“The use of a service organization does not reduce management's
responsibility to maintain effective internal control over financial
reporting. Rather, user management should evaluate controls at the service
organization, as well as related controls at the user company, when
making its assessment about internal control over financial reporting.”