Want independent validation and assurance? Ask for a SAS-70

Area of Science:

• Auditing and Assurance Services
• Healthcare Management
• Information Security

Background:

• Third-party service providers are increasingly utilized in healthcare.
• Ensuring adequate controls within these service organizations is critical for hospitals.
• Regulatory compliance and operational integrity necessitate oversight of outsourced services.

Purpose of the Study:

• To inform hospitals about the importance of Statement on Auditing Standards No.70 (SAS-70) reports.
• To explain the role of SAS-70 audits in verifying service provider controls.
• To guide hospitals in requesting and utilizing SAS-70 reports from their third-party vendors.

Main Methods:

• The abstract describes the nature and purpose of SAS-70 audits.
• It outlines the typical components of a SAS-70 report.
• It recommends the proactive acquisition of SAS-70 reports by hospitals.

Main Results:

• SAS-70 reports provide assurance on a service provider's internal controls.
• These reports are issued by Certified Public Accountants (CPAs).
• SAS-70 reports contain a CPA's opinion, a description of controls, and details on control design.

Conclusions:

• Hospitals must actively request SAS-70 reports from all third-party service providers.
• SAS-70 audits are essential for validating the adequacy of controls in outsourced operations.
• Utilizing SAS-70 reports enhances hospital oversight and risk management for contracted services.