Question to Plan Auditors - BISYS' SAS 70 Report

[Guest twalters]

Our firm recently received BISYS' Type II SAS 70 Report for the year ended December 31, 2002, which we were hoping to rely on to reduce participant testwork. Although the opinion was "clean", the report of independent accountants also stated that: "BISYS Retirement Services, L.P. was in the process of converting all recordkeeping to the WySTAR application and retiring the CASCADE System. Our examination did not extend to controls and related control objectives that were specific to the CASCADE recordkeeping application."

Because the CASCADE system was used for most of 2002, our firm believes that the SAS 70 report serves only to document controls at BISYS and cannot be used to reduce participant testwork. This would include testing the investment elections (which can be changed via the telephone and internet) and the allocation of investment gains/losses to participants.

Has anyone else received this report from BISYS and how did you deal with it??

[Guest mjn]

In reviewing the BISYS SAS 70 Reports for both 2002 and 2001, it appears that in 2001 BISYS acquired UPI. BISYS had offices in Pennsylvannia, and UPI had offices in Minnesota. The 2001 SAS 70 from BISYS specifically excluded UPI from being covered by its report. In 2002, the BISYS SAS 70 Report refers to its offices in Pennsylvannia and Minnesota. It appears their Minnesota offices may really be the old UPI offices.

We do not have any plans that were handled by UPI, so this is not an issue for us. However, we may conclude from the two reports that UPI was using CASCADE and BISYS was using WySTAR. BISYS acquired UPI and finally converted them to WySTAR during 2002.

Do you have, or can you locate, a 2001 SAS 70 for UPI which covers the CASCADE application? The AICPA Audit Guide of Employee Benefit Plans, paragraph 6.16, discusses obtaining a report outside the plan's reporting period to gain preliminary understanding, supplemented by discussion with the service organization about possible changes in processing or internal controls during the audit period. You may be able to combine the 2001 report with the service provider's representation to reduce testing.

We hope this may be of some help to you.