Auditing Information Systems, Second Edition

5.3. REPORT OF INDEPENDENT AUDITORS

The independent auditor's report includes an opinion statement on the adequacy of policies and procedures and, if contracted by the service organization, an opinion on whether the policies and procedures were operating with sufficient effectiveness during the specified period. Internal auditors at client organizations should examine the opinion closely. If the opinion is "qualified" due to one or more significant control weaknesses at the service organization, the internal auditor should determine whether the weaknesses significantly affect the internal control environment at the client organization. If so, the internal auditor should recommend that management communicate their concern to the service organization and determine whether the service organization has implemented necessary changes to resolve the control weaknesses.

If the necessary changes have not been implemented, the internal auditor should recommend that management consider changing to another service vendor that does not have any significant control weaknesses that adversely affect the internal control environment at its client organizations. If the original service organization states that the control weaknesses have been corrected, the internal auditor should perform alternative tests to confirm the changes. The internal auditor should also confirm that the same control weaknesses are not mentioned in the next service auditor's report. The existence of perpetual control weaknesses ...