by the service auditor in the description of tests of controls and results. Note: Deviations in the results of tests of controls should be considered individually and in the aggregate to determine their effect, if any, on audit procedures to be performed. Service Organization’s Response included in the Control Objective # description of the Service Plan Auditor’s Response Deviation(s) noted (from table above) Organization’s System (Such (see note below) responses are not covered by the service auditor’s opinion) Note: Consider any mitigating controls in place at the plan sponsor, or consider designing procedures to address the risks related to the deviations identified in the table above. Conclusion: Deviations were as documented above; however, we have concluded that they would not significantly affect the nature, timing and extent of our procedures in the audit of the employee benefit plan. Although the deviations did not result in a qualification of the service auditor’s opinion on the operating effectiveness of the controls to achieve the control objective, the following procedures were completed by the plan auditor to address and evaluate the effect of the deviations on the audit. Document procedures performed and include any supporting documentation. Section VII Complementary User Entity Controls – Summarize any complementary user entity control considerations identified in the service organization’s description of its system. Are the Complementary user entity control Work Complementary user entity considerations identified in the service control considerations No. organization’s description relevant to the plan? If reference identified in the service No, document If Yes, document (see note organization’s description or reference work performed to ensure below)
by the service auditor in the description of tests of controls and results. Note: Deviations in the results of tests of controls should be considered individually and in the aggregate to determine their effect, if any, on audit procedures to be performed. Control Objective # (from table above) Deviation(s) noted Service Organization’s Response included in the description of the Service Organization’s System (Such responses are not covered by the service auditor’s opinion) Plan Auditor’s Response (see note below) Note: Consider any mitigating controls in place at the plan sponsor, or consider designing procedures to address the risks related to the deviations identified in the table above. Conclusion: Deviations were as documented above; however, we have concluded that they would not significantly affect the nature, timing and extent of our procedures in the audit of the employee benefit plan. Although the deviations did not result in a qualification of the service auditor’s opinion on the operating effectiveness of the controls to achieve the control objective, the following procedures were completed by the plan auditor to address and evaluate the effect of the deviations on the audit. Document procedures performed and include any supporting documentation. Section VII – Complementary User Entity Controls Summarize any complementary user entity control considerations identified in the service organization’s description of its system. No. Complementary user entity control considerations identified in the service organization’s description Are the Complementary user entity control considerations identified in the service organization’s description relevant to the plan? If No, document If Yes, document or reference work performed to ensure Work reference (see note below)
soc1_type_2_report_documentation_tool.docx