Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p4
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 4/22)
Character Range: 15569–18849

a service organisation (referred to in this Auditing Standard as a type 1 report) means a report that comprises:

             (i)                 A description, prepared by management of the service organisation, of the service organisation's system, control objectives and related controls that have been designed and implemented as at a specified date; and

             (ii)               A report by the service auditor with the objective of conveying reasonable assurance that includes the service auditor's opinion on the description of the service organisation's system, control objectives and related controls and the suitability of the design of the controls to achieve the specified control objectives.

(c)                Report on the description, design, and operating effectiveness of controls at a service organisation (referred to in this Auditing Standard as a type 2 report) means a report that comprises:

             (i)                 A description, prepared by management of the service organisation, of the service organisation's system, control objectives and related controls, their design and implementation as at a specified date or throughout a specified period and, in some cases, their operating effectiveness throughout a specified period; and

             (ii)               A report by the service auditor with the objective of conveying reasonable assurance that includes:

                  a. The service auditor's opinion on the description of the service organisation's system, control objectives and related controls, the suitability of the design of the controls to achieve the specified control objectives, and the operating effectiveness of the controls; and

                  b. A description of the service auditor's tests of the controls and the results thereof.

(d)                Service auditor means an auditor who, at the request of the service organisation, provides an assurance report on the controls of a service organisation.

(e)                Service organisation means a third‑party organisation (or segment of a third‑party organisation) that provides services to user entities that are part of those entities' information systems relevant to financial reporting.

(f)                 Service organisation's system means the policies and procedures designed, implemented and maintained by the service organisation to provide user entities with the services covered by the service auditor's report.

(g)                Subservice organisation means a service organisation used by another service organisation to perform some of the services provided to user entities that are part of those user entities' information systems relevant to financial reporting.

(h)                User auditor means an auditor who audits and reports on the financial report of a user entity.

(i)                 User entity means an entity that uses a service organisation and whose financial report is being audited.

Requirements

Obtaining an Understanding of the Services Provided by a Service Organisation, Including Internal Control

9.                   When obtaining an understanding of the user entity in accordance with ASA 315,[3] the user auditor shall obtain an understanding of how a user entity uses the services of a