.16

The guidance in section 319.90 through .99, regarding the auditor's consideration of the sufficiency of evidential matter to support a specific assessed level of control risk is applicable to user auditors considering evidential matter provided by a service auditor's report on controls placed in operation and tests of operating effectiveness. Because the report may be intended to satisfy the needs of several different user auditors, a user auditor should determine whether the specific tests of controls and results in the service auditor's report are relevant to assertions that are significant in the user organization's financial statements. For those tests of controls and results that are relevant, a user auditor should consider whether the nature, timing, and extent of such tests of controls and results provide appropriate evidence about the effectiveness of the controls to support the user auditor's assessed level of control risk. In evaluating these factors, user auditors should also keep in mind that, for certain assumptions, the shorter the period covered by a specific test and the longer the time elapsed since the performance of the test, the less support for control risk reduction the test may provide. [Revised, May 2001, to reflect conforming changes necessary due to the issuance of Statement on Auditing Standards No. 94.]