Document ID: chunk:federal_register_of_legislation:F2020L00252:body:0:p31
Version: federal_register_of_legislation:F2020L00252
Segment Type: other
Provision Reference: 
Character Range: 87019–89867

the relevant controls at the service organisation related to services provided to the user entity.  If a type 1 or type 2 report has been issued, the user auditor may use the service auditor to perform these procedures as the service auditor has an existing relationship with the service organisation.  The user auditor using the work of another auditor may find the guidance in ASA 600 useful as it relates to understanding another auditor (including that auditor's independence and professional competence), involvement in the work of another auditor in planning the nature, timing and extent of such work, and in evaluating the sufficiency and appropriateness of the audit evidence obtained.

120.           Existing paragraph A22 is amended to read as follows:

A type 1 or type 2 report, along with information about the user entity, may assist the user auditor in obtaining an understanding of:

…

A type 1 or type 2 report may assist the user auditor in obtaining a sufficient understanding to identify and assess the risks of material misstatement.  A type 1 report, however, does not provide any evidence of the operating effectiveness of the relevant controls.

121.           Existing paragraph A29 is amended to read as follows:

The user auditor is required by ASA 330 to design and perform tests of controls to obtain sufficient appropriate audit evidence as to the operating effectiveness of relevant controls in certain circumstances.  In the context of a service organisation, this requirement applies when:

…

122.           Existing paragraph A30 is amended to read as follows:

If a type 2 report is not available, a user auditor may contact the service organisation, through the user entity, to request that a service auditor be engaged to provide a type 2 report that includes tests of the operating effectiveness of the relevant controls or the user auditor may use another auditor to perform procedures at the service organisation that test the operating effectiveness of those controls.  A user auditor may also visit the service organisation and perform tests of relevant controls if the service organisation agrees to it.  The user auditor's risk assessments are based on the combined evidence provided by the work of another auditor and the user auditor's own procedures.

123.           Existing paragraph A33 is amended to read as follows:

It may also be necessary for the user auditor to obtain additional evidence about significant changes to the relevant controls at the service organisation outside of the period covered by the type 2 report or determine additional audit procedures to be performed.  Relevant factors in determining what additional audit evidence to obtain about controls at the service organisation that were operating outside of the period covered by the service auditor's report may include: