benefit, these reports are useful to your clients' auditors to assist in the planning and audit of their financial statements.

The Benefits of Using PKM

PKM performed its first SAS 70 examination in 1994 and has grown that practice from one small transaction processor for community banks located in rural Georgia to a practice with SAS 70 clients throughout the United States. We have been able to develop that practice, in part, due to the firm’s professional expertise of financial institutions and insurance companies. The other factor that is responsible for fueling that development is our investment in excellent people with strong technical and business backgrounds. Building on those factors, we have been able to expand our expertise to encompass specialty third-party administrators, credit card processing clearing houses, Internet banking and bill payment operations, and a variety of Internet intrusion detection and prevention service providers.

Our approach to these audits is to provide on-site expertise that enables us to address the needs of our clients and the users of their services. While many newer firms that provide SAS 70 audits take a very cookie-cutter approach, our process allows us to get to know your business and the resulting report is focused on the needs of your users/clients.

With PKM, you can be assured of getting a significant amount of technical expertise on-site and working directly on your SAS 70 examination engagement. While we will need to become acquainted with your business and how it operates, our professionals are well-trained and well-supervised. This enables us to run efficient engagements in a manner that is least disruptive to your organization.

PKM believes that proper staffing of an engagement is crucial; therefore, on each of our engagements you will be assigned a Partner or Senior Manager level professional who is responsible for the overall management of the engagement and an experienced management or senior level professional who will be on-site at all times during the engagement. Within your engagement team there will be at least one Certified Information Systems Auditor. We have made a commitment to providing excellent technical service during all phases of the examination and believe that this approach to engagement staffing enables us to accomplish this goal.

The bottom line is that PKM has significant experience in providing each of these services, and it usually is less expensive, in the long run, to find a "guru" who understands how to audit and what to audit. Industry expertise is also an advantage to clients we serve, and we stack the expertise of our ITAS auditors against any other firm in the country.

Click here to download PKM's SAS 70 brochure.