SAS 70 report

[Guest mpark]

We do third party admin for 2 clients over 120 participants and need independent audit.

The auditor is requesting an SAS 70 report for our firm

Is a TPA firm required to have a SAS 70 audit done on controls/procedures?

Thank you

[Archimage]

No, it is not required but it will reduce the amount of audit work performed which lowers the price of the audit.

[MGB]

There is nothing special about a SAS 70 report. It is just a single audit, with the results summarized into a report in such a way that the report can be handed out to multiple auditors looking for the same information.

Doing a SAS 70 audit is one audit.

Doing a single audit for each client is multiple audits.

Normally, the SAS 70 audit is a cheaper way to go. However, that depends on how thorough the SAS 70 audit is in comparison to the single audits. Another big differential may be how much knowledge the individual audit firms have in auditing recordkeeping processes. Having someone not familiar trying to do an audit versus having someone audit you that is very familiar may be a huge differential in total cost.

[Jon Chambers]

Having a SAS 70 may be a competitive advantage (or a necessity) if you want to work with larger plan sponsors. I generally advise clients to request a copy of the SAS 70 when they are considering engaging a recordkeeper, as it provides some insight into the internal controls that the recordkeeper has established. While not having a SAS 70 is not necessarily a deal breaker, it may serve as a yellow flag, requiring more caution and diligence by the sponsor.

At this point, most of the larger TPAs in our area obtain a SAS 70 as a matter of course--the market seems to be requiring it.

[rcline46]

After noting that we do have our SAS 70 audit, my personal opinion is that it is a waste of time for a TPA who does not handle client money. It is just a money maker for the CPAs.

But guess who gets to demand them? Sort of a self fulfilling income generator, and they have to be done every year!

[E as in ERISA]

TPAs are getting them more often now, because they're doing more than just reporting on transactions effected by others -- they are often performing functions that are part of the transaction (calculations, voice response, etc.) If you had 50 or 100 or more clients that were audited, then you might want the SAS 70 in order to avoid having each of the plan's auditors come in and inspect your internal controls. But in your case it sounds like it might be less intrusive, less costly to let the 2 auditors come in and inspect your internal controls. Unless you want to market upstream and get larger plans too.

[jquazza]

MPark,

if you're a TPA only, I assume you use an outside firm for your clients custody needs. That's who needs to provide a SAS-70 for the auditors. The SAS-70 doesn't apply to the pure TPA work (the auditor should still review your testing and verify your Recordkeeping.) The SAS-70 is really useful to control the work of the financial institution holding the assets.

[MGB]

Our auditors, our clients, and their auditors agree...SAS 70 is required for pure TPA work (that is all we do and we spend a LOT on SAS 70 reports).

There are a lot more applications of a SAS 70 report than tracking assets at a financial institution, especially now that Sarbanes-Oxley 404 requires controls to be audited for ANY outside servicer of records that could affect the plan sponsor's financial statements.

[AndyH]

MGB, isn't that more important for daily valuation or on-line benefits processing or something similarly transactional that doesn't involve the client directly?

Why would it be necessary for actuarial services, pure consulting services or simple compliance work and recordkeeping? Or would it?

[MGB]

Out of your list, only recordkeeping fits in with a SAS 70 report.

In the Academy Alert that I released a couple of weeks ago, I tried to make the case that SAS 70 reports are generally not applicable to actuarial valuations. Originally, the draft said outright that a SAS 70 report is inappropriate for actuarial services. However, after discussions with the committee, we decided to make a softer statement and concede that actuarial services at some firms could be a candidate for SAS 70 reports. We were thinking of situations where every actuarial valuation is done in the exact same way every time, such as what is seen with numerous insurance companies' or some small TPAs' administration of DB plans.

[Guest 5500]

MGB is absolutely correct. The SAS 70 is not only for custodians or others holding plan assets. It also applies to recordkeepers as stated above.