Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p19
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 19/22)
Character Range: 57276–60308

controls in place for authorising transactions before they are sent to the service organisation for processing.  In such a situation, the service organisation's description of controls may include a description of those complementary user entity controls.  The user auditor considers whether those complementary user entity controls are relevant to the service provided to the user entity.

A37.         If the user auditor believes that the service auditor's report may not provide sufficient appropriate audit evidence, for example, if a service auditor's report does not contain a description of the service auditor's tests of controls and results thereon, the user auditor may supplement the understanding of the service auditor's procedures and conclusions by contacting the service organisation, through the user entity, to request a discussion with the service auditor about the scope and results of the service auditor's work.  Also, if the user auditor believes it is necessary, the user auditor may contact the service organisation, through the user entity, to request that the service auditor perform procedures at the service organisation.  Alternatively, the user auditor, or another auditor at the request of the user auditor, may perform such procedures.

A38.         The service auditor's type 2 report identifies results of tests, including exceptions and other information that could affect the user auditor's conclusions.  Exceptions noted by the service auditor or a modified opinion in the service auditor's type 2 report do not automatically mean that the service auditor's type 2 report will not be useful for the audit of the user entity's financial report in assessing the risks of material misstatement.  Rather, the exceptions and the matter giving rise to a modified opinion in the service auditor's type 2 report are considered in the user auditor's assessment of the testing of controls performed by the service auditor.  In considering the exceptions and matters giving rise to a modified opinion, the user auditor may discuss such matters with the service auditor.  Such communication is dependent upon the user entity contacting the service organisation, and obtaining the service organisation's approval for the communication to take place.

Communication of deficiencies in internal control identified during the audit

A39.         The user auditor is required to communicate in writing significant deficiencies identified during the audit to both management and those charged with governance on a timely basis.[12]  The user auditor is also required to communicate to management at an appropriate level of responsibility on a timely basis other deficiencies in internal control identified during the audit that, in the user auditor's professional judgement, are of sufficient importance to merit management's attention.[13]  Matters that the user auditor may identify during the audit and may communicate to management and those charged with governance of the user entity include:

           *