An audit client has engaged a third party service organization to host its payroll software package on servers located at the service organization. What options do you have to obtain assurance about the controls embedded in the payroll application?
1) You can visit the service organization to obtain evidence about the design and operating effectiveness of internal controls at the service organization.
2) The service organization can engage its auditor to provide a Type 1 report that provides an opinion about the fairness of the description of the service organization's system and opinion about the suitability of the design of the controls in that system.
3) The service organization may engage its auditor to provide a Type 2 report that provides the opinions contained in a Type 1 report, plus an opinion on the operating effectiveness of controls at the service organization.
4) None of the above are suitable options to obtain assurance about the controls embedded in the payroll application.