ISO27001/BS7799 Certification vs Sarbox Compliance

[Lou]

Can anyone name an authoritative source that says that an ISO27001/BS7799 certification is an acceptable alternative to a SAS70 for Sarbox compliance purposes?

[Calvin]

I dont think such a source exist as ISO27001/BS7799 is not considered equivalent to SAS70 type I or II for SOX compliance.

[Lou]

Then is there an authoritative source that says that?

[schellman]

Yes, there is. PCAOB Audit Standard 2, which is freely available for download at pcaobus.org. It identifies a service auditors report (which is a type 2 SAS 70 report in the United States) as being the only acceptable report for inter-auditor communication. An ISO or BS 7799 certification has a completely different purpose, and does not necessarily address control objectives that are relavant to user organizations' internal controls over financial reporting. At best, it would only be good for informational purposes to a third party. Financial statement auditors would be prohibited from using any security "certification" for assessing control risk or SOX financial reporting controls.

There are also authoritative sources in the auditing world, but I will spare you the details.

I hope this helps.

Chris Schellman, CPA, CIA, CISA
Co-Founder
SAS 70 Solutions, Inc.

[mcarecho]

Could someone help me in order to know if I am able to use the ISO 27001 controls objectives for the SAS 70.
Actualy the company I work for has been ISO 27001 certified by the last month and for the following month it will be audit for the SAS 70.

I am trying to understand whether we could use the same controls objectives of the ISO 27001 for the SAS 70 IT general contols since 27001 is a very abroad standard?

You may also answer to my personal e-mail: marianacarecho@gmail.com

Regards,
MC