Obtaining an Understanding of the ServicObtaining an Understanding of the Services Provided by a Service Organisation, Including Internal Control

Obtaining an Understanding of the Services Provided by a Service Organisation, Including Internal Control

1. When obtaining an understanding of the user entity in accordance with ASA 315,[3] the user auditor shall obtain an understanding of how a user entity uses the services of a service organisation in the user entity’s operations, including: (Ref: Para. A1‑A2)
   1. The nature of the services provided by the service organisation and the significance of those services to the user entity, including the effect thereof on the user entity’s internal control; (Ref: Para. A3‑A5)
   2. The nature and materiality of the transactions processed or accounts or financial reporting processes affected by the service organisation; (Ref: Para. A6)
   3. The degree of interaction between the activities of the service organisation and those of the user entity; and (Ref: Para. A7)
   4. The nature of the relationship between the user entity and the service organisation, including the relevant contractual terms for the activities undertaken by the service organisation. (Ref: Para. A8‑A11)
2. When obtaining an understanding of the entity’s system of internal control in accordance with ASA 315, the user auditor shall identify controls in the control activities component[4] at the user entity, from those that relate to the services provided by the service organisation, including those that are applied to the transactions processed by the service organisation, and evaluate their design and determine whether they have been implemented.[5] (Ref: Para. A12‑A14)
3. The user auditor shall determine whether a sufficient understanding of the nature and significance of the services provided by the service organisation and their effect on the user entity’s system of internal control has been obtained to provide an appropriate basis for the identification and assessment of the risks of material misstatement.
4. If the user auditor is unable to obtain a sufficient understanding from the user entity, the user auditor shall obtain that understanding from one or more of the following procedures:
   1. Obtaining a type 1 or type 2 report, if available;
   2. Contacting the service organisation, through the user entity, to obtain specific information;
   3. Visiting the service organisation and performing procedures that will provide the necessary information about the relevant controls at the service organisation; or
   4. Using another auditor to perform procedures that will provide the necessary information about controls at the service organisation. (Ref: Para. A15‑A20)

Using a Type 1 or Type 2 Report to Support the User Auditor’s Understanding of the Service Organisation