Overview

This Canadian Standard on Assurance Engagements (CSAE) addresses audit engagements undertaken by a service auditor to report on controls at organizations that provide services to user entities when those controls are likely to be relevant to user entities' internal control over financial reporting. It complements CAS 402, Audit Considerations relating to an Entity using a Service Organization, in that reports prepared in accordance with this CSAE may provide appropriate evidence under CAS 402.

The objectives of the service auditor are to: (a) obtain reasonable assurance about whether, in all material respects, based on suitable criteria: (i) management's description of the service organization's system fairly presents the system that was designed and implemented throughout the specified period (or in the case of a type 1 report, as of a specified date); (ii) the controls related to the control objectives stated in management's description of the service organization's system were suitably designed throughout the specified period (or in the case of a type 1 report, as of a specified date); and (iii) when included in the scope of the engagement, the controls operated effectively to provide reasonable assurance that the control objectives stated in management's description of the service organization's system were achieved throughout the specified period; and (b) report on the matters in (a) above, in accordance with the service auditor's findings.

Effective for attestation engagements where the assurance report is dated on or after June 30, 2017, the practitioner is required to comply with both CSAE 3000, Attestation Engagements Other than Audits or Reviews of Historical Financial Information, and this CSAE when performing an assurance engagement to report on controls at a service organization. This CSAE supplements, but does not replace, CSAE 3000 and expands on how CSAE 3000 is to be applied in an assurance engagement to report on controls at a service organization.