SAS70 Audits:

1

• SAS70 Audits
• How helpful are they
• from a Government
• Shared Service Providers
• Perspective?

AGA Presentation By Dean Martin, June 27, 2007
2
SAS70 Audits How Helpful Are They?

• The goal of this briefing is to define from a
  Service Organization Perspective the value of a
  Type II SAS70 Audit Engagement operating as a
  Government Shared Service Provider

3
SAS70 Audits Why the interest?

• Why the interest in a SAS70?
• A SAS70 is review of a system environment or
  application, performed by an independent auditor,
  for a service organization on behalf of its
  customers.
• A Type II examination involves the review of
  controls and procedures placed in operation, as
  well as tests of the operating effectiveness of
  the controls over a period of time, usually 12
  months.

4
SAS70 Audits What is tested?

• Tests of Operating Effectiveness
• The following types of tests are performed to
  verify the operating effectiveness of NBCs
  controls
• Inquiry of personnel
• Inspection of documentation
• Analysis of system outputs
• Defines and conducts tests to verify that the
  controls and procedures defined by the NBC were
  operating effectively throughout the entire
  review period.
• Observation of processes, tasks, and
  environmental conditions

5
SAS70 Service Organization Perspective

• On an annual basis the SAS70 Audit Engagement
  provides the NBC Assurance that system and
  general operating controls are in place and are
  operating effectively and efficiently
• A SAS70 Examination provides the Government
  Shared Service Provider the luxury of dealing
  with one independent public audit group in lieu
  of the Inspector General or Contract Auditors
  from every client organization
• Federal Clients can leverage the independent
  public accounting firms opinion and re-state
  those assertions within its Annual Assurance
  Statement

6
SAS70 A Customers Perspective

• What is the customers perspective?
• Customers are receive an unqualified or
  qualified opinion of each major application
• The independent public accounting firms opinion
  is re-stated and leveraged within the clients
  assurance statements
• SAS70 is supplemented by A-123 Appendix A testing
  results
• Clients expectations are met