If a significant period of time has elapsed between the time period covered by the tests of controls in a service auditor’s report and the date of the certifying officer’s assessment of ICFR, the certifying officers should consider whether the service organization’s controls have changed subsequent to the period covered by the service auditor’s report. The service organization might communicate certain changes such as changes in its personnel or changes in reports or other data that it provides. Changes might also be indicated by errors identified in the service organization’s processing. If the certifying officers identify changes in the service organization’s controls, they should evaluate the effect of these changes and consider the need for additional procedures. These might include obtaining further information from the service organization, performing procedures at the service organization, or requesting that a service auditor perform specified procedures.
