AGA Research Study Finds That SAS 70 Reports Are Useful to Governments But Could Be Improved

Alexandria, VA (October 3, 2008) - Today, the Association of Government Accountants (AGA) released the results of a research study that examined the usefulness of the American Institute of Certified Public Accountants' (AICPA) Statement on Auditing Standards (SAS) No. 70, Service Organizations, report to governments.

SAS 70 Reports: Are They Useful and Can They Be Improved? addresses the usefulness of SAS 70 and whether improvements would increase its usefulness. SAS 70 reports are used by numerous federal and state agencies when they outsource their financial systems and services, most commonly payroll.

The significant findings of the research were that:

1) User organizations do not always obtain the information they need from the SAS 70 report;
2) The controls tested by the service organization's auditor may not be those that are considered important by the user organization;
3) Generally, user organizations do not have significant input to the scope or systems to be covered by the SAS 70 report.

The study used a series of face-to-face meetings, telephone interviews and Internet surveys with selected users as well as state and federal government auditors to gauge their usage and success levels. SAS 70 reports communicate information and assurance about the controls of the service organization that are of interest to user organizations and their auditors as they relate to an audit of the financial statements. Service organizations have become a critical part of some user organizations' overall system of internal control over financial and operational reporting.

The passage of the Sarbanes-Oxley Act caused an increase in the usage of SAS 70 reports as a way to better evaluate the control environment for outsourced functions. They have limitations, such as not meeting FISMA requirements and the AICPA is considering changing some requirements. Users should also keep up with the planned changes in the relevant professional standards (both AICPA and International Standards) that will enhance the overall concept of the service auditor's report from the SAS 70 examination level report to an attest report where management of the service organization will assert to their controls as a component of the audit report. Details of those planned changes are included in the research report.

"The federal government has seen a big increase in the outsourcing of functions, especially financial functions, in the past decade," said AGA Director of Research Anna D. Gowans Miller, MBA, CPA. "The organization that outsources its financial functions is still responsible for providing assurance that the controls are adequate and, with proper planning and communication with the service provider, SAS 70 reports provide a cost-effective way for the user organization to provide this assurance."

The research project was sponsored by Ernst & Young LLP's Federal Assurance and Advisory Practice. AGA's Miller led this effort. She was aided by Werner Lippuner and James Merrill, both with Ernst & Young LLP.

View the report.

Questions: Contact Anna Miller at 800.AGA.7211, ext. 313.