CA Final · Advanced Auditing, Assurance and Professional Ethics · Prospective Financial Information and Other Assurance Services

Vihaan Logistics Ltd. outsources payroll processing to Paytrack Services, which engages CA Ishaan to issue a SAE 3402 report on controls at Paytrack. Paytrack's management also asks Ishaan to include testing of controls over preparation of Paytrack's own statutory financial statements and to make the report freely available to any prospective customer. Which conclusion is correct under SAE 3402?

Controls over preparing the service organisation's own financial statements are excluded, as they do not relate to the stated control objectives. The report is relevant only to those who understand how the system is used by user entities, so the auditor may add wording restricting distribution to intended users.

1. ABoth requests are acceptable, since controls at the service organisation include all its controls
2. BControls related to preparing the service organisation's own financial statements are not within controls at the service organisation for this purpose, and the report may include wording restricting distribution to intended usersCorrect
3. COnly the second request is unacceptable, because the first is part of the control objectives by default
4. DBoth requests must be accepted if Paytrack pays additional fees