Regulatory Compliance

Does AuditConfirmations have a SAS70 report?

Not yet, but soon.

SAS No. 70, as amended, really is not applicable to an electronic confirmation service organization under the authoritative SAS 70 guidance. It is applicable only to services that are part of the user organization’s (i.e., audit client) information system (AICPA Audit Guide, Service Organizations:Applying SAS No. 70 As Amended, par. I-06). AuditConfirmations is not part of an audit client’s information system and processes no financial transactions for an audit client. Furthermore, even for the auditor, confirmations are corroborating audit evidence, not primary evidence and thus certainly do not need to be covered by a SAS 70.

However, we get so many requests for SAS70, we have elected to complete one. We expect our first Type II SAS 70 to to be issued in September 2010 covering the period from March 1, 2010-August 31, 2010. We do maintain a very tight internal control environment that we intend to reflect in our SAS70 report.

Is AuditConfirmations compliant with authoritative guidance on confirmation procedures?

Yes. You can learn more about key related authoritative guidance and how AuditConfirmations is compliant with it on the guidance page.

Is AuditConfirmations compliant with the Bank Secrecy Act (BSA)?

Yes. The Bank Secrecy Act is codified in the United States Code (USC) at 31 USC §5311-5330. AuditConfirmations is in strict compliance with the BSA and maintains records to support any inquiry by the Secretary of the Treasury, and Federal or State law enforcement agencies. The records would “…support criminal, tax, or regulatory investigations or proceedings, or in the conduct of intelligence or counterintelligence activities, including analysis, to protect against international terrorism” (see §5311).

Is AuditConfirmations compliant with the Gramm-Leach Bliley Act (GLBA)?

Yes. The Gramm-Leach Bliley Act is codified at 15 USC §6801-6809. AuditConfirmations is subject to the GLBA and as such, has undertaken steps with regard to the privacy, use, and protection of nonpublic personal information (NPI). In addition, AuditConfirmations meets the definition for certified public accountants found in section §6803(d)(1)(A-C) of the GLBA. AuditConfirmations does not disclose NPI except to the extent expressly authorized by the auditors, audit clients, and bankers to allow such use in the performance of completing electronic audit confirmations for the purposes of a financial statement audit. Moreover, authorized disclosures of NPI are done in accordance with the GLBA and other related regulations. NPI is not disclosed to any unrelated third-party unless in cases required by law. AuditConfirmations maintains appropriate safeguards to protect NPI.