Which of the following is not true?
A) Management may outsource their organizations' IT functions, but they cannot outsource their management responsibilities for internal control.
B) Section 404 requires the explicit testing of outsourced controls.
C) The SAS 70 report, which is prepared by the outsourcer's auditor, attests to the adequacy of the vendor's internal controls.
D) Auditors issue two types of SAS 70 reports: SAS 70 Type I report and SAS 70 Type II report.

Question

Quizplus · Accepted Answer

The SAS 70 report does not attest to the adequacy of the vendor's internal controls; it reports on the controls at a service organization relevant to user entities' internal control over financial reporting.

Which of the Following Is Not True