Fall 2009 issue of Horizons

• Payroll service providers • Outsourced document processors or report processors • Call centers/collection agencies • Reward card processers • Cost recovery providers (telecom, payment, other billing)

This article speaks to a company having a SAS 70; what about using a SAS 70? For the user organization, the benefits include: • Cost and Time — With a SAS 70 report, user organizations may be able to eliminate the costs and time associated with sending their internal auditors or other compliance representatives to the service organization to perform audit procedures. • External Audit Fees — With sound internal controls at the service organization, external auditors may be able to rely on the controls and reduce the amount of testing in support of the financial statement audit. • Controls Assurance — User organizations that obtain a SAS 70 report from their service provider receive valuable information on the design and operating effectiveness of internal controls. RubinBrown would be happy to provide further insights related to SAS 70 coverage and usage. For example, ensure that the SAS 70: • Covers your actual data, servers and processes.

Benefits of a SAS 70

The SAS 70 provides many benefits, which may include:

• Competitive Differentiation — An unqualified SAS 70 opinion, vissued by a PCAOB-registered accounting firm, differentiates the organization from its peers by demonstrating effective controls while also building trust with clients. • Process Improvements—Having a SAS 70 auditor from a PCAOB-registered accounting firm with SAS 70 experience across many organizations leads to identification of opportunities to improve and streamline operational processes and internal controls. • Time Savings — With a SAS 70 report, service

• Is for the appropriate time period. • Includes testing and is not limited to inquiry procedures.

15 u fall 2009 issue