Tag Service Industry

by Janet Bryan-Matura, CPA, Audit Partner, TR Moore & Company, A Doeren Mayhew Firm

As an increasing number of businesses outsource key functions such as payroll, benefits administration and IT management, it has become a best practice for these external service providers (and a requirement for some) to assure their customers of effective internal controls within their organizations. For nearly 20 years, Statement on Auditing Standards (SAS) No. 70 has provided guidance for CPAs who audit these service companies. However, new standards are set to take effect beginning with the periods ending on or after June 15, 2011.

Background

Traditionally, a SAS 70 audit has helped assure businesses that their service provider’s internal controls are adequate — enabling the business to better manage outsourcing risks.

1. In a “Type I” audit, the auditor expresses an opinion as to whether controls are properly designed.
2. In a “Type II” audit, the auditor goes a step further and expresses an opinion on whether the controls are operating effectively.

In an effort to bring U.S. standards in line with international standards, the AICPA’s Auditing Standards Board recently released Statement on Standards for Attestation Engagements (SSAE) No. 16, Reporting on Controls at a Service Organization. SSAE 16 will replace SAS 70’s guidance for service organization auditors, effective for periods ending on or after June 15, 2011. In addition, a new SAS for auditors of user organizations will take effect in 2013.

What changes can service companies expect?

Changes to the current standard will require additional detail in the reports, including:

• Management must provide a written assertion about the fairness of the presentation of: 
  1.  The description of the organization’s controls and the suitability of their design.
  2. The operating effectiveness of those controls, if a Type II engagement
• Type II reports under SSAE No. 16 must cover a period consistent with the auditor’s tests of operating effectiveness, and not just by a specified date as is currently permitted under SAS No. 70 standards.
• Any tests of controls conducted by internal auditors must be identified in the reports.
• Auditors can no longer use evidence on the satisfactory operation of controls in prior periods as a basis for a reduction in testing in the current period.

To ensure a smooth transition to the new standards, we recommend beginning to work with your audit firm now to understand the impact of the standards on your company, how to best prepare, and what adjustments may be needed to your policies, procedures and systems. Contact us for more information.