Payroll Data Co. (PDC) processes payroll transactions for a retailer. Cook, CPA, is engaged to express an opinion on a description of PDC's internal controls placed in operation as of a specific date. These controls are relevant to the retailer's internal control, so Cook's report may be useful in providing the retailer's independent auditor with information necessary to plan a financial statement audit. Cook's report should:

Question

Quizplus · Accepted Answer

Choice "A" is correct. There are two types of reports on the processing of transactions by service organizations: "reports on controls placed in operation" and "reports on controls placed in operation and tests of operating effectiveness." The former does not include tests of operating effectiveness and, therefore, are not intended to provide the user auditor with a basis for reducing the assessment of control risk. Accordingly, such reports should include a disclaimer of opinion regarding the operating effectiveness of the controls. Choice "B" is incorrect. The report should contain an indication that the controls were suitably designed to achieve specified control objectives, but it does not provide any assurance regarding the achievement of the user organization's (in this case, the retailer's) objectives. Choice "C" is incorrect. The service auditor (Cook) is not required to identify the service organization's (i.e., PDC's) controls relevant to specific financial statement assertions because this is not a financial statement audit. Choice "D" is incorrect. The service auditor (Cook) is not required to disclose the assessed level of control risk for the service organization (PDC).