2006

Orange Business Services successfully achieves Statement on Auditing Standards No. 70 (SAS 70) Type II certification for data centers in Rennes, France and Oak Hill, Va., U.S.

All companies falling under the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 must prove that their financial statements are accurate and that they apply effective control over the entire reporting chain of financial statements. As a result, this certification is a must for service providers who host or process data belonging to their customers.

how certification is achieved

Independent auditors perform stringent SAS 70 Type II examinations to validate the quality, reliability and integrity of operational processes and controls of any services company. The comprehensive assessment included reviews and a 7-month testing period – Nov. 1, 2005 to May 31, 2006 – of Orange Business Services’ processes, controls and documentation, including:

• Site-specific elements:  such as the physical security and environmental controls in place at Orange managed services sites.
• Process-related elements:  such as deployment, change and incident management, back-up and recovery procedures and customer service.

what certification means to customers

The auditors’ report confirms that Orange Business Services delivers an effective and reliable environment with standardized controls in place to maintain data integrity in all instances and on a global basis.

“With the SAS 70 certification, Orange Business Services exemplifies its ongoing goal of being the partner of choice for managed services,” said Philippe Bourhis, IT Services and Operations, Customer Services & Operations, Orange Business Services. “Our multinational customers are under tremendous pressure to apply strict controls to their business operations and financial reporting. Customers need to work with a partner like Orange Business Services that understands the regulations they’re under and applies the same level of controls to its own business and its managed services.”

About Orange Business Services

Orange Business Services represents the business communications solutions and services provided by the France Telecom Group as of June 1st, 2006. They were previously sold under the France Telecom, Orange, Equant, Etrali, Almerys, EGT, Expertel Consulting, France Telecom Intelmatique, SETIB and Solicia brands.

The offers include converged voice, data and mobile services as well as IT expertise and managed services, all designed to transform business processes and improve productivity. Orange Business Services is present in 166 countries and territories and serves customers in 220.

www.orange-business.com

Editor’s Note

Statement on Auditing Standards (SAS) No. 70, Service Organizations, is an internationally recognized auditing standard developed by the American Institute of Certified Public Accountants (AICPA). A SAS 70 audit or service auditor's examination is widely recognized, because it represents that a service organization has been through an in-depth audit of their control activities, which generally include controls over information technology and related processes.

In developing the 14 control objectives for the SAS 70, the architects engaged two frameworks:  Control Objectives for Information and related Technology (COBIT) and IT Infrastructure Library (ITIL).

In today's global economy, service organizations or service providers must demonstrate that they have adequate controls and safeguards when they host or process data belonging to their customers. In addition, the requirements of Section 404 of the Sarbanes-Oxley Act of 2002 make SAS 70 audit reports even more important to the process of reporting on effective internal controls at service organizations.

Much of the information above is based on the AICPA's audit guide entitled "Service Organizations, Applying SAS No. 70, As Amended". The audit guide is designed to provide guidance to auditors of companies that use service organizations as well as service auditors who perform SAS 70 examinations. The audit guide can be ordered from the AICPA's Web site at www.cpa2biz.com or by calling 1-888-777-7077. The audit guide is listed as publication number 012772SK. For more information on SAS 70 Type II certification, please see www.sas70.com.