Effective June 15, 2011 all reports on controls at service organizations must be performed in accordance with SSAE 16 and/or ISAE 3402, as of that date, the current SAS 70 audit reporting standard will no longer be utilized.

SAS 70 Standard was in place from 1992 through June 2011

Statement on Auditing Standards 70 (SAS 70) is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA) in 1992.  It is used to report on the “processing of transactions by service organizations”, which can be done by completing either a Type I or a Type II audit.  A SAS 70 Type I is known as “reporting on controls placed in operation”, while a SAS 70 Type II is known as “reporting on controls placed in operation” and “tests of operating effectiveness”.

SAS 70 has been replaced by the SSAE 16 Standard for all Attestations (audits) beginning June 2011.