Service Organizations: Applying SAS No. 70, as Amended – AICPA Audit Guide

This Audit Guide is designed to provide guidance to auditors reporting on a service organization's controls, this Guide also provides guidance to auditors of companies that use service organizations. In addition, it has been revised as of March 1, 2008 to reflect certain changes necessary because of the issuance of authoritative pronouncements.

Service organizations provide services ranging from performing a specific task under the direction of a company to replacing entire business units or functions of that company. Many companies use service organizations to accomplish tasks that affect the company's financial statements.

Because many of the service organizations' functions affect a company's financial statement, auditors auditing those financial statements may need information about those services, the related service organization's controls, and their effects on the company's financial statements.

Introduction
  
I-01   Many entities use outside service organizations to accomplish tasks that affect the entity's financial statements. Service organizations provide services ranging from performing a specific task under the direction of an entity to replacing entire business units or functions of an entity. In recent years, there has been a significant increase in the use of service organizations. Because many of the functions performed by service organizations affect an entity's financial statements, auditors performing audits of financial statements may need to obtain information about those services, the related service organization controls, and their effects on an entity's financial statements.

I-02   Examples of service organizations that perform functions that may affect other entities' financial statements are bank trust departments that hold and service assets for employee benefit plans or for others, mortgage bankers that service mortgages for others, and application service providers that provide software applications and a technology environment that enables customers to process financial and operational transactions.

I-03   An auditor may be engaged to issue a report on a service organization's controls for use by user organizations and their auditors. Statement on Auditing Standards (SAS) No. 70, Service Organizations, as amended (AICPA, Professional Standards, vol. 1, AU sec. 324),1 provides guidance to an auditor performing (1) an audit of a user organization's financial statements, and (2) procedures at a service organization that will enable the auditor to issue a ser- vice auditor's report on a service organization's controls that may be part of user organizations' information systems. Although a service auditor's report may be used by management of a service organization and its user organizations, its primary purpose is to provide information to auditors who audit user organizations' financial statements. The purpose of this Guide is to help auditors of entities that use service organizations (user auditors) and auditors issuing reports on the controls of service organizations (service auditors) implement SAS No. 70, as amended.

I-04   Publicly-held companies and other ''issuers'' are subject to the provisions of the Sarbanes-Oxley Act of 2002 (Act) and related Securities and Ex- change Commission (SEC) regulations implementing the Act. Their outside auditors are also subject to the provisions of the Act and to the rules and standards issued by the Public Company Accounting Oversight Board (PCAOB).  The PCAOB adopted as interim standards, on an initial, transitional basis, the AICPA generally accepted auditing standards in existence on April 16, 2003. In September 2004 certain of these interim standards were amended by PCAOB Release 2004-008, Conforming Amendments to PCAOB Interim Standards Resulting from the Adoption of PCAOB Auditing Standard No. 2, "An Audit Of Internal Control Over Financial Reporting Performed In Conjunction With An Audit of Financial Statements." The PCAOB has also issued four auditing standards. These standards include:

• PCAOB Auditing Standard No. 1, References in Auditors' Reports to the Standards of the Public Company Accounting Oversight Board

• PCAOB Auditing Standard No. 2, An Audit of Internal Control Over Financial Reporting performed in Conjunction With an Audit of Financial Statements
• PCAOB Auditing Standard No. 3, Audit Documentation
• PCAOB Auditing Standard No. 4, Reporting on Whether a Previously Reported Material Weakness Continues to Exist

I-05   Since this Guide is designed to provide guidance to service auditors engaged to issue reports on a service organization's controls that may be part of a user organization's information system in the context of an audit of financial statements and to provide guidance to user auditors engaged to audit the financial statements of entities that use service organizations, PCAOB Auditing Standards No. 1, 2, 3, and 4 are not reflected in this Guide, except to reflect certain conforming amendments made by PCAOB Release 2004-008 to certain of the interim standards discussed in this Guide. For issuers, these conforming amendments have been footnoted throughout this Guide, as applicable. Certain of the provisions in Release 2004-008 are relevant to situations in which an auditor is engaged solely to audit a company's financial statements and not just when performing an integrated audit of financial statements and internal control over financial reporting (''integrated audit"). For information on PCAOB auditing standards, quality control standards, and related guidance that may have been issued subsequent to the writing of this Guide, please refer to the PCAOB Web site at www.pcaobus.org (audits of issuers only).