I mentioned in my ealier posts that a SAS 70 audit can be a Type I Engagement or a Type II engagement. The main difference between a Type I and a Type II report is that a Type II report not only includes a description of service organizations controls, but also includes testing such controls over a certain period of time say six months. Thus, a Type II report will give comfort to the User Organization that controls have been placed in operation, they are suitable designed and further they are operating effectively over the period of review.

A SAS 70 Type II Report will thus contain -

- description of controls of the service organization as relevant to audit of financial statements

- Whether such controls have been designed suitably to meet control objectives

- Whether Controls had been placed in operation on a specified date.

- And finally, that the controls were operating effectively over the specified period of time to meet the control objectives.

More Related Posts >>

Section 404 Report Requirements
Sarbanes Oxley Year Two Challenges
Steps to a Strong Control Environment
Sarbanes Oxley Year One - Lessons Learned