- The types of services provided to user entities, including, as appropriate, the types of transactions processed.
- The procedures, within both automated and manual systems, by which services are provided, including, as appropriate, procedures by which transactions are initiated, authorized, recorded, processed, corrected as necessary, and transferred to the reports and other information prepared for user entities.
- The related accounting records, whether electronic or manual, and supporting information involved in initiating, authorizing, recording, processing, and reporting transactions.
- The procedures for the correction of incorrect information.
- The method of transferring information, including, but not limited to, reports to user entities.
- The method that the service organization’s system captures and addresses significant events and conditions other than transactions.
- The process used to prepare reports and other information used for user entities.
- The specified control objectives and controls designed to achieve those objectives, including as applicable, complementary user entity controls contemplated in the design of the service organization’s controls.
- Other aspects of the service organization’s control environment, risk assessment process, information and communication systems (including related business processes), control activities, and monitoring controls that are relevant to the services provided.
- In the case of a type 2 report, relevant details of changes to the service organization’s system during the period covered by the description.
It should be noted that SSAE 16 requires the service auditor to determine whether management’s description of the service organization’s system omits or distorts information relevant to the service organization’s system, but acknowledges that management’s description is prepared to meet the needs of a broad range of user entities and their user auditors. Therefore, system descriptions are not required to include every aspect of the service organization’s system that each individual user entity and its user auditor may consider important in its own particular environment. Rather, system descriptions should utilize a “lowest common denominator” approach that presents a level of detail about the system that will be equally applicable to all user entities. Using this approach will ensure that user entities do not misinterpret the applicability of the system description and related controls to the services to which they subscribe.
About the AuthorMore Content by Ryan Buckner