by the service auditor in the description of tests of controls and results. Note: Deviations in the results of tests of controls should be considered individually and in the aggregate to determine their effect, if any, on audit procedures to be performed. Control Objective # (from table above) Deviation(s) noted Service Organization’s Response included in the description of the Service Organization’s System (Such responses are not covered by the service auditor’s opinion) Plan Auditor’s Response (see note below) Note: Consider any mitigating controls in place at the plan sponsor, or consider designing procedures to address the risks related to the deviations identified in the table above. Conclusion: Deviations were as documented above; however, we have concluded that they would not significantly affect the nature, timing and extent of our procedures in the audit of the employee benefit plan. Although the deviations did not result in a qualification of the service auditor’s opinion on the operating effectiveness of the controls to achieve the control objective, the following procedures were completed by the plan auditor to address and evaluate the effect of the deviations on the audit. Document procedures performed and include any supporting documentation. Section VII – Complementary User Entity Controls Summarize any complementary user entity control considerations identified in the service organization’s description of its system. No. Complementary user entity control considerations identified in the service organization’s description Are the Complementary user entity control considerations identified in the service organization’s description relevant to the plan? If No, document If Yes, document or reference work performed to ensure Work reference (see note below)
Page # in the service organization’s description of its system or service auditor’s tests of controls where control objective is listed (from Section VI) Control objective as listed in the description (from Section VI) Does the description of the controls and the control objectives enable the plan auditor to evaluate the design and confirm the implementation of relevant controls and assess risk? (Yes/No) Do the tests of operating effectiveness and results of those tests support the achievement of the stated control objective? (Yes/No) Note: Consider the effect of any deviations identified in the table above in Section VI Reference from Section VII to complementary user entity controls identified in the description that are in place to support the plan auditor’s risk assessment IT General Controls/Control Objectives – Logical Access and Program Change Management Controls/Control Objectives Related to New Plan Set-up – Plan Provisions Controls/Control Objectives Related to New Plan Set-up – Participant Level Data/Accounts and Investments Controls/Control Objectives Related to Eligibility, Enrollment and Participant Data Controls/Control Objectives Related to Contributions – Plan Controls/Control Objectives Related to Contributions – Participant Level Controls/Control Objectives Related to Participant Account Income/Expense Allocations Controls/Control Objectives Related to Distributions to Participants/Beneficiaries Controls/Control Objectives Related to Distributions - Plan Expenses Controls/Control Objectives Related to Marketable Securities Held – Safekeeping & Valuation Controls/Control Objectives Related to Non-readily Marketable Securities Held – Safekeeping & Valuation Evaluation of the Control Objectives Continued
Page # in the service organization’s description of its system or service auditor’s tests of controls where control objective Is listed (from Section VI) Control objective as listed in the description (from Section VI) Does the description of the controls and the control objectives enable the plan auditor to evaluate the design and confirm the implementation of relevant controls and assess risk? (Yes/No) Do the tests of operating effectiveness and results of those tests support the achievement of the stated control objective? (Yes/No) Note: Consider the effect of any deviations identified in the above in Section VI Reference from Section VII to complementary user entity controls identified in the description that are in place to support the plan auditor’s risk assessment Controls/Control Objectives Related to Investment Transactions – Purchases/Sales (Including realized gain/loss) Controls/Control Objectives Related to Investment Income – Plan Level Controls/Control Objectives Related to Report Processing – Plan Level Controls/Control Objectives Related to Report Processing – Participant Level DEFINED CONTRIBUTION ONLY Controls/Control Objectives Related to Participant (Authorization, Calculation and Recording) Controls/Control Objectives Related to Participant Loan Repayments – Plan Level Controls/Control Objectives Related to Participant Loan Repayments – Participant Level Controls/Control Objectives Related to Investment Election Changes and Transfers DEFINED BENEFIT AND HEALTH & WELFARE PLANS Controls/Control Objectives Related to Participant Census Data Controls/Control Objectives Related to Plan Obligations HEALTH & WELFARE PLANS ONLY Controls/Control Objectives Related to Claims Processing Section IX – Payroll Processing Service Organizations Most large payroll processors provide a type 1 or type 2 report but such reports vary widely as to what services are covered. In addition, some payroll processors issue several reports that cover different locations, services or markets. Plan sponsors may contract with different payroll processors to provide different services. Plan sponsors are expected by