1. Gain an understanding of the services being provided
2. Assess the design and implementation of the internal controls of the service provider
3. Visit the service provider and perform tests of control
4. Contact the service provider's auditor to obtain an opinion on the systems and the suitability of controls