A service organization performs activities that form part of another entity's information system relevant to financial reporting. Payroll processing, transaction recordkeeping, and outsourced accounting can move important processing controls outside the entity whose financial statements are audited.
- User entity: The customer whose transactions or financial reporting processes depend on the service organization.
- User auditor: The auditor responsible for obtaining sufficient appropriate evidence about that customer's financial statements.
- Service auditor: The practitioner who examines and reports on the service organization's controls within a specified system.
The user auditor should identify which outsourced activities affect significant transactions, accounts, disclosures, and financial statement assertions. Outsourcing does not transfer management's responsibility for internal control or the user auditor's responsibility for sufficient appropriate audit evidence.
The auditor should document the purpose of outsourcing and how the service connects to financial reporting risks. Significance depends on transaction volume and complexity, potential misstatement, retained records, and the division of responsibilities, rather than merely the vendor's fees.
A planning record makes those connections explicit:
Common mistakes
- Signature-date substitution. A November 15 report dated after September 30 still leaves October through December outside its operating-effectiveness period.
- Customer approval presumed. Thirty service-auditor selections matching submitted requests do not resolve Linden's six missing independent approvals.
- Automatic sample arithmetic. Two late documentation records among forty inspected reviews do not prescribe mechanical sample expansion; the response depends on their nature and implications for planned reliance.
Bottom line
- SOC 1 addresses financial reporting controls; SOC 2 addresses selected Trust Services Criteria and may inform particular technology risks.
- Type 1 addresses description and design at a date; Type 2 adds operating-effectiveness evidence over a period.
- Outsourcing requires documenting the service, affected assertions, retained controls, available records, and intended audit response.
- Planned reliance depends on relevant controls, adequate tests, appropriate period coverage, and effective complementary controls.
Exam shortcut
The evidence objective determines the approach: understanding design, relying on operation, or testing transaction amounts. The report and remaining procedures must address that objective. Coverage dates determine the operating period; the signature date does not extend it. Excluded systems and subservice controls require separate evaluation. Each exception links to a control objective and assertion. Discarding unrelated controls requires evidence that the weakness extends to them.
The full lesson (about 5,145 words, 34 min read) adds 2 worked examples, all 5 common mistakes, a self-check, free in the app.
Learning objectives
- II.C4
Browse all free CPA AUD lessons or jump into free CPA AUD practice questions.