I like the direction being proposed; the current SAS70 framework is deficient in providing relying parties substance they can rely on. The focus should not be to replace ISO27001:2005, but rather, it should build on it. For example, an organization could adopt and achive ISO27001:2005 certification and then an inexpensive SAS70 could then be of value to document that the controls implemented within that framework meet the specidic requirements of a regulation, such as HIPAA. This ensures that a continuous improving ISMS is in place and that the controls sufficiently meet the regulatory requirements. This could then be relied upon by both the customers, as well as recognized by the Insurance industry, for reducing the risks associated with information.

Well said and implied.
Aligning Governance, Risk Management and Compliance with business operations will rightfully place both functions together where they have all along belonged. I had contemplated the idea only three days ago behind the wheels and my conclusions align with yours.

Should CEOs then begin to bring CISOs to COOs level or even a bit higher? Should the CISO be on top of the CEO's right hand men; a sort of a personal bastion protecting the organization by delivering real-time data as to risks to assets, and keeping these minimally low as possible by implementing the right controls to support the very top executive to the best of abilities? If not, why not?

Pascal

This article is terrible. It is titled "SAS 70 Changes Coming" and barely discusses SAS 70 audits. 2 of 3 pages don't even mention the word "SAS 70". Is the interviewee a CPA? It doesn't appear so. Wouldn't it make sense to interview a CPA about an audit that only a CPA can issue? Also, what is the interviewee's SAS 70 audit experience? Please cite a source for the claim that "An update on SAS 70 is brewing" and "Talks are happening around the idea of creating general-purpose SAS 70s where you could define to some extent the environment you'll be auditing against and then design and test that environment." Who is having these talks? I am one of the world's leading experts on SAS 70 audits and have no idea what this refers to. ISACA and ASIS have no sway in writing audit standards. Furthermore, how could you write this article and not even mention the pending adoption of the SAS 70 standard as an international standard?? The exposure drafts of the new standard make very little changes to the language of the existing standard. So if any changes are "brewing", they forgot to describe them in the ISAE draft that is anticipated to be adopted as early as April of 2009.