FOLLOW SIT

5970 Audit

5970 Audit

Have your auditors talked to you about a 5970 audit? Don’t fret. As your banking software vendor, we’re here to help. SIT’s process for handling this audit is relatively painless. We simply create a work request to cover our costs, and invite your auditors in to examine the controls we have in place.

At SIT we believe our approach is more prudent and conservative than simply having our own auditors state that we're 5970 compliant. Using your auditors gives you the satisfaction of knowing SIT's processes and controls meet your standards.

CICA 5970: What Is It?

Simply put, a Section 5970 is a financial control audit.

In strict "audit-speak", SIT is considered a service organization and our customers are considered a user organization.

The theory of the 5970 audit is simple. A service organization (like SIT) that performs any work with an operating platform of a user organization inherently becomes part of that user organization's operating platform. Therefore when an audit is to be conducted on the user organization the service organization needs to be included.

CICA 5970: Canada’s Version of SAS 70

Developed by the Canadian Institute of Chartered Accountants (CICA) in 2004, the Section 5970 audit largely adopted its guidelines from an already established American equivalent—the American Institute of Certified Public Accountants Statement on Auditing Standards No. 70 (SAS 70). Both standards examine policies and procedures of organizations in the financial services industry.

These kinds of industry standards have taken on a particular importance since the Sarbanes-Oxley Act was passed in 2002. This United States federal law was created in response to major corporate accounting scandals, including those surrounding Enron. The 5970 is Canada’s response to these high profile cases.

5970 Audit: A bit of History

• 1987: the 5900 and 5130 standards are issued by the Canadian Institute of Chartered Accountants (CICA) to cover service organizations.
• 2001: Enron goes bankrupt with investors losing billions due to accounting fraud.
• 2002: Sarbanes-Oxley Act is passed in the United States with Section 404 focused on stricter audit for internal and external control. As a result, the American Statement on Auditing Standards 70 (SAS 70) takes on increased importance.
• 2004: CICA’s Auditing and Assurance Standards Board (AASB) is influenced by the revised SAS 70 controls in the USA, and creates a new standard to cover the audit of service organizations in Canada—Section 5970.

The above "list" is a small and incomplete example of a control that a 5970 auditor may want to analyze.

Futures: ISAE 3402 May Replace CICA Section 5970

A new standard has recently been proposed to amend Section 5970. The International Standard on Assurance Engagements, Assurance Reports on Controls at a Service Organization (ISAE 3402) could take effect as early as 2011 in Canada.

This standard is already set to affect the SAS 70 standard in the United States as of July 2011, when the American Institute of Certified Public Accountants (AICPA) implements a new SSAE No.16 standard—a standard that will update the SAS 70, and comply with the ISAE 3402 global standard.

CICA, however, has yet to adopt the proposed standard.

WARNING: Major Breaches Occur Despite Industry Standard Compliance.

On November 10, 2010, The New York Times published an article by James Verini entitled "The Great Cyberheist". According to Verini, more than 500 banks were affected by the recent and widely publicized Heartland breach.

The mastermind behind the breach, Albert Gonzalez, a former CIA informant, cost Heartland and other companies "more than $400 million in reimbursements and forensic and legal fees".

And much of the damage remains unknown.

During the time of the breach, however, Heartland Payment Systems Inc. was PCI compliant. This is the Data Security Standard for the Payment Card Industry, a standard that most people believe is more stringent than the CICA 5970 standard.

"By the time Heartland realized something was wrong, the heist was too immense to be believed: data from over 130 million transactions had been exposed." (Verini, "The Great Cyberheist", New York Times.)

SIT recommends that you go beyond any written standard and develop your own security policies and procedures that can help guard sensitive data. SIT will be glad to help you develop and implement any proposed changes to help make your environment more secure.

SIT & Your Auditor

If you find yourself subject to a 5970 audit, you need to call your relationship manager at SIT. We'll be glad to accommodate your auditors on our premises to ensure our processes meet the latest industry standards!