James-Here’s an advisory alert from AuditOne that may be of interest to you.

AuditOne Inc. Advisory Alert Changes to SAS 70 Requirements

AuditOne Inc. is dedicated to staying current on all the changes, nuances, and requirement techniques of the SSAE16 process. This Advisory Alert announces important changes to the traditional SAS 70 Types I and II reporting process. The new rules, entitled Statement on Standards for Attestation Engagements #16 (SSAE16) replace the SAS 70 rules, and become effective for reports for periods ending on or after 6-15-2011.

1) Under SSAE16, the service provider must provide a written statement of "the description of the provider's system" that will be included in Section 2 of the SSAE16 report. This is new and not previously required. This system description is to include: how the system was designed and implemented to process relevant transactions; any material changes to the system during the period covered; statement of the system controls

2) The service provider will provide an “Assertion by Management” of a Service Organization for a Type I or II Report. While this is technically new, it is basically the same content as the "Representation Letter" now done for SAS 70s. The major difference is that this new Assertion by Management letter must now be incorporated into the SSAE16 report.

3) The SSAE16 can be accomplished by either the "Carve-Out Method" or the "Inclusive Method." The Inclusive Method includes a description of the nature of the services and controls provided by subservice organizations. The Carve-Out Method does not examine the controls of the subservice organizations' systems.

Bud Genovese is Managing Director of AuditOne Inc, California-based CPA firm whose skilled audit, technical and security experts deliver the highest quality, cost-effective, responsive SSAE16 and SAS 70 service in the industry. Contact Bud Genovese at 408-980-8099 bud.genovese@audit-one.com AuditOne Inc. www.auditoneinc.com