FinServe Ltd.

FinServe Ltd. provides investment-accounting services to several banks. Its management has prepared a description of its system and has engaged a service auditor to report on controls.

The service auditor is considering whether the engagement should be a Type 1 or Type 2 engagement.

The following circumstances exist:

Management wants assurance only that the controls were suitably designed and implemented as at 31 March 2027.
One user entity wants assurance that specified controls operated effectively throughout the period from 1 April 2026 to 31 March 2027.
The service auditor intends to perform tests of operating effectiveness only in relation to the second requirement.
The service organisation’s management wants the same report to cover both the description of the system and the operating effectiveness of specified controls.

Which ONE of the following is most appropriate?

A. A Type 1 report is sufficient because once the controls are suitably designed and implemented, their operating effectiveness is presumed for the period covered.

B. A Type 2 report may address both the description and suitability of design of controls as well as the operating effectiveness of specified controls for a period.

C. Two separate Type 1 reports are mandatory because Type 1 and Type 2 reports cannot address different aspects of the same system.

D. A Type 2 report cannot be issued unless every control described by management is tested for operating effectiveness throughout the entire period.