SAS 70 in the post-Sarbanes Oxley World
The Sarbanes-Oxley Act, enacted two years ago, requires establishment of extensive internal controls for financial reporting. Outsourced business process that are part of the user firm's corporate information system are considered part of its internal control over financial reporting. In this regard, the Statement on Auditing Standards (SAS) No. 70, Service Organizations, a recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA), which enables an independent auditor to evaluate and report a service organization's controls, assumes significance. An important question of interest to user firms and BPO service providers is:
What types of outsourcing activities result in a service organization arrangement addressed by SAS 70? What types of outsourcing activities are part of a company's internal control over financial reporting?
In the Staff FAQ (June 23, 2004) regarding "Auditing Internal Control over Financial Reporting", the PCAOB addresses this question with examples of situations in which the service organization's services affect the user firm's information system. A direct inference is that the outsourced business process is part of the user firm's information system if it impacts any of the following:
What types of outsourcing activities result in a service organization arrangement addressed by SAS 70? What types of outsourcing activities are part of a company's internal control over financial reporting?
In the Staff FAQ (June 23, 2004) regarding "Auditing Internal Control over Financial Reporting", the PCAOB addresses this question with examples of situations in which the service organization's services affect the user firm's information system. A direct inference is that the outsourced business process is part of the user firm's information system if it impacts any of the following:
- The classes of transactions in the company's operations that are significant to the company's financial statements.
- The procedures, both automated and manual, by which the company's transactions are initiated, authorized, recorded, processed, and reported from their incurrence to their inclusion in the financial statements.
- The related accounting records, whether electronic or manual, supporting information and specific accounts in the company's financial statements involved in initiating, authorizing, recording, processing and reporting the company's transactions.
- How the company's information system captures other events and conditions that are significant to the financial statements.
- The financial reporting process used to prepare the company's financial statements, including significant accounting estimates and disclosures.
You can download a copy of the FAQ at the PCAOB website:
A comprehensive online resource dedicated to the SAS 70 auditing standard and third-party assurance for service organizations is:
posted by Deepa at
9:30 AM
