John is about to start on the audit of Bourdain Restaurants, a local restaurant chain. In reviewing last year’s work papers, John discovers that Bourdain Restaurants uses an outside service provider for its payroll services. Last year the service organization was treated as a part of the Bourdain’s information system, and the audit team relied on a Type II SAS 70 report. After carefully reviewing the work papers John asks the senior for more information. What information will John receive from the senior on the following questions?

Required:
a. What is a SAS 70 engagement? What is the difference between a Type 1 and Type II SAS 70 report?
b. What characteristics should John look for this year to decide whether the outside service organization is still a part of Bourdain’s information system?
c. What must the audit team consider when deciding whether the SAS 70 audit report provides sufficient evidence about the operating effectiveness of controls?
d. Assume that Bourdain Restaurants has made a change and for the current year obtains a Type I rather than a Type II SAS 70 report. List the audit procedures the senior will expect John and the audit team to perform.