The Two Types of SAS70 Reports

The Two Types of SAS70 Reports

It should be noted that there are two different types of SAS 70 reports. The first type commonly referred to as Type I includes an opinion written by the service auditor. Type I reports describe the degree in which the service organization fairly represent its services in regards to controls that have been implemented in operations and its inherent design to achieve objectives set forth.

Type II reports are similar to Type I, however an additional section is added, the additional section includes the service auditor's opinion on how effective controls operated under the defined period during the review (usually the defined period is six month, but can be longer).

You should note that there is a substantial difference between the Type I and Type II reports Type II reports are more through, because the auditors gives an opinion on how effective the controls operated under the defined period of the review. Type I only lists the controls, but Type II tests the efficacy of these controls to reasonably assure that they are working correctly. Because Type II reports require a much more thorough audit they are usually much more expensive.