AT 801: Reporting on Controls at a Service Organization
EFFECTIVE DATE AND APPLICABILITY
|Original Pronouncement||Statements on Standards for Attestation Engagements (SSAE) 16, Reporting on Controls at a Service Organization.|
|Effective Date||This statement currently is effective.|
|Applicability||Examination engagements to report on controls at organizations that provide services to user entities when those controls are likely to be relevant to user entities’ internal control over financial reporting.|
DEFINITION OF TERMS
Carve-out method. A method for reviewing the services provided by a subservice organization, where management’s definition identifies the nature of the services performed and excludes its control objectives and controls from the scope of the service auditor’s engagement.
Complementary user entity controls. Controls that the management of a subservice entity assumes will be implemented by entities using the services of the subservice entity.
Control objectives. The purpose of specific controls.
Controls at a service organization. The policies and procedures used by a service organization that are likely to be relevant to the internal control over the financial reporting of user entities.
Controls at a subservice organization. The policies and procedures used by a subservice organization that are likely to be relevant to the internal control over the financial reporting of user entities.
Criteria. The standard against which the service auditor evaluates subject ...