| A31. | A type 2 report may be intended to satisfy the needs of several different user auditors; therefore tests of controls and results described in the service auditor's report may not be relevant to assertions that are significant in the user entity's financial statements. The relevant tests of controls and results are evaluated to determine that the service auditor's report provides sufficient appropriate audit evidence about the effectiveness of the controls to support the user auditor's risk assessment. In doing so, the user auditor may consider the following factors: |
| (a) | The time period covered by the tests of controls and the time elapsed since the performance of the tests of controls; |
| (b) | The scope of the service auditor's work and the services and processes covered, the controls tested and tests that were performed, and the way in which tested controls relate to the user entity's controls; and |
| (c) | The results of those tests of controls and the service auditor's opinion on the operating effectiveness of the controls. |
| A32. | For certain assertions, the shorter the period covered by a specific test and the longer the time elapsed since the performance of the test, the less audit evidence the test may provide. In comparing the period covered by the type 2 report to the user entity's financial reporting period, the user auditor may conclude that the type 2 report offers less audit evidence if there is little overlap between the period covered by the type 2 report and the period for which the user auditor intends to rely on the report. When this is the case, a type 2 report covering a preceding or subsequent period may provide additional audit evidence. In other cases, the user auditor may determine it is necessary to perform, or use another auditor to perform, tests of controls at the service organization in order to obtain sufficient appropriate audit evidence about the operating effectiveness of those controls. |
| A33. | It may also be necessary for the user auditor to obtain additional evidence about significant changes to the relevant controls at the service organization outside of the period covered by the type 2 report or determine additional audit procedures to be performed. Relevant factors in determining what additional audit evidence to obtain about controls at the service organization that were operating outside of the period covered by the service auditor's report may include: |
| The significance of the assessed risks of material misstatement at the assertion level; |
| The specific controls that were tested during the interim period, and significant changes to them since they were tested, including changes in the information system, processes, and personnel; |
| The degree to which audit evidence about the operating effectiveness of those controls was obtained; |
| The length of the remaining period; |
| The extent to which the user auditor intends to reduce further substantive procedures based on the reliance on controls; and |
| The effectiveness of the control environment and monitoring of controls at the user entity. |
| A34. | Additional audit evidence may be obtained, for example, by extending tests of controls over the remaining period or testing the user entity's monitoring of controls. |
| A35. | If the service auditor's testing period is completely outside the user entity's financial reporting period, the user auditor will be unable to rely on such tests for the user auditor to conclude that the user entity's controls are operating effectively because they do not provide current audit period evidence of the effectiveness of the controls, unless other procedures are performed. |
| A36. | In certain circumstances, a service provided by the service organization may be designed with the assumption that certain controls will be implemented by the user entity. For example, the service may be designed with the assumption that the user entity will have controls in place for authorizing transactions before they are sent to the service organization for processing. In such a situation, the service organization's description of controls may include a description of those complementary user entity controls. The user auditor considers whether those complementary user entity controls are relevant to the service provided to the user entity. |
| A37. | If the user auditor believes that the service auditor's report may not provide sufficient appropriate audit evidence, for example, if a service auditor's report does not contain a description of the service auditor's tests of controls and results thereon, the user auditor may supplement the understanding of the service auditor's procedures and conclusions by contacting the service organization, through the user entity, to request a discussion with the service auditor about the scope and results of the service auditor's work. Also, if the user auditor believes it is necessary, the user auditor may contact the service organization, through the user entity, to request that the service auditor perform procedures at the service organization. Alternatively, the user auditor, or another auditor at the request of the user auditor, may perform such procedures. |
| A38. | The service auditor's type 2 report identifies results of tests, including exceptions and other information that could affect the user auditor's conclusions. Exceptions noted by the service auditor or a modified opinion in the service auditor's type 2 report do not automatically mean that the service auditor's type 2 report will not be useful for the audit of the user entity's financial statements in assessing the risks of material misstatement. Rather, the exceptions and the matter giving rise to a modified opinion in the service auditor's type 2 report are considered in the user auditor's assessment of the testing of controls performed by the service auditor. In considering the exceptions and matters giving rise to a modified opinion, the user auditor may discuss such matters with the service auditor. Such communication is dependent upon the user entity contacting the service organization, and obtaining the service organization's approval for the communication to take place. |
 |
Licence and copyright | © 2018, LexisNexis Group a division of Reed Elsevier (UK) Ltd. All rights reserved. |