SAS 70 Finance Explained

SAS 70, or Statement on Auditing Standards No. 70, was a widely recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). While technically superseded by SSAE 16 (now SSAE 18) in 2011, understanding SAS 70 provides valuable context for understanding the current landscape of service organization controls reporting, especially within finance.

At its core, SAS 70 addressed the controls implemented by a service organization, such as a payroll processor, a data center, or a cloud provider, that could impact the financial statements of its user entities (customers). It wasn't a certification or guarantee of absolute security; rather, it was a report demonstrating that the service organization had controls in place and operating effectively to protect the user entity's financial data and related processes.

Two types of SAS 70 reports existed:

• Type I: This report described the service organization's controls as of a specific date. It essentially detailed what controls the service organization claimed to have in place.
• Type II: This report went further by describing the service organization's controls and testing their operating effectiveness over a period of time (typically six months or more). This provided a higher level of assurance to user entities.

From a finance perspective, SAS 70 reports were critical for user entities relying on service organizations. For example, a company outsourcing its payroll processing needed assurance that the payroll provider had adequate controls to ensure accurate and timely processing, compliance with tax regulations, and protection of employee data. A SAS 70 report, particularly a Type II, provided independent validation of these controls, allowing the user entity's auditors to rely on the service organization's controls testing and reduce the scope of their own audit.

The importance of SAS 70 stemmed from the Sarbanes-Oxley Act (SOX) of 2002. SOX mandated that publicly traded companies establish and maintain effective internal controls over financial reporting. When a company relied on a service organization, the service organization's controls effectively became part of the user entity's control environment. A SAS 70 report provided the documentation necessary for the user entity to demonstrate compliance with SOX.

While SAS 70 is no longer in use, its principles remain relevant. SSAE 18 (SOC 1) has replaced it, but the fundamental objective remains the same: to provide assurance that service organizations have controls in place to protect user entities' financial information. Understanding SAS 70 helps in comprehending the evolution of service organization controls reporting and the continuing importance of these reports for maintaining the integrity of financial reporting, especially in an environment increasingly reliant on outsourcing and cloud-based services. Finance professionals still encounter references to SAS 70 when reviewing legacy documentation or understanding the historical context of current controls assessments.