If a controlling standard does not exist for a service being evaluated, what should an auditor rely on?

When there is no controlling standard available for a service being evaluated, an auditor should rely on persuasive standards with appropriate citations. Persuasive standards serve as guidelines derived from relevant reputable sources, such as professional organizations, peer-reviewed publications, or widely recognized best practices, which can inform the auditor's decisions and assessments. These standards may not be enforceable but can provide insight into what is considered appropriate or acceptable conduct in the absence of binding regulations.

Using persuasive standards allows an auditor to apply an informed approach grounded in credible sources, which can facilitate a more comprehensive evaluation of the service in question. Such an approach is crucial for maintaining consistency and ensuring that audit findings align with generally accepted best practices, thereby supporting the integrity of the audit process.

The other choices, while relevant in different contexts, do not serve as the primary source of guidance when no controlling standard exists. Regulatory changes may not yet be established and could be irrelevant at the time of evaluation. Legal advice from attorneys is typically focused on compliance and liability rather than operational auditing practices. Internal policy guidelines, although useful, may vary between organizations and are not universally applicable in evaluating a service where no established standards exist.