Outsourcing is an inevitable phenomenon with most of the Fortune 1000 Companies. Many client organizations believe that there is a cost benefit to the Outsourcing engagements while there are some risks, however such can be mitigated. Client Management, BoD and their auditors specifically are concerned with the risks involved in outsourcing and finding ways to gain assurance on the internal controls at the vendor operations.

With increased risks pertaining to Outsourcing, now many of the large clients in the US are making a SAS 70 Type II report as a mandatory requirement either for procuring a new IT / BPO vendor or to renew the existing contracts with the current vendors.

Making SAS 70 Reports available to your clients also offers great benefits to client audit teams and Board of Directors. A favorable /unqualified SAS-70 report from the Service Organization/Vendor provides a detailed description of vendor organization’s controls and an independent assessment of whether the controls were in operation, suitably designed for the outsourced process and whether such controls are operating efficiently.

As an added benefit, these reports are useful to Clients’ auditors to assist them in the planning and audit of client’s financial statements /Sarbanes-Oxley Audits. In majority of the cases, a well documented and favorable SAS-70 that is provided by the vendor on a timely basis would enhance the client’s audit preparedness and most likely minimizes additional audits on vendor’s controls and environments.

Service Organizations/Vendors receive significant value from SAS 70 Reports. An organization when completes favorable SAS 70 certification demonstrates that the Organization has established effectively designed control objectives and activities. This certification positively differentiates the organizations from its peers and builds trust with its clients and their regulators.

In most cases, a SAS 70 Report will also satisfy many regulators by serving as a readily available, single source of information that has been independently verified by 3rd party auditors. Such audit / reports helps an organization from having to entertain multiple audit requests from various clients and their auditors, eliminating the strain on the organization’s resources imposed by multiple audit visits.

As with increasing and strenuous external audits initiated by Sarbanes-Oxley 404 Audits, both clients and servicing organization would not want to undermine importance of appropriate and satisfactory audits that were conducted in adherence to AICPA and PCAOB standards. In addition, the SAS 70 process often results in the identification of improvements in operational areas, making the organization more efficient.

A well scope and a successful SAS 70 engagement could be best utilized as a competitive advantage in the outsourcing market. All other criteria being equal among vendors, at times the very fact that a particular vendor has presented an unqualified SAS 70 Reports over the others could be the distinguishing factor that could aid the client’s to make a favorable decision to engage such vendor.