Changes In Controls Attestation Engagements: Are You Ready?

Over the past few years, the introduction of the Sarbanes-Oxley Act together with a greater focus on risk management has generated an increase in demand from service providers in obtaining third party assurance over the design and operating effectiveness of their internal controls. It is, therefore, also not a surprise that as regulation of the financial services industry increases, the existing regulatory standards and frameworks are changing as well.

Historically, the most popular form of controls attestation report has been referred to as a Statement on Auditing Standards No. 70 report (a "SAS 70"). A SAS 70 report is prepared in one of two forms: a Type I or a Type II report. A Type I report provides an opinion on the description and design of an entity's controls as at a point in time. A Type II report, in addition to covering the description and design of controls, also includes an opinion on the operating effectiveness of the entity's controls over a period of