SAS70 Replacement

Solution & Benefits Lifecycle Related Regulations

SAS70 Compliance Lifecycle

The SAS70 compliance lifecycle includes the following steps, all automatically enacted by the ProcessGene™ GRC Software Suite:

** SSAE 16 is SAS 70 replacement. The changes made to the standard will bring your company, and the rest of the companies in the US, up to date with new international service organization reporting standards, the ISAE3402. Read more about the SSAE 16 and how to adjust your SAS70 compliance practice to this revised regulation. **

Lifecycle step SAS70 activity
SAS70 context establishment
  1. Definition of SAS70 compliance related business processes
  2. Delineation of process diagrams (optional)
  3. Definition of assets within the SAS70 scope
  4. Standardization and documentation of SAS70 regulations, policies and procedures
Risk identification
  1. Risk description, identification of risk stakeholders
  2. Risk classification and determination of heat-maps
  3. Risk assessment and measurement
  4. Determination of Key Risk Indicators (KRIs)
  5. Risk tolerance determination
Control determination
  1. Definition of controls to mitigate identified SAS70 risks
  2. Assignment of SAS70 control owners
  3. Scheduling and monitoring SAS70 control execution
  4. Assessment of residual risk levels
Requirement management
  1. Requirement definition
  2. Automated requirement workflow management
  3. Requirement fulfillment monitoring
SAS70 audit and remediation
  1. Definition and scheduling of SAS70 audit plans
  2. Definition of mechanisms for testing ongoing SAS70 compliance
  3. Collection, analysis and storage of SAS70 audit results
  4. Remediation plan definition, execution and follow-up
SAS70 related incident management
  1. Incident recording
  2. SAS70 related incident handling (using scheduled workflows)
  3. SAS70 related incident analysis and reporting
  4. Incident monitoring and follow-up
SAS70 certification
  1. Hierarchal SAS70 certification process determination
  2. Establishment of an automated SAS70 certification process
  3. Monitoring and reporting SAS70 certification status
  4. Archiving SAS70 certification history
Multi-Org management
  1. Determination of a global SAS70 compliance baseline with mandatory components
  2. Establishing a workflow for examining local (subsidiary) variants
  3. Enforcement of enterprise guidelines, regulations and frameworks within subsidiaries
  4. Control SAS70 compliance level both locally (per subsidiary) and globally from a central HQ cockpit

The ProcessGene™ SAS70 Software Users

The ProcessGene™ SAS70 compliance software provides value to the following users:
  1. C-level management (CEO, CFO, CIO, CRO, COO)
  2. Board of directors
  3. Compliance officers
  4. Internal auditors
  5. SAS70 compliance managers



Continue to: Related Regulations >