An auditor reports on an examination of the effectiveness of an entity’s internal control over financial reporting. If the control criteria used are established by a regulatory agency, the report should
Contain a statement of restriction on use if the criteria have not been subjected to due process procedures and are appropriate only for a limited number of users.
If the criteria were established by a regulatory agency after following due process procedures, including distribution of proposed criteria for public comment, and the criteria are available to users, a standard form of reporting may be used. If the control criteria have not been subjected to due process procedures, and the auditor determines that the criteria are appropriate only for a limited group of users (e.g., those who participated in their establishment), the appropriate form of the report should be modified to include a restriction on use stated in a paragraph following the opinion paragraph (AT 101).