SAS 70 Expiration Time? 294
-
Hello all.
Is there expiration time for SAS 70 Type 2 report?
Thanks
-
This post is deleted!
-
This post is deleted!
-
This post is deleted!
-
This post is deleted!
-
SAS70 reports are annual.
-
SAS70 reports are annual.
I knew, but does it mean, that if you have new SAS 70 report, old one
is ‘expired’ or you’ll need it yet as reference for the period, when old report was issued?
-
I would be more inclined to think of a SAS70 like a set of accounts. They represent a period of 12 months up to the date of the report and are the most relevant information until a new report is issued. The old report doesn’t expire as such it just becomes less relevant with time.
-
More importantly PCAOB FAQs gave some guidance as to the use of SAS 70s. They stated that the age (time since issued) of the report is to be taken into consideration when looking to rely on the report for Internal Controls of an outsourcer.
The older the report, the more a company should do to verify that the controls surrounding an outsourced process have not changed. That is, the longer the time from issuance date, the greater probability that changes may have occurred that may impact the validity of the report.
FJ
-
The old reports should be retained to the extent that they were relied upon in your ICOFR assessments. They should be retained as long as you retain your SOX support (generally about 7 years). Each new report supports a different period of time. Match the report to the period of time you are assessing.
-
SAS 70 - It is a continuous process that management should
undertake annually to ensure the system of controls maintains
its integrity.