SAS 70 Audits

[Guest MPITTS]

Do any firms that only do balance forward recordkeeping get a SAS 70 audit? We are getting asked for this by auditors a lot now. I know that daily firms that handle investments usually get them but we don't handle any investment transactions.

Would the answer change if your firm was agent of record?

[Harwood]

Since a SAS 70 is a report on the processing of transactions by service organizations, I see no reason why it would be limited to daily valuation providers.

[TCWalker]

Gee, I think anyone could get a SAS 70 for just about any accounting or data management function. As I recall, what's promised is a predictible outcome based upon the integrity of the controls, methodology and operational effectiveness. I'm fairly certain I've seen balance forward shops offering SAS 70 certs.

[E as in ERISA]

That's probably just a standard question. The real test is whether the auditors are actually coming into your shop and reviewing your processes and internal controls. The SAS 70 would generally allow you to avoid having each of the plan's auditors come in and conduct their own reviews. If they aren't performing such reviews, then you probably don't have a lot of need for a SAS 70 either. However, the reviews of internal controls may become more intensive when the Sarbanes Oxley assessments become required. So it may be beneficial to have one in the future.