We have three small companies which are all legally formed entities. We are going to get a SAS 70 Type II audit performed on the main company where all of our operations and IT assets reside. Is there any AICPA guideline or law that will require us to get separate SAS 70 Type II audits for each company individually? Since the scope of our audit is on the operations and technology in the main company, can we just get the audit on this company and include the names of the other two in the audit report?
Thanks for your help.