Wiley Practitioner's Guide to GAAS 2013: Covering all SASs, SSAEs, SSARSs, and Interpretations

AT 801: Reporting on Controls at a Service Organization

EFFECTIVE DATE AND APPLICABILITY

Original Pronouncement	Statements on Standards for Attestation Engagements (SSAE) 16, Reporting on Controls at a Service Organization.
Effective Date	This statement currently is effective.
Applicability	Examination engagements to report on controls at organizations that provide services to user entities when those controls are likely to be relevant to user entities’ internal control over financial reporting.

DEFINITION OF TERMS

Carve-out method. A method for reviewing the services provided by a subservice organization, where management’s definition identifies the nature of the services performed and excludes its control objectives and controls from the scope of the service auditor’s engagement.

Complementary user entity controls. Controls that the management of a subservice entity assumes will be implemented by entities using the services of the subservice entity.

Control objectives. The purpose of specific controls.

Controls at a service organization. The policies and procedures used by a service organization that are likely to be relevant to the internal control over the financial reporting of user entities.

Controls at a subservice organization. The policies and procedures used by a subservice organization that are likely to be relevant to the internal control over the financial reporting of user entities.

Criteria. The standard against which the service auditor evaluates subject ...