Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p6
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 6/22)
Character Range: 21496–24614

the audit evidence provided by a type 1 or type 2 report, the user auditor shall be satisfied as to:

(a)                The service auditor's professional competence and independence from the service organisation; and

(b)                The adequacy of the standards under which the type 1 or type 2 report was issued.  (Ref: Para. A21)

14.               If the user auditor plans to use a type 1 or type 2 report as audit evidence to support the user auditor's understanding about the design and implementation of controls at the service organisation, the user auditor shall:

(a)                Evaluate whether the description and design of controls at the service organisation is at a date or for a period that is appropriate for the user auditor's purposes;

(b)                Evaluate the sufficiency and appropriateness of the evidence provided by the report for the understanding of the controls at the service organisation; and

(c)                Determine whether complementary user entity controls identified by the service organisation are relevant to the user entity and, if so, obtain an understanding of whether the user entity has designed and implemented such controls.  (Ref: Para. A22‑A23)

Responding to the Assessed Risks of Material Misstatement

15.               In responding to assessed risks in accordance with ASA 330, the user auditor shall:

(a)                Determine whether sufficient appropriate audit evidence concerning the relevant financial report assertions is available from records held at the user entity; and, if not,

(b)                Perform further audit procedures to obtain sufficient appropriate audit evidence or use another auditor to perform those procedures at the service organisation on the user auditor's behalf.  (Ref: Para. A24‑A28)

Tests of Controls

16.               When the user auditor's risk assessment includes an expectation that controls at the service organisation are operating effectively, the user auditor shall obtain audit evidence about the operating effectiveness of those controls from one or more of the following procedures:

(a)                Obtaining a type 2 report, if available;

(b)                Performing appropriate tests of controls at the service organisation; or

(c)                Using another auditor to perform tests of controls at the service organisation on behalf of the user auditor.  (Ref: Para. A29‑A30)

Using a Type 2 Report as Audit Evidence that Controls at the Service Organisation Are Operating Effectively

17.               If, in accordance with paragraph 16(a) of this Auditing Standard, the user auditor plans to use a type 2 report as audit evidence that controls at the service organisation are operating effectively, the user auditor shall determine whether the service auditor's report provides sufficient appropriate audit evidence about the effectiveness of the controls to support the user auditor's risk assessment by:

(a)                Evaluating whether the description, design and operating effectiveness of controls at the service organisation is at a date or for a period that