Time for a renewed focus on outsourcing compliance programs?

Some experts have discerned that regulators are taking a closer look at outsourcing arrangements these days. For many companies, the answer seems to be SAS70 II (a standard developed by the AICPA) assurances from the service provider. But a commentary on Silicon.com suggests that all companies subject to Sarbanes-Oxley in the U.S. and abroad should not assume that compliance ends if a service provider has the right certifications. This is true even if you have a captive service arrangement, on shore or off. "For these operations, there is often no service level agreement, no detailed contract, no lawyers involved and no internal audit activity." It might be a good time to review your liability here. It could be a little uncomfortable but you need to dialogue with providers about how their compliance efforts at all levels.

For more:
- here's a commentary from Silicon.com

Related Articles:
More jargon: What is a SAS Type II exam?
Software-as-a-Service and Sarbox: Good match?