Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p14
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 14/22)
Character Range: 43628–46577

The control objectives at the service organisation that are relevant to the user entity's financial report assertions; and

(d)                Whether controls at the service organisation are suitably designed and implemented to prevent or detect processing errors that could result in material misstatements in the user entity's financial report.

    A type 1 or type 2 report may assist the user auditor in obtaining a sufficient understanding to identify and assess the risks of material misstatement.  A type 1 report, however, does not provide any evidence of the operating effectiveness of the controls.

A23.         A type 1 or type 2 report that is as of a date or for a period that is outside of the reporting period of a user entity may assist the user auditor in obtaining a preliminary understanding of the controls implemented at the service organisation if the report is supplemented by additional current information from other sources.  If the service organisation's description of controls is as of a date or for a period that precedes the beginning of the period under audit, the user auditor may perform procedures to update the information in a type 1 or type 2 report, such as:

           * Discussing the changes at the service organisation with user entity personnel who would be in a position to know of such changes;

           * Reviewing current documentation and correspondence issued by the service organisation; or

           * Discussing the changes with service organisation personnel.

Responding to the Assessed Risks of Material Misstatement (Ref: Para. 15)

A24.         Whether the use of a service organisation increases a user entity's risk of material misstatement depends on the nature of the services provided and the controls over these services; in some cases, the use of a service organisation may decrease a user entity's risk of material misstatement, particularly if the user entity itself does not possess the expertise necessary to undertake particular activities, such as initiating, processing, and recording transactions, or does not have adequate resources (for example, an IT system).

A25.         When the service organisation maintains material elements of the accounting records of the user entity, direct access to those records may be necessary in order for the user auditor to obtain sufficient appropriate audit evidence relating to the operations of controls over those records or to substantiate transactions and balances recorded in them, or both.  Such access may involve either physical inspection of records at the service organisation's premises or interrogation of records maintained electronically from the user entity or another location, or both.  Where direct access is achieved electronically, the user auditor may thereby obtain evidence as to the adequacy of controls operated by the service organisation over the completeness and integrity of the user entity's data