CA Final · Advanced Auditing, Assurance and Professional Ethics · Prospective Financial Information and Other Assurance Services

CA Firm Iyer & Co issues a SAE 3402 report on controls at Bharat Data Services Pvt Ltd, a payroll processor. Bharat Data's management asks that the controls over preparation of Bharat Data's own statutory financial statements be included in the report's controls scope, and that the report be freely given to prospective customers. What is the correct view of the service auditor?

Controls over the service organisation's own financial statements are not controls at the service organisation, because they are unrelated to the control objectives stated in its system description. The service auditor may also include wording restricting distribution to intended users, who understand how the system is used, rather than giving it to prospective customers freely.

1. AInclude both requests, since controls over all financial reporting at the service organisation are within scope
2. BControls unrelated to the control objectives in the system description, such as those over its own financial statements, are not controls at the service organisation for this purpose; the auditor may consider restricting distribution to intended usersCorrect
3. CInclude the first request but restrict distribution, because own financial statements controls are always relevant to user entities
4. DDecline the engagement, since a service auditor cannot restrict distribution of the report