An issuer might outsource a significant process to a service organization. Examples include payroll, production accounting for oil and gas companies, or other bookkeeping services. Based on their assessment of risks as discussed in subsection 6.6(2) of the Policy, the certifying officers might identify the need for controls, policies and procedures relating to an outsourced process. In considering the design and evaluation of such controls, policies and procedures, the officers should consider whether:
(a) the service organization can provide a service auditor’s report on the design and operation of controls placed in operation and tests of the operating effectiveness of controls at the service organization;
(b) the certifying officers have access to the controls in place at the service organization to evaluate the design and effectiveness of such controls; or
(c) the issuer has controls that might eliminate the need for the certifying officers to evaluate the design and effectiveness of the service organization’s controls relating to the outsourced process.