Service Auditor's Report (SAS 70) - Who is required to have one?

[Guest Sponias]

The accountant who is performing an independent audit (for 5500 purposes) on a large plan is informing me that we, as third party administrator, must have a SAS 70 report. Does anyone know where I can find more information regarding the Service Auditor's Report?

[E as in ERISA]

Never required. But if they want to review internal controls of plans you administer and you don't have a SAS 70, then they may want to come in and do tests in your shop.

Note that the SAS 70 requirements have not changed dramatically, if at all, for benefit plans. The new Sarbanes Oxley 404 requirements do not apply to SEC filings for benefit plans.

However there are a lot more nuisance inquiries because they are doing a lot more review of internal controls for corporate work and they are mass mailing SAS 70 requests to all vendors of the company.

For basic info on SAS 70 see

http://www.sas70.com/about.htm

http://www.sas70solutions.com/SAS70-FAQ.html

http://www.sas-70.com/

[Guest Sponias]

The websites you provided are very informative. Thanks!