SAS 70 audits examine controls in service organizations, often including IT controls. Which act's requirements make SAS 70 reports more important?

• A. Sarbanes-Oxley Act of 2002
• B. Gramm-Leach-Bliley Act
• C. Health Insurance Portability and Accountability Act
• D. Federal Information Security Management Act

Answer: (A)

The main idea is how financial-reporting rules drive the need for independent assurance on a service provider’s controls. The Sarbanes-Oxley Act requires public companies to establish, maintain, and attest to the effectiveness of internal controls over financial reporting. When a company relies on a service organization for processes that affect its financial statements, regulators and auditors want solid evidence that those external controls are reliable. A SAS 70 (now used in practice as an SOC 1 type report) offers an independent evaluation of a service provider’s controls relevant to financial reporting, showing whether those controls are well designed and operating effectively. This makes SAS 70 reports particularly valuable under SOX, because they help clients and their auditors gain confidence in the controls that touch the financial statements, reducing the need for duplicative testing. The other acts focus on privacy or security in different domains and don’t tie as directly to financial reporting assurance in the same way, so they don’t elevate the importance of SAS 70 reports to the same extent.