Auditing Information Systems, Second Edition

5.1. SERVICE AUDITOR REPORTS

Most major service organizations contract with an independent auditing firm to express an opinion on the adequacy of policies and procedures within the service organization that may affect the internal control environment at the client organization. In some cases, the independent auditor may be contracted to perform additional tests to determine whether such policies and procedures are operating effectively within the service organization. These service auditor reports provide some assurance to clients that adequate controls exist within the service organization to ensure the reliability, integrity, and confidentiality of client customer information. Professional auditing standards pertaining to the issuance of service auditor reports in most developed countries are similar but by no means identical. Some standards provide more assurance than others. Therefore, when examining a service auditor report, the reader must be cognizant of the country in which the service organization is domiciled. The following paragraphs examine the current status of professional auditing standards pertaining to the different types of service auditor reports issued in the United States, Canada, the United Kingdom and Australia.

United States

In the United States, a service organization may hire an independent external auditor to express one of two types of opinions on policies and procedures at the service organization that may be relevant to the internal control structure ...