Untitled Document

Understanding the Many Benefits of a SAS 70 [ PDF ]
by Philip M. Cronin, CISSP, and Bruce Eissner

In this paper, we describe how a SAS 70 may be a requirement for serving many customers; but ultimately, the SAS 70 can benefit the service provider too.

In formal terms, a SAS 70 is an auditing statement that a "service organization" can provide to its customers. The SAS 70 attests to the internal controls of the service organization. If a company either provides or plans to provide services that are listed in the box below, a SAS 70 may be required by the customer.

SAS 70s Requiredif you provide:

Outsource Services	Hosting or ASP Servicesto these Verticals

Claims handling Investment advisors Custody services Payroll services Billing services Clearing houses Credit processors	Financial Accounting Manufacturing and IT Healthcare industries Customer care Human resources Benefits management Payments and administration

Required by law. The Sarbanes-Oxley financial reporting act, the Gramm-Leach-Bliley privacy act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA) and California’s SB1386 notification act all require that sensitive data is assured of protection. And for good reason; the headlines have been everywhere -- MasterCard, ChoicePoint, LexusNexus, and on and on. Simply put, companies that handle sensitive data are required to protect that data. Companies that provide outsource services or hosting /ASP services now need to provide substantial assurances to their customers. Those customers have the choice of auditing the service organization or of accepting a SAS 70 from the service organization. The first option - auditing the service organization can be costly and inefficient for both organizations. The second option - accepting a SAS 70 - will be effective only if the service organization provides a substantial and current SAS 70.

What the customers expect: The Federal Reserve Bank of New York uses "a SAS 70 report as a starting point for assessing assurances and controls at external service suppliers" according to Sean Mahon, vice president. The bank recently decided not to use the services of a salary benchmarking consultancy because it lacked a SAS 70 report and the bank required independent evidence of the consultancy's security processes to protect sensitive employee data.¹

Northern Trust Company of Chicago has beefed up its effort to scrutinize current and potential outsourcing partners because regulators have made it clear that "outsourcing relationships are subject to the same risk management practices" as those used in-house, Hurst said at a recent forum. First Horizon Bank also spends "considerable time" performing internal audits and using the SAS 70 certification standard to ensure that the IT operations of its outsourcers are compliant with privacy laws, said Patrick Ruckh, First Horizon's chief technology officer.²

What the service organizations are saying: "Our SAS 70 certification is the next level of (service) delivery and illustrates our commitment to the specific needs of enterprise customers." … Our "customers can be confident that our … services are consistent, safe and reliable and that they are compliant with emerging regulatory mandates."

Our "customers can trust that our … services are secure and effective and we are extremely proud to have ongoing third-party endorsements of (our) network and facility controls," We "will continue to pursue annual SAS 70 examinations to ensure we are offering our customers … services that meet their security needs and allow the exchange of critical data with the utmost confidence."³

A SAS 70 can keep, attract, and build business. Beyond the examples cited above, a SAS 70 can be an effective means for attracting new customers and strengthening ties with existing ones. A SAS 70 can differentiate one service organization from another. As evidence of that, service providers with SAS 70’s often incorporate the overview section of their SAS 70 directly into their marketing material.

It's a sign of assurance. A SAS 70 with an unqualified opinion indicates that the service provider has tight and effective control over its operation; and that the likelihood of financial loss, operational failure or corruption of data is mitigated. A SAS 70 demonstrates that the infrastructure, applications and processes have passed rigorous, independent third-party testing and have an environment that incorporates the processes and controls that are necessary for effectively hosting and/or exchanging corporate data and financial information. Overall, the SAS 70 is a demonstration of both the legal and business commitment to greater levels of reliability, availability and security.

External audit vs. internal understanding. A SAS 70 from a service organization can avoid the possibility of demands for multiple external audits from customers. Such requests can lead to uncontrolled costs, and they may interrupt the flow of normal business operations. They may impact negatively on service organizations’ relationships with their customers. While the SAS 70 can help to avoid these problems, the SAS 70 process in and of itself can also provide real benefits to a service provider. For example, it can lead to improved risk management and heightened controls levels. In addition, the SAS 70 can give management the confidence that key business objectives are being met and that business-critical levels of IT governance are in place.

More information. For more detailed and technical information, please see the white paper "SAS 70 Overview and Planning Guide" available at www.polarcove.com.

1. Linda Leung, Network World, 07/28/03 (www.nwfusion.com)
2. Lucas Mearian, Computerworld, 4/11/05 (www.computerworld.com)
3. Recent press releases from several vendors.