Statement on Auditing Standards No. 70: Service Organizations, commonly abbreviated as
SAS 70 and available
full-text by permission of the AICPA, is an
auditing statement issued by the
Auditing Standards Board of the
American Institute of Certified Public Accountants with its content codified as
AU 324. SAS 70 provides guidance to service
auditors when assessing the
internal control of a service organization and issuing a service auditor’s report. SAS 70 also provides guidance to auditors of financial statements of an entity that uses one or more service organizations. Service organizations are typically entities that provide outsourcing services that impact the
control environment of their customers. Examples of service organizations are insurance and medical claims processors, trust companies, hosted data centers,
application service providers, managed security providers, credit processing organizations and clearinghouses.