Do You Really Need a SAS 70 on a Lockbox?
SAS 70 audits-attestations by a company's auditors as to the robustness of its internal controls–are nothing new for Mellon Bank. Thanks to one big and influential client–the federal government-Mellon was conducting SAS 70 audits of its lockbox operation twice a year long before such reviews were required as part of the Sarbanes-Oxley Act. The big difference today: Uncle Sam is not the only one asking.
It's not as if treasurers have been standing in line. But Blaine Carnprobst, Mellon's first vice president and lockbox product manager, describes demand from corporate clients for the statements as "certainly more than trivial."
Recommended For You
Other banks report the same. "So far, we've had about 100 customers request it," reports Steve Stone, senior vice president for treasury operations at PNC Corp. That's out of a base of 3,000 lockbox customers.
The question is, however, do treasurers need them? And the answer–as it has often been during the first year of Section 404 SOX compliance: Maybe yes, maybe no.
Most major lockbox providers have asked their auditors to prepare such statements, after a few cautious treasurers began to make inquiries. While banks say this represents a substantial expense, it is not one that is generally being passed on to customers. The audits are comprised of two types–Type 1, which validates bank procedures and Type 2, a more extensive review that audits how those procedures are followed. "There are two schools of thought among treasurers about SAS 70 forms," PNC's Stone observes. "Some think the lockbox is a critical part of their financial performance and must be documented. Others think they monitor lockbox operations so closely that they have a handle on the process and controls."
So let's go to the audit experts. According to Anne Marchetti, practice director for governance and risk management at Parson Consulting, nearly every public company should request a SAS 70 Type 2 letter from its lockbox bank. "You're outsourcing parts of your cash application or processing on which cash application depends, and cash application definitely has a material impact on your financial statements," she says. "You should have documentation of the bank's processes and controls. There may be a few exceptions, but there won't be many."
Jennifer Meiselman, director of BridgeMark Risk Consulting, a division of BDO Seidman, couldn't disagree more. "If the bank was coding transactions straight to general ledger accounts, that might make a SAS 70 statement useful, but that's not what most lockbox services do," she says. "It would be useful only in exceptional situations."
The bottom line of the debate: SAS 70s on your lockbox may be overkill, but since they're free, it may not hurt to ask.
© 2025 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
