Which of the following statements is correct concerning a service auditor’s report on a service organization?
A. The report is ordinarily distributed to all shareholders of the service organization.
B. The report may include a conclusion on whether controls have been suitably designed or on compliance effectiveness.
C. The report must include a summary assessment of control risk.
D. The report may include a conclusion on whether controls have been suitably designed or on whether they have been suitably designed and operate effectively.
Answer:D
D is correct because such reports are on suitability of design (type I) or suitability of design and operating effectiveness (type II).
A is incorrect because the report is ordinarily restricted in use.
B is incorrect because the report does not address "compliance effectiveness."
C is incorrect because no summary assessment of control risk is included.