Service organizations receive significant value from having a SAS 70/SSAE 16 Report engagement performed.  Such a report with an unqualified opinion issued by an Independent Accounting Firm differentiates the service organization from its peers by demonstrating the establishment of effectively designed control objectives and control activities.  It builds trust with your customers.

Furthermore, without a current Service Auditor's Report, a service organization may have to entertain multiple audit requests from its customers and their respective auditors which can place a strain on the service organization's resources.  A Service Auditor's Report ensures that all user organizations and their auditors have access to the same information and will satisfy the user auditor's requirements.

Our Approach

MMB employs field-tested best practices when performing a SAS 70/SSAE 16 Report engagement. We evaluate your business situation and related technologies and help establish a course of action. You, your clients and the auditors of your clients will be able to recognize the quality and thoroughness of our work. Through our experience in preparing SAS 70/SSAE 16 reports, we have developed an efficient approach designed to reduce your time commitment and cause minimum disruption to your staff.

Our approach features:

Planning: Working closely together with management and involved parties, we will validate the scope; clarify the roles and expectations of management and MMB; determine the methods of communications; and establish an audit plan and schedule.

Gaining an Understanding: Each client is treated in a manner unique to its respective services, environment or industry. To accomplish this, we conduct walkthroughs with the main process owners and review documentation available to support these discussions.

Documentation: We prepare narratives and lists of documents, reports and electronic data needed to complete our audit procedures. During this phase, ongoing discussions are held with management to determine the final control objectives and identify the controls most suitable to achieve those control objectives.

Design and Execution of Testing: Testing typically includes inquiry, observation of activities, inspection of documents and records and re-performance of the control. Throughout the execution of our testing we discuss our findings immediately with the main process owners.

Reporting: In the final phase, we prepare our draft report and submit it to management for review. The report includes our opinion, the control narratives, critical controls, test procedures and any exceptions identified. As the report is being reviewed by management, the working papers supporting our testing and the report undergo a rigorous internal review to ensure the quality of the final product.

For more information contact: