SAS70 2152



  • Hi there,
    Apologies if I have the wrong place to post this question but would very much appreciate hearing any comments you may have on the following independence issue
    I am looking for tenders from a number of the big four for a SAS 70 Type 1. I have one party who is the external auditor who assures me that although they conduct my company’s corporate audit that they are still independent enough to conduct the SAS 70. I guess my first question is whether they would be even if using Chinese walls etc?
    One of the other firms I have looked for a tender from also co-partners Internal Auditing for us, i.e. they do much of the leg work and ensure our standards applies etc are the best while we also put our name to it and assist throughout. This firm has informed me that they can also conduct the SAS 70 and independence is not an issue. I guess the next question is whether this might be correct or not?
    Lastly the first firm - our corporate auditors advised me that the second firm- our co-partners in IA, cannot conduct the SAS 70 for us. Is this correct do you think?
    I guess if I cant clear up the question shortly I’ll be forced to go with the other completely independent firm but they were not my first choice.
    Any suggestions/comments are gratefully received.
    Many thanks



  • I think the problem is that a SAS 70 type 1 has to be certified by an independant auditor.
    I would come back to your external auditors and ask them why exactly they believe that such work would not conflict with their external audit, given that they may be relying on such a report as part of their assessment of your internal controls for SOX (auditor self -reliance).
    Overall, it may be safer to go with a firm that performs neither internal or external audit work - just to be safe.
    Auditor independance can be a serious issue. I remember that when Enron, Worldcom and Xerox scandals came out, that a lot of journalists commented on the fact that many of the audit firms engaged with these companies had been the same firms that senior finance executives had trained with. Whilst this is not illegal, it does raise a number of independence questions as most accountants tend to be very loyal to their Alumnus.



  • Many thanks for responding so quickly.
    I take your point in regard to the using the last firm independent of us presently. Unfortunately this is the provider of least choice. If I was able to use either of the first two then the impact on us would be significantly less.
    I think I will approach both providers and request, as you suggest, why such work would or would not conflict with their present duties and whether they would be relying on it or not as a result. I will look for written confirmation of their view for sure on this point.
    Many thanks



  • Once again thanks for the contribution.
    Would you be aware of where I might read up on the SAS 70 - Auditor independance issue. One suggestion was the section ET100 in the auditing standards.
    thanks again and have a great weekend



  • I have split out these posts from the topic in which they were originally posted (auditor independence) because I think it is validly a new subject and there was potential for the responses to become confused.
    I hope there are no objections to this.



  • RiskMgt, it would be useful of you posted a few more details.
    I have assumed that you are looking for a SAS 70 on yourself as the outsourced service provider, is this right? If so do you provide services to multiple clients?
    My view on potential conflicts would be that a SAS70 is an audit service and that therefore there should be no objection to your external auditor completing the SAS70. After all it is your clients that are relying on the SAS70 report and not you, the service provider.
    If you are servicing multiple clients then conflicts are virtually impossible to avoid as you probably have clients that are audited by every firm.
    The firms themselves would tend to manage any conflict through chinese walls i.e. you wouldn’t work on a SAS 70 audit for someone that provides a service to another client of your. The Big 4 are certainly big enough to manage this through different offices or, at least, different teams.



  • Hi there,
    Hope you are doing well. I am currently working for one of the leading top 20 accounting firm in USA. We are specialized in performing SAS70 and SOX type engagement. Please let me know whether you are still accepting the tender for performing SAS 70 Type 1 audit.
    I would appreciate if you could provide your contact details so that I can understand your requirements before submiting our tender.
    Thanks a lot for your help.

    • R

Log in to reply