Publications

• 30 Second Ideas
• Accounting Updates
• Alerts
• Articles
• Business Surveys
• Construction Edge
• Healthcare Edge
• Insurance Edge
• Legal Talent
• Manufacturing Edge
• Not-for-Profit Edge
• Quick Links & Good Ideas
• SEC Edge
• Strategy Insights Blog
• Surviving the Upturn
• Tax Highlights

Article Author:

Important SAS 70 Internal Control Reporting Changes and Their Impact on Service Organizations

Timothy R. Bowling, CPA, Partner
tbowling@BlackmanKallick.com, 312-980-2927

Significant changes to SAS 70 internal control reporting are in the works, and they'll impact not only the way the reports are used, but also how your auditor performs their tests and how your company is required to participate in and prepare for its audit.

The changes

The Auditing Standards Board (ASB) of the American Institute of Certified Public Accountants (AICPA) recently issued a draft of the new auditing standards. Key changes will require service organizations to perform the following:

• Issue written assertions accompanying its description of the control environment as to the fair presentation, suitability of design and operating effectiveness of the control environment
• Prepare independent risk assessment documentation and other audit evidence to support its written assertion
• Perform ongoing monitoring activities and/or separate evaluations, which might be derived from regular management and supervisory activities performed in the normal course of business, rather than independent testing of its internal controls to affirm its written assertions

Additional changes include the following:

• Revised service auditor reports, opining as to the reasonableness of management's assertions. This concept is similar to audit engagements performed on internal control of large, publicly traded enterprises as required by the Sarbanes-Oxley Act of 2002.
• Revised report titles for Type I and Type 2 reports. Reports may not be referred to as "SAS 70 audit reports" in the future.
• Enhanced disclosure of deficiencies in internal control and related causative factors.
  

What do the changes mean to your organization?

You, better than anyone, know that it's critical for today's service organizations to successfully demonstrate a commitment to safeguarding customer data and assets. Your customers rely on your current SAS 70 audit report as evidence that their interests are protected, and your prospects evaluate your report when they consider doing business with you. Simply put, your organization needs to stay SAS 70-compliant.

Consider now how these pending changes could affect your organization and what actions you can take to ensure you're prepared once the changes take effect. To review the proposed changes from the AIPCA, click here. Keep an eye out for additional alerts from Blackman Kallick. And, as always, reach out to Blackman Kallick at any time to discuss the pending changes, to get your questions answered, and to prepare for and produce current, accurate internal control reporting.

Blackman Kallick's SAS 70 Audit Services team is here to help.

 If you need help preparing for these changes and producing up-to-date and accurate internal control reporting, please contact Tim Bowling at 312-980-2927 or tbowling@BlackmanKallick.com.

This publication is part of Blackman Kallick’s marketing of professional services, and is not written tax advice directed at the specific facts and circumstances of any person and/or entity. Contents of this publication are of a general nature, and you should not act on this information without obtaining professional advice from your business advisor that is appropriately tailored to your individual needs and circumstances. This written advice is not intended or written to be used, and cannot be used by any taxpayer, for the purpose of avoiding penalties that may be imposed under the Internal Revenue Code.