SAS 70 and TPA Firms

[Guest Grumpy456]

Are other TPA firms obtaining SAS 70 certification? What's the prevailing rationale for either foregoing the certification or obtaining it? Thanks!

[BeckyMiller]

In general, benefit plan auditors - the CPA ones, not the government type, will be easier to work with if you have a SAS 70 report. It allows them to rely on that report in many ways and reduce the amount of testing that they must do. But, relying on a SAS 70 is really only worthwhile to the auditor if the firm has many common clients with you. If you do not have many clients that require an audit or if you do not have many clients with the same plan auditor, the amount of work that it takes the auditor to review the SAS 70 and determine how procedures can be modified is probably more work than if they just come in and do the audit.

Having said that, realize that there is an ancillary benefit to you of having a SAS 70. It is a review of your internal controls. A good SAS 70 report lets you know where you are doing a good job and where you have weaknesses. Since weaknesses can mean the potential of costly errors in your work, you might have a business case for having such work done even if the benefit plan auditors are not demanding the work.

Now - I have to say that as a representative of an auditing firm, we do tend to encourage clients to use TPAs and other service providers who have clean SAS 70 reports.

[Guest Grumpy456]

Thanks, Becky. I appreciate your comments.