SAS 70 Reports and Employee Benefit Plans

Auditors of employee benefit plans have continued to raise questions about how SAS 70 reports should be considered in their audits, and about the auditing procedures that should be applied to SAS 70 reports to increase their reliability as audit evidence.

This publication provides you with guidance on the use of SAS 70 reports in your employee benefit plan audits and specifically addresses issues relating to:

• The circumstances under which a SAS 70 report should be obtained
  
• How SAS 70 reports should be considered in a limited-scope audit
  
• The implications of sub-service arrangements
  
• Reading and understanding how a SAS 70 report affects your audit, including:
   
  • The procedures you should perform to understand the scope of the service auditor's work and whether that scope is adequate for your purpose
  • The procedures you should perform to evaluate the results of tests of controls
    
   
• How to develop an appropriate audit response for identified testing exceptions and control deficiencies developing an appropriate audit response for identified testing exceptions and control deficiencies.