What is contained within a description of controls?
A description of controls should contain a level of detail that provides user auditors with sufficient information to plan their financial statement audit and for the management of the user organization to make assertions regarding internal controls of its financial reporting. The description of controls does not need to address every aspect of the service organization’s operations or services. Rather, the description of controls should generally contain the following information: • Aspects of the service organization’s control environment; risk assessment; information and communication; and monitoring that may affect the services provided to user organizations, as it relates to an audit of financial statements • Control objectives and related controls activities • Changes to controls since the later of the date of the last report or within the last 12 months There is no required form for a description of controls; however, most audit firms utilize a methodology that accounts for the c
