Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p20
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 20/22)
Character Range: 60026–62950

in the user auditor's professional judgement, are of sufficient importance to merit management's attention.[13]  Matters that the user auditor may identify during the audit and may communicate to management and those charged with governance of the user entity include:

           * Any controls within the entity's process to monitor the system of internal control that could be implemented by the user entity, including those identified as a result of obtaining a type 1 or type 2 report;

           * Instances where complementary user entity controls are noted in the type 1 or type 2 report and are not implemented at the user entity; and

           * Controls that may be needed at the service organisation that do not appear to have been implemented or that are not specifically covered by a type 2 report.

Type 1 and Type 2 Reports that Exclude the Services of a Subservice Organisation (Ref: Para. 18)

A40.         If a service organisation uses a subservice organisation, the service auditor's report may either include or exclude the subservice organisation's relevant control objectives and related controls in the service organisation's description of its system and in the scope of the service auditor's engagement.  These two methods of reporting are known as the inclusive method and the carve‑out method, respectively.  If the type 1 or type 2 report excludes the controls at a subservice organisation, and the services provided by the subservice organisation are relevant to the audit of the user entity's financial report, the user auditor is required to apply the requirements of this Auditing Standard in respect of the subservice organisation.  The nature and extent of work to be performed by the user auditor regarding the services provided by a subservice organisation depend on the nature and significance of those services to the user entity and the relevance of those services to the audit.  The application of the requirement in paragraph 9 assists the user auditor in determining the effect of the subservice organisation and the nature and extent of work to be performed.

Fraud, Non‑Compliance with Laws and Regulations and Uncorrected Misstatements in Relation to Activities at the Service Organisation (Ref: Para. 19)

A41.         A service organisation may be required under the terms of the contract with user entities to disclose to affected user entities any fraud, non‑compliance with laws and regulations or uncorrected misstatements attributable to the service organisation's management or employees.  As required by paragraph 19, the user auditor makes enquiries of the user entity management regarding whether the service organisation has reported any such matters and evaluates whether any matters reported by the service organisation affect the nature, timing and extent of the user auditor's further audit procedures.  In certain circumstances, the user auditor may require