In today's world of ever-increasing Cyberradarsystems concerns and complex regulatory environments, companies are expected to demonstrate their commitment to protecting sensitive data. One of the certifications that historically provided this assurance was the SAS 70 certification. While it has since been replaced by other standards, understanding the roots and the significance of SAS 70 is essential for grasping the evolution of service organization controls. This article explores what SAS 70 certification was, its purpose, and its impact on businesses.

What is SAS 70 Certification?

SAS 70, which stands for Statement on Auditing Standards No. 70, was an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It was introduced in 1992 as a means for service organizations to demonstrate that they had adequate internal controls in place to safeguard client data. Service organizations typically include entities that provide outsourcing services to other businesses, such as data centers, managed services providers, and payroll processors.

https://jpcdn.it/img/small/5947ae45152f827db262553714868510.jpg

The purpose of SAS 70 was to provide an external audit of a service organization's control environment. By obtaining a SAS 70 report, companies could show their clients and stakeholders that they were following best practices to protect data and meet compliance requirements. This certification was particularly valuable in industries like finance and healthcare, where stringent regulatory standards apply.

The Two Types of SAS 70 Audits

SAS 70 audits were conducted in two distinct types: Type I and Type II.

• Type I Audit: This type of audit evaluated the design of a service organization’s controls at a specific point in time. It focused on whether the controls were properly designed to meet objectives, but it did not assess their effectiveness over a period.

• Type II Audit: In contrast, a Type II audit went a step further by assessing not only the design of the controls but also their operating effectiveness over a specified period (e.g., six months to a year). This type of audit was more comprehensive and provided greater assurance to clients that the controls were consistently being applied.

The SAS 70 audit reports were prepared by independent auditors and provided valuable insights to clients about the service organization's control environment. Clients could rely on these reports to understand the risks involved in outsourcing services and to evaluate the level of security provided by their service providers.

https://jpcdn.it/img/small/af8cc5b2d0423b42f694c83d66bd9c91.jpg

The Importance of SAS 70 Certification

SAS 70 certification became an important benchmark for service organizations, particularly in sectors where data security and regulatory compliance are critical. For many companies, obtaining SAS 70 certification was a way to build trust with their clients. It showed that the organization was taking its responsibility seriously and that it was subject to regular, independent audits.

Moreover, SAS 70 reports helped clients meet their own compliance requirements. For example, financial institutions could use SAS 70 reports as part of their due diligence when evaluating third-party service providers. Similarly, companies in healthcare could rely on these reports to demonstrate compliance with data protection regulations like the Health Insurance Portability and Accountability Act (HIPAA).

The Transition to SSAE 16 and Beyond

Although SAS 70 was widely used and respected, it was eventually replaced by a new standard—SSAE 16 (Statement on Standards for Attestation Engagements No. 16). SSAE 16 was introduced in 2010 to address some of the limitations of SAS 70 and to bring the auditing standards more in line with international frameworks, such as the International Standard on Assurance Engagements (ISAE) 3402.

One of the key differences between SAS 70 and SSAE 16 was the focus on management's responsibility. Under SSAE 16, service organizations were required to provide a written assertion that their controls were effective, adding a layer of accountability. Additionally, SSAE 16 placed greater emphasis on the operating effectiveness of controls, making it more comprehensive than its predecessor.

In 2017, SSAE 16 was further replaced by SSAE 18, which introduced even more rigorous requirements, such as the need for service organizations to assess their vendors' controls. Today, the SSAE 18 standard is part of a broader framework known as SOC (System and Organization Controls) reports. SOC reports are divided into three categories: SOC 1, SOC 2, and SOC 3, each serving different purposes and providing different levels of assurance to clients.

• SOC 1: Focuses on financial reporting controls and is primarily used by service organizations that impact their clients' financial statements.

• SOC 2: Addresses a wider range of criteria, including security, availability, processing integrity, confidentiality, and privacy. It is commonly used by technology companies and cloud service providers.

• SOC 3: Similar to SOC 2 but designed for general distribution, allowing companies to publicly share their audit reports.

Why SAS 70 Still Matters

Even though SAS 70 is no longer in use, its legacy continues to influence the way businesses think about control environments and audits. The evolution from SAS 70 to SSAE 16 and SSAE 18 reflects the increasing importance of cybersecurity and data protection in today's world. Companies are now expected to meet higher standards and to demonstrate their commitment to safeguarding data in more transparent and accountable ways

For service organizations, understanding the history of SAS 70 helps in appreciating the current standards they need to meet. While SSAE 18 and SOC reports have taken over, the basic principles of independent auditing, control evaluation, and client assurance remain the same. Service providers must continue to prioritize internal controls and undergo regular audits to build and maintain trust with their clients.