Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p18
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 18/22)
Character Range: 54586–57559

type 2 report offers less audit evidence if there is little overlap between the period covered by the type 2 report and the period for which the user auditor intends to rely on the report.  When this is the case, a type 2 report covering a preceding or subsequent period may provide additional audit evidence.  In other cases, the user auditor may determine it is necessary to perform, or use another auditor to perform, tests of controls at the service organisation in order to obtain sufficient appropriate audit evidence about the operating effectiveness of those controls.

A33.         It may also be necessary for the user auditor to obtain additional evidence about significant changes to the controls at the service organisation outside of the period covered by the type 2 report or determine additional audit procedures to be performed.  Relevant factors in determining what additional audit evidence to obtain about controls at the service organisation that were operating outside of the period covered by the service auditor's report may include:

           * The significance of the assessed risks of material misstatement at the assertion level;

           * The specific controls that were tested during the interim period, and significant changes to them since they were tested, including changes in the information system, processes, and personnel;

           * The degree to which audit evidence about the operating effectiveness of those controls was obtained;

           * The length of the remaining period;

           * The extent to which the user auditor intends to reduce further substantive procedures based on the reliance on controls; and

           * The effectiveness of the control environment and the user entity's process to monitor the system of internal control.

A34.         Additional audit evidence may be obtained, for example, by extending tests of controls over the remaining period or testing the user entity's process to monitor the system of internal control.

A35.         If the service auditor's testing period is completely outside the user entity's financial reporting period, the user auditor will be unable to rely on such tests for the user auditor to conclude that the user entity's controls are operating effectively because they do not provide current audit period evidence of the effectiveness of the controls, unless other procedures are performed.

A36.         In certain circumstances, a service provided by the service organisation may be designed with the assumption that certain controls will be implemented by the user entity.  For example, the service may be designed with the assumption that the user entity will have controls in place for authorising transactions before they are sent to the service organisation for processing.  In such a situation, the service organisation's description of controls may include a description of those complementary user entity controls.  The user auditor considers