Service Auditor's Report
Service Auditor’s Report Contents
A Service Auditor’s Report typically includes several sections:
1. Independent Service Auditor’s Report
2. The Service Organization’s Description of Controls
- Overview
- Control Environment Elements
- Description of Computerized Systems
- Control Objectives, Controls and User Controls
- Considerations for each of the Controls
- Tests of the Controls and Results of the Tests Performed (For Type II Reports)
3. Other information
Type I versus Type II
A Type I report is a report on the controls placed in operation as at a specific date. A Type II report is a report on the controls placed in operation and tests of the operating effectiveness of controls during a specified period of time. The period of time for a Type II report is generally 6 months or 1 year. Since the Type II report is an extension of the Type I report, if you chose to do a Type I report and opted to switch to Type II, the difference is the application of tests of the operating effectiveness of specific controls for the audit period.
Some clients have opted for a Type I report for the first year and a Type II report in subsequent years. This has the advantage of allowing you to review and improve your controls before undergoing the testing in the Type II. (Sarbanes Oxley 404 and MI 52-109 have created time pressures which make this approach less of an option)
Responsibilities During The Audit
The Service Organization is responsible for documenting:
- The Service Organization’s description of controls
- Features of the control environment that may affect the service provided to User Organizations
- Applications and control objectives to be covered by the tests
- Other information the Service Organization may provide
The Service Auditor is responsible for:
- An opinion as to whether Service Organization’s description of its controls presents fairly those controls that have been placed in operation as of the end of the reporting period
- An opinion as to whether the described controls were suitably designed to achieve the specified control objectives
- Other information the Service Auditor may provide
For a Type II Report
- An opinion that the controls that were tested were operating with sufficient effectiveness to provide reasonable, but not absolute, assurance that the control objectives were achieved for the period under review
- Determining which controls are, in his or her judgment necessary to achieve the control objectives and the nature, timing, and extent of the tests of the selected controls
- A description of the tests of operating effectiveness of controls and the results of those tests
