Читать книгу Wiley Practitioner's Guide to GAAS 2020 - Joanne M. Flood - Страница 289

AU-C 402.08 defines two types of service auditor’s reports:

1 Report on controls placed in operationNOTE: This type of report can help in obtaining an understanding of internal control to plan the audit, but it is not usually in and of itself an adequate basis for reducing the assessed level of control risk below the maximum.

2 Report on controls placed in operation and tests of operating effectiveness

Both types of service auditor’s reports provide an opinion on whether:

 The accompanying description presents fairly, in all material respects, the aspects of the service organization’s controls that may be relevant to a user organization’s internal control;

 The controls have been placed in operation as of a date; and

 The controls are suitably designed to provide reasonable assurance that the specified control objectives would be achieved.

The second type of service auditor’s report adds a list of tests of controls performed by the service auditor and an opinion on whether the controls tested were operating with sufficient effectiveness to provide reasonable, but not absolute, assurance that the related control objectives were achieved during the period specified.

Before using a service auditor’s report, the user auditor should make inquiries about the service auditor’s professional reputation. Also, the user auditor should consider:

 Discussing the audit procedures and their results with the service auditor

 Reviewing the service auditor’s audit program

 Reviewing the service auditor’s audit documentation