.23

As a result of procedures performed at the service organization, the service auditor may become aware of illegal acts, fraud, or uncorrected errors attributable to the service organization's management or employees that may affect one or more user organizations. The terms errors, fraud, and illegal acts are discussed in section 312, Audit Risk and Materiality in Conducting an Audit, and section 317, Illegal Acts by Clients; the discussions therein are relevant to this section. When the service auditor becomes aware of such matters, he or she should determine from the appropriate level of management of the service organization whether this information has been communicated appropriately to affected user organizations, unless those matters are clearly inconsequential. If the management of the service organization has not communicated the information to affected user organizations and is unwilling to do so, the service auditor should inform the service organization's audit committee or others with equivalent authority or responsibility. If the audit committee does not respond appropriately to the service auditor's communication, the service auditor should consider whether to resign from the engagement. The service auditor may wish to consult with his or her attorney in making this decision.