SAS70 US Experience of KPMG Russia Team

Transcription

1 IT ADVISORY SAS70 US Experience of KPMG Russia Team ADVISORY

2 Some Typical Services Outsourced for a Large-Scale US Company Paycheck Processing IT Services Accounts Payable Medical Claims Reimbursement Travel Services Background Checks Human Resources Compensation and Benefits Career Counseling Records Management Legal Support A typical large-scale company may easily have 5,000-10,000 vendors. A SAS70 is applicable to many of these. 2

3 Which Service Organizations Is SAS70 Applicable For? Quote from ASB: If a service organization is part of the entity s information system and internal control, the responsible party should consider the service organizations activities in making its assertion on internal control.. (Paragraph 35) 3

4 Personal Experience With SAS70 Clients Credit card processing #2 in US Banking statement processing Top 5 Paycheck processing #1 volume-wise in US (KPMG covers all top 3) IT services provision to other depts within a service-oriented organization (a Bank) IT service provider (network and infrastructure support) for hospitals 4

5 US Drivers for Ordering SAS70 Reports SOX404 (both use COSO, Audit Standard 5 only recognizes SAS70 as a an appropriate report, etc) Unified compliance (costs savings, especially when SAS70 report is provided by an external auditor not prohibited) Independence in the eyes of both external auditors and clients A positive factor during the RFP considerations (vendors with SAS70 are often preferred over those that don t have it) 5

6 Indirect Benefits for Companies Better understanding of their own control environment Better Practices implementation 6

7 Issues Observed Scope creep mostly based on incomplete initial descriptions of procedures Lack of the PMO office 70% of Qualified opinion reports for first time SAS70 need to do a pre-assessment (typically 50% of the full SAS70 budget) 7

8 Partial List of SAS70 Clients That KPMG US Serves SAS 70 ADP* Air2Web Atos Origin* Aurum Technologies* Autotote/Scientific Games Bank One/First USA* Bureau of Public Debt California State Automobile Association Cenlar Mortgage Ceridian* Chatham Financial CheckFree* Citigroup* Center for Medicare and Medicaid Deutsche Bank Global Security Services eprofile FISERV* Genuity* Loanstar* Mellon Financial Corp.* Nationwide Insurance Minnesota Life Insurance NelNet* Northern Trust Oklahoma Healthcare Authority* Pennsylvania Higher Education Assistance Agency Pershing Prelude Systems Procard* SEI Siemens Health Services Smith Barney Corporate Trust Southwestern Bell Communications* State of Colorado* TSYS* Verisign Vital Processing Services (VISA)* Wells Fargo* Wachovia Wilmington Trust Company* 8

9 The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation. Questions? Nikolai Legkodimov CCIE CISSP CISA PMP KPMG Limited +7 (915) nlegkodimov@kpmg.ru 9