When services are outsourced to a third party service provider that significantly impact financial reporting,what should the auditor do to gain evidence over the operating effectiveness of the internal controls at the third party?
A)Review the Type 2 Service Auditor's report (Report on the suitability of the design and operating effectiveness of controls of a service organization).
B)Review the Type 1 Service Auditor's report (Report on the suitability of the design of controls of a service organization).
C)Obtain a comfort letter from the third party on their internal controls.
D)Review the independent auditor's report for the third party.

Question

Quizplus · Accepted Answer

The Type 2 Service Auditor's report provides an independent assessment of the operating effectiveness of the third party's internal controls over financial reporting. The report includes a description of the controls tested, the testing procedures performed, and the results of the testing. Therefore, reviewing the Type 2 report would enable the auditor to gain evidence over the operating effectiveness of the internal controls at the third party. The Type 1 report only provides an assessment of the design of the controls, not their operating effectiveness, so it would not be sufficient. Obtaining a comfort letter or reviewing the independent auditor's report may provide some information about controls at the third party, but they would not be as reliable as the Type 2 report.

When Services Are Outsourced to a Third Party Service Provider