As a service provider, should the language in our service agreements be changed from SAS 70 to SSAE 16?

User's Picture
Anonymous (Marketing Coordinator)
| Apr 21, 2011

This question was asked by an attendee at a recent Proformative SAS 70/SSAE 16 event: As a service provider, should the language in our service agreements be changed from SAS 70 to SSAE 16?

Topics:

Answers

Sam Wholley's Profile
Sam Wholley (Consultant, Frank, Rimerman + Co. LLP)
Profile
Sam Wholley
Title: Consultant
Company: Frank, Rimerman + Co. LLP
| May 3, 2011

Yes, if the report issued is produced under SSAE 16, it should change. If you do not have an SSAE 16 report issued, keep the language reflective of the SAS 70 if applicable. Only change the language if the document available for review is the SSAE 16 report. If you are seeking to handle the transition, and you have a SAS 70 report in place, you might use some language in your Service Level Agreement that references adherence to the controls asserted in the SAS 70 report until such time as a new report is available.

For full access, login or register
Topic Expert
Mark Hurst's Profile
Mark Hurst (Director of BAS, Hein and Associates)
Profile
Mark Hurst
Title: Director of BAS
Company: Hein and Associates
| May 5, 2011

You may also keep your terminology generic and say service organization control report covering (description of the systems/processes).

For full access, login or register