SOP 07-2: reporting on controls over compliance at service providers.

Securities and Exchange Commission Rule 38a-1 of the Investment Company Act of 1940 and Rule 206(4)-7 of the Investment Advisers Act of 1940 require funds and investment advisers to designate a chief compliance officer to be responsible for administering the compliance policies and procedures of these entities. Many operations of funds and, in some instances, operations of investment advisers are carried out by service providers that have their own compliance policies and procedures that may affect or be part of a fund's or investment adviser's compliance or internal control over compliance (compliance). In addition to its own compliance, Rule 38a-1 requires funds to establish polices and procedures to provide for oversight of compliance of the following service providers: investment advisers, principal underwriters, administrators and transfer agents. The funds and investment advisers that use the services of a service provider are known as user organizations. In some instances, a single entity may be a service provider and a user organization.

An Auditing Standards Board task force recently released Statement of Position No. 07-2, Attestation Engagements That Address Specified Compliance Control Objectives and Related Controls at Entities That Provide Services to Investment Companies, Investment Advisers, or Other Service Providers (No. 014946; see page 7 for ordering instructions). The SOP provides guidance on examining an assertion by management of a service provider about its controls over compliance that affect user organizations.

The SEC Releases adopting the rules note it may be impractical for a fund or its CCO to directly review the policies and procedures of its service providers. In those circumstances, the SEC considers the fund to have satisfied the requirements of Rule 38a-1 if the fund's board of directors, in evaluating whether to approve the service provider's compliance program, uses a "third-party report" on the service provider's policies and procedures.

In the engagement described in the SOP, which is performed under AT...