If a service auditor’s report on controls placed in operation and tests of the operating effectiveness of controls is available, the certifying officers should evaluate whether the report provides them sufficient evidence to assess the design and effectiveness of controls relating to the outsourced process. The following factors will be relevant in evaluating whether the report provides sufficient evidence:
(a) the time period covered by the tests of controls and its relation to the as-of date of the certifying officers’ assessment of the issuer’s ICFR;
(b) the scope of the examination and applications covered and the controls tested; and
(c) the results of the tests of controls and the service auditor’s opinion on the operating effectiveness of controls.