Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p10
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 10/22)
Character Range: 32752–35817

the Service Organisation (Ref: Para. 9(d))

A8.             The contract or service level agreement between the user entity and the service organisation may provide for matters such as:

           * The information to be provided to the user entity and responsibilities for initiating transactions relating to the activities undertaken by the service organisation;

           * The application of requirements of regulatory bodies concerning the form of records to be maintained, or access to them;

           * The indemnification, if any, to be provided to the user entity in the event of a performance failure;

           * Whether the service organisation will provide a report on its controls and, if so, whether such report would be a type 1 or type 2 report;

           * Whether the user auditor has rights of access to the accounting records of the user entity maintained by the service organisation and other information necessary for the conduct of the audit; and

           * Whether the agreement allows for direct communication between the user auditor and the service auditor.

A9.             There is a direct relationship between the service organisation and the user entity and between the service organisation and the service auditor.  These relationships do not necessarily create a direct relationship between the user auditor and the service auditor.  When there is no direct relationship between the user auditor and the service auditor, communications between the user auditor and the service auditor are usually conducted through the user entity and the service organisation.  A direct relationship may also be created between a user auditor and a service auditor, taking into account the relevant ethical and confidentiality considerations.  A user auditor, for example, may use a service auditor to perform procedures on the user auditor's behalf, such as:

(a)                Tests of controls at the service organisation; or

(b)                Substantive procedures on the user entity's financial report transactions and balances maintained by a service organisation.

Considerations Specific to Public Sector Entities

A10.         Public sector auditors generally have broad rights of access established by legislation.  However, there may be situations where such rights of access are not available, for example when the service organisation is located in a different jurisdiction.  In such cases, a public sector auditor may need to obtain an understanding of the legislation applicable in the different jurisdiction to determine whether appropriate access rights can be obtained.  A public sector auditor may also obtain or ask the user entity to incorporate rights of access in any contractual arrangements between the user entity and the service organisation.

A11.         Public sector auditors may also use another auditor to perform tests of controls or substantive procedures in relation to compliance with law, regulation or other authority.

Understanding the Controls Relating to Services Provided by the Service