Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p17
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 17/22)
Character Range: 51944–54798

intends to rely on the operating effectiveness of controls at the service organisation in determining the nature, timing and extent of substantive procedures); or

(b)                Substantive procedures alone, or in combination with tests of the operating effectiveness of controls at the user entity, cannot provide sufficient appropriate audit evidence at the assertion level.

A30.         If a type 2 report is not available, a user auditor may contact the service organisation, through the user entity, to request that a service auditor be engaged to provide a type 2 report that includes tests of the operating effectiveness of the controls or the user auditor may use another auditor to perform procedures at the service organisation that test the operating effectiveness of those controls.  A user auditor may also visit the service organisation and perform tests of controls if the service organisation agrees to it.  The user auditor's risk assessments are based on the combined evidence provided by the work of another auditor and the user auditor's own procedures.

Using a Type 2 Report as Audit Evidence that Controls at the Service Organisation Are Operating Effectively (Ref: Para. 17)

A31.         A type 2 report may be intended to satisfy the needs of several different user auditors; therefore tests of controls and results described in the service auditor's report may not be relevant to assertions that are significant in the user entity's financial report.  The relevant tests of controls and results are evaluated to determine that the service auditor's report provides sufficient appropriate audit evidence about the effectiveness of the controls to support the user auditor's risk assessment.  In doing so, the user auditor may consider the following factors:

(a)                The time period covered by the tests of controls and the time elapsed since the performance of the tests of controls;

(b)                The scope of the service auditor's work and the services and processes covered, the controls tested and tests that were performed, and the way in which tested controls relate to the user entity's controls; and

(c)                The results of those tests of controls and the service auditor's opinion on the operating effectiveness of the controls.

A32.         For certain assertions, the shorter the period covered by a specific test and the longer the time elapsed since the performance of the test, the less audit evidence the test may provide.  In comparing the period covered by the type 2 report to the user entity's financial reporting period, the user auditor may conclude that the type 2 report offers less audit evidence if there is little overlap between the period covered by the type 2 report and the period for which the user auditor intends to rely on the report.  When this is the case,