As noted in paragraph 9(c) , control objectives relate to risks that controls seek to mitigate.  For example, the risk that a transaction is recorded at the wrong amount or in the wrong period can be expressed as a control objective that transactions are …

A request to change the scope of the engagement may not have a reasonable justification when, for example, the request is made to exclude certain control objectives from the scope of the engagement because of the likelihood that the service auditor’s …

A request to change the scope of the engagement may have a reasonable justification when, for example, the request is made to exclude from the engagement a subservice organisation when the service organisation cannot arrange for access by the service …

An example engagement letter is contained in [Aus] Append ix 0A. …

Criteria need to be available to the intended users to allow them to understand the basis for the service organisation’s statement about the fair presentation of its description of the system, the suitability of the design of controls and, in the case of …

ASAE 3000 requires the service auditor, among other things, to determine whether the criteria to be used are suitable, and to determine the appropriateness of the underlying subject matter. [11]   The underlying subject matter is the underlying condition …

Paragraph 16(a) identifies a number of elements that are included in the service organisation’s description of its system as appropriate.  These elements may not be appropriate if the system being described is not a system that processes transactions, for …

In an engagement to report on controls at a service organisation, the concept of materiality relates to the system being reported on, not the financial reports/statements of user entities.  The service auditor plans and performs procedures to determine …