SAS 70 Type II...Any Equivalent certification??? 885



  • Hi All,
    I have few questions regarding SAS 70 type II
    Is there any Equivalent audit report that can do in place of SAS 70 type II like BS 15K certification. My company mostly outsource Infrastructure and application Service support to a company in India and they r BS 15K certified( though its a service delivery related certification)
    Continuing in the same direction …Can we test their Internal Controls from here in US. Sending our auditors or hiring auditors in that country may be Prohibitive in cost for us. We have our Internal control guidlines and objectives from KPMG …can we test them ourselves on them without bringing an audit firm in between. We have an audit team in the company for testing our controls.
    lastly if they give us something in writing that they have tested themselves for the controls ( as set by us) will that do.
    As you may observe my firm is thinking of reducing cost here as the onus for SAS 70 is with us then with the TPA and the TPA wants us to do SAS 70 type II.
    Thanks in Advance
    BS



  • Without a SAS 70 Type II, each customer must sent the auditors to the service organization this means time and additional costs
    There is not a third option
    Public Company Accounting Oversight Board, Auditing Standard No. 2
    In all audits of internal control over financial reporting, the auditor must perform enough of the testing himself or herself so that the auditor’s own work provides the principal evidence for the auditor’s opinion
    The auditor may, use the work of others to alter the nature, timing, or extent of the work he or she otherwise would have performed. For these purposes, the work of others includes relevant work performed by internal auditors, company personnel and third parties.
    The extent to which the auditor may use the work of others depends on the degree of competence and objectivity of the individuals performing the work.
    Factors concerning the competence of the individuals performing the tests of controls include:
    *Their educational level and professional experience
    *Their professional certification and continuing education
    *Supervision and review of their activities
    *Quality of the documentation of their work, including any reports or recommendations issued
    The auditor should test some of the work of others to evaluate the quality and effectiveness of the work.
    Management self-assessment of controls:
    Because such an assessment is made by the same personnel who are responsible for performing the controlthe individuals performing the self-assessment do not have sufficient objectivity as it relates to the subject matter.
    Therefore, the auditor should not use their work



  • Is there any Equivalent audit report that can do in place of SAS 70 type II like BS 15K certification.
    In short, not really. There are other certifications but you would find it hard to get your US auditor to support use of it.
    Continuing in the same direction …Can we test their Internal Controls from here in US. Sending our auditors or hiring auditors in that country may be Prohibitive in cost for us. We have our Internal control guidlines and objectives from KPMG …can we test them ourselves on them without bringing an audit firm in between. We have an audit team in the company for testing our controls.
    It would be hard for you to do this remotely, but not impossible.
    That said I don’t see why you would imagine it to be a prohibitive cost to audit them? You should be able to engage a Big 4 audit firm in India cheaper than in the US.
    However, you can test them yourself without using an audit firm if you fell happy with doing that.



  • thanks George and Denis …that really helped.
    My last doubt however is still there…
    I will rephrase it…if the TPA has an Internal audit department and they audit the TPA operations for my company against the control that we give to them, and issue an statement will that do…does that eliminates the need of third party…
    We are also facing a conflict of interest as KPMG is also a auditor for the TPA and they are reluctant to hire someone else.We have already hired KPMG and are in a fix.
    Thanks again for ur valuable time.
    BS


Log in to reply