ICAEW to update assurance on internal controls of service organisations
ICAEW is consulting on proposed updates to guidance on assurance reports on internal controls of service organisations for third parties, set out in technical release 01/06 AAF
5 Aug 2019
The amendments have been developed with the help of a working party set up by ICAEW’s Audit and Assurance Faculty (AAF), and the proposed changes include further guidance for service auditors, as well as more practical examples on control objectives and reporting.
The technical release is designed to enable service organisations (third party organisations that provide services to user entities) to engage an independent practitioner (a service auditor) to provide an assurance opinion over the relevant controls which seek to manage risks on behalf of user entities.
The assurance opinion can then be made available to user entities and their external auditors (‘user organisations’), avoiding the need for several different user organisations to test the same controls.
The key changes include an expanded introduction on assurance engagements that should assist more accounting firms undertake engagements in accordance with this guidance.
There is expanded guidance for senior management of service organisations, particularly in their role as preparers of the description of the service organisation’s control activities.
The guidance for service auditors has also been expanded, particularly in scenarios where the service organisation uses other service organisations and in respect of the nature, timing and extent of their testing and how the results of that testing gives rise to a range of reporting options that need to be considered by the service auditor.
Although the principle of specifying control objectives to promote consistency of reporting has been retained, the control objectives have been refined and reworded to reflect the current risks faced by service organisations. In some cases, there has been a reduction in the specified control objectives, with certain objectives now presented as illustrative and supplementary.
In addition, control objectives have been specified for two new areas, fiduciary management and property investment administration, while separate control objectives for hedge fund management have been removed.
The stewardship supplement has been withdrawn, in line with the Financial Reporting Council’s (FRC) new Stewardship Code, which makes no specific reference to AAF 01/06.
Dr Nigel Sleigh-Johnson, head of financial reporting, audit and assurance at ICAEW, said: ‘Tech 01/06 is internationally recognised and underpins the work of firms of accountants in this area. The proposed changes to the existing guidance are important and should improve its accessibility.’
The closing date for comment is 30 September.
ICAEW consultation, Assurance on internal controls of services organisations (AAF 01/06)
Pat Sweet | 05-08-2019