SAS 70 stands for "Statement on Auditing Standard 70", and has been developed and is maintained by the AICPA (American Institute of Certified Public Accountants). It is a report generated by an auditor that assesses the internal controls operating within a company and verifies the controls are in place.

Examples of controls could be "dual signatures are required for all payments above $10,000 in value" or "error log files are reviewed by IT staff at least once a week". Therefore, a SAS 70 report lists the controls in operation within an organization, as verified by the auditor.

The Type II report is more substantial because it does not only assess the controls in operation, but it also includes the auditor's opinion of the effectiveness of the controls. Thus the Type I report simply lists the controls whereas the Type II report also tests the controls to confirm they are working effectively.

More information about the SAS 70 reporting standard can be found at:
http://www.tech-faq.com/sas-70.shtml