Download Presentation - Plante Moran

Reporting
Deviations / Control Deficiencies
If deviations have been identified, the service auditor’s description of tests and results
should identify the extent of testing performed by the service auditor that led to the
identification of the deviations, including:
# of items tested
Number and nature of deviations noted
If deviations have been identified, it may be helpful to users of the report for management to
disclose, to the extent known
Causative factors for the deviation
Controls that mitigate the effect of the deviation
Corrective actions taken
Other qualitative factors that would assist users in understanding the effect of the
deviations
Information provided by management about controls that mitigate the effect of deviations or
corrective actions should not include forward-looking info, such as future plans to implement
controls.
24