Alpha Ltd.

Alpha Ltd. uses the payroll processing services of PayServe Ltd., a service organisation.

PayServe’s system description identifies Control X as follows:

“Certain controls necessary to achieve the specified control objectives are expected to be performed by the entities using PayServe’s services. Control X requires Alpha Ltd. to review and approve the exception report generated by PayServe before the payroll records are finally processed. PayServe’s control over the generation of the exception report is designed on the assumption that this review will be performed by Alpha Ltd.”

PayServe has obtained a Type 2 report from its service auditor covering the period from 1 April 2026 to 31 March 2027. The service auditor has tested the relevant controls at PayServe and has reported that they operated effectively throughout the period.

Alpha Ltd. has not performed Control X during the year.

The engagement partner makes the following statements:

Statement 1: Since Control X is performed by Alpha Ltd. and not by PayServe, its non-performance cannot affect the user auditor’s evaluation of the controls at PayServe.

Statement 2: Since the service auditor has expressed an opinion that the relevant controls at PayServe operated effectively, the user auditor may rely on that opinion without considering Control X.

Statement 3: The user auditor should consider whether the absence of Control X affects the achievement of the relevant control objectives and the resulting audit evidence obtained from the service organisation’s controls.

Statement 4: Control X is relevant only to Alpha Ltd.‘s internal control and cannot form part of the matters considered by the user auditor when evaluating the service organisation’s controls.

Which ONE of the following is correct?

A. Statements 1 and 4 only.

B. Statement 3 only.

C. Statements 2 and 3 only.

D. Statements 1, 2 and 4 only.