ASA 402 - Audit Considerations Relating to Entities Using Service Organisations - April 2006
AUDITING STANDARD ASA 402AUDITING STANDARD ASA 402
Start here
Get a plain-English read of AUDITING STANDARD ASA 402
Turn the raw legal text into a practical explanation grounded in ASA 402 - Audit Considerations Relating to Entities Using Service Organisations - April 2006.
Audit Considerations Relating to Entities Using Service Organisations
Application
1 This Auditing Standard applies to:
(a) an audit of a financial report for a financial year, or an audit of a financial report for a half-year, in accordance with Part 2M.3 of the Corporations Act 2001; and
(b) an audit of a financial report for any other purpose.
2 This Auditing Standard also applies, as appropriate, to an audit of other financial information.
Operative Date
3 This Auditing Standard is operative for financial reporting periods commencing on or after 1 July 2006.
Introduction
4 The purpose of this Auditing Standard is to establish mandatory requirements and to provide explanatory guidance to an auditor where the entity uses a service organisation(s). This Auditing Standard also describes the service organisation auditor’s reports which may be obtained by the entity’s auditors. In certain cases, the service organisation may, in turn, use the services of another service organisation(s) (sub-service organisation). Although this Auditing Standard does not specifically refer to a sub-service organisation, it applies to the services provided by the sub-service organisation.
5 The auditor shall consider how an entity’s use of a service organisation affects the entity’s internal control so as to identify and assess the risk of material misstatement and to design and perform further audit procedures.
6 An entity may use a service organisation such as one that executes transactions and maintains related accountability, or records transactions and processes related data (for example, a computer systems service organisation). If the entity uses a service organisation, certain policies, procedures and records maintained by the service organisation may be relevant to the audit of the financial report of the entity.
Considerations of the Auditor
7 A service organisation may establish and execute policies and procedures that affect the entity’s internal control. These policies and procedures are physically and operationally separate from the entity. When the services provided by the service organisation are limited to recording and processing the entity’s transactions and the entity retains authorisation and maintenance of accountability, the entity may be able to implement effective policies and procedures within its organisation. When the service organisation executes the entity’s transactions and maintains accountability, the entity may deem it necessary to rely on policies and procedures at the service organisation.
8 An auditor appointed to provide an opinion on an entity’s financial report may also have additional statutory or regulatory responsibilities, which may be affected by the entity’s use of a service organisation. For example, sections 307(c) and 307(d) of the Corporations Act 2001 require the auditor to form an opinion on whether the entity has kept proper financial records, and other records and registers as required by that Act.
9 In obtaining an understanding of the entity and its environment, the auditor shall determine the significance of service organisation activities to the entity and the relevance to the audit.
10 In doing so, the auditor ordinarily obtains an understanding of the following, as appropriate:
the nature of the services provided by the service organisation;
the terms of contract and relationship between the entity and the service organisation;
the extent to which the entity’s internal control interacts with the systems at the service organisation;
the entity’s internal control relevant to the service organisation activities such as:
♦ those that are applied to the transactions processed by the service organisation; and
♦ how the entity identifies and manages risks related to use of the service organisation;
the service organisation’s capability and financial strength, including the possible effect of the failure of the service organisation on the entity;
information about the service organisation such as that reflected in user and technical manuals; and
information available on controls relevant to the service organisation’s information systems such as general IT controls and application controls.
11 The auditor would ordinarily consider the existence of third-party reports from service organisation auditors, internal auditors, or regulatory agencies as a means of obtaining information about the internal control of the service organisation and about its operation and effectiveness. When the auditor intends to use work of the internal auditor, ASA 610 Considering the Work of Internal Audit provides mandatory requirements and explanatory guidance on evaluating the adequacy of the internal auditor’s work for the auditor’s purposes.
12 The understanding obtained may lead the auditor to decide that the control risk assessment of the risk of material misstatement will not be affected by controls at the service organisation; if so, further consideration of this Auditing Standard is unnecessary.
13 If the auditor concludes that the activities of the service organisation are significant to the entity and relevant to the audit, the auditor shall obtain a sufficient understanding of the entity and its environment, including its internal control, to identify and assess the risks of material misstatement and design further audit procedures in response to the assessed risk.
14 Under ASA 315 Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, the auditor needs to assess the risks of material misstatement at the financial report level and at the assertion level for classes of transactions, account balances and disclosures. Under ASA 330 The Auditor’s Procedures in Response to Assessed Risks, the auditor needs to determine overall responses to assessed risks at the financial report level, and to design and perform further audit procedures to respond to assessed risks at the assertion level, in order to reduce audit risk to an acceptably low level.
15 If the understanding of the entity and its environment obtained is insufficient to identify and assess risks and design further audit procedures, the auditor ordinarily considers the need to request the service organisation to have its auditor perform such risk assessment procedures to supply the necessary information, or the need to visit the service organisation to obtain the information. An auditor wishing to visit a service organisation may advise the entity to request the service organisation to give the auditor access to the necessary information.
16 The auditor may be able to obtain a sufficient understanding of internal control affected by the service organisation by reading the third-party report of the service organisation auditor. In addition, when assessing the risks of material misstatement, for assertions affected by the service organisation’s internal controls, the auditor may also use the service organisation auditor’s report.
17 If the auditor uses the report of a service organisation auditor, the auditor shall consider the professional competence of that auditor in the context of the specific assignment undertaken by the service organisation auditor.
18 Under ASA 330, the auditor needs to obtain audit evidence about the operating effectiveness of controls when the auditor’s risk assessment includes an expectation of the operating effectiveness of the service organisation’s controls or when substantive procedures alone do not provide sufficient appropriate audit evidence at the assertion level. The auditor may also conclude that it would be efficient to obtain audit evidence from tests of controls. Audit evidence about the operating effectiveness of controls may be obtained by the following:
performing tests of the entity’s controls over activities of the service organisation;
obtaining a service organisation auditor’s report that expresses an opinion as to the operating effectiveness of the service organisation’s internal control for the service organisation activities relevant to the audit; and/or
visiting the service organisation and performing tests of controls.
Service Organisation Auditor’s Reports
19 When using a service organisation auditor’s report, the auditor shall consider the nature of and content of that report.
20 The report of the service organisation auditor will ordinarily be one of two types as follows:
Type A — Report on the Design and Implementation of Internal Control
(a) a description of the service organisation’s internal control, ordinarily prepared by the management of the service organisation; and
(b) an opinion by the service organisation auditor that:
(i) the above description is accurate;
(ii) the internal controls are suitably designed to achieve their stated objectives; and
(iii) the internal controls have been implemented.
Type B — Report on the Design, Implementation and Operating Effectiveness of Internal Control
(a) a description of the service organisation’s internal control, ordinarily prepared by the management of the service organisation; and
(b) an opinion by the service organisation auditor that:
(i) the above description is accurate;
(ii) the internal controls are suitably designed to achieve their stated objectives;
(iii) the internal controls have been implemented; and
(iv) the internal controls are operating effectively based on the results from the tests of controls. In addition to the opinion on operating effectiveness, the service organisation auditor would ordinarily identify the tests of controls performed and related results.
The report of the service organisation auditor will ordinarily contain restrictions as to its use (generally to management, the service organisation and its customers, and the entity’s auditors).
21 The auditor shall consider the scope of work performed by the service organisation auditor and shall evaluate the usefulness and appropriateness of reports issued by the service organisation auditor.
22 Type A reports may be useful to the auditor in obtaining an understanding of internal control. However, under paragraph 21 of this Auditing Standard, the auditor needs to disregard such reports as audit evidence about the operating effectiveness of controls.
23 In contrast, Type B reports may provide such audit evidence since tests of control have been performed. When a Type B report is to be used as audit evidence about operating effectiveness of controls, under paragraph 21 of this Auditing Standard, the auditor needs to consider whether the controls tested by the service organisation auditor are relevant to the entity’s transactions, account balances, and disclosures, and related assertions, and whether the service organisation auditor’s tests of control and the results are adequate (for example, the auditor considers the length of the period covered by the service organisation auditor’s tests and the time since the performance of those tests).
24 For those specific tests of control and results that are relevant, the auditor shall consider whether the nature, timing and extent of such tests provide sufficient appropriate audit evidence about the operating effectiveness of the internal control to support the auditor’s assessed risks of material misstatement.
25 In circumstances where the auditor concludes that the work of the service organisation auditor cannot be used, and the auditor has been unable to obtain sufficient appropriate audit evidence about the operating effectiveness of the internal control to support the auditor’s assessed risks of material misstatement, the auditor may conclude that a limitation on the scope of the auditor’s work exists. ASA 701 Modifications to the Auditor’s Report, provides mandatory requirements and explanatory guidance in relation to circumstances where a limitation on the scope of the auditor’s work exists.
26 The auditor of a service organisation may be engaged to perform substantive procedures that are of use to the entity’s auditor. Such engagements may involve the performance of procedures agreed upon by the entity and its auditor and by the service organisation and its auditor.
27 When the auditor uses a report from the auditor of a service organisation, no reference shall be made in the entity’s auditor’s report to the auditor’s report on the service organisation.
Conformity with International Standards on Auditing
28 Except as noted below, this Auditing Standard conforms with International Standard on Auditing ISA 402 Audit Considerations Relating to Entities Using Service Organizations, issued by the International Auditing and Assurance Standards Board of the International Federation of Accountants. The main differences between this Auditing Standard and ISA 402 are:
This Auditing Standard applies to sub-service organisations, whereas ISA 402 does not (paragraph 4).
This Auditing Standard contains a mandatory requirement for the auditor to consider the professional competence of the service organisation auditor, where the auditor uses the report of that auditor, in the context of the specific assignment undertaken by the service organisation auditor (paragraph 17). Where the auditor uses the report of a service organisation auditor, ISA 402 requires the auditor to consider making enquiries concerning the auditor’s professional competence in the context of the specific assignment undertaken by the service organisation auditor.
This Auditing Standard contains explanatory guidance relating to circumstances where the auditor concludes that the work of the service organisation cannot be used, and the auditor has been unable to obtain sufficient appropriate audit evidence about the operating effectiveness of the internal control to support the auditor’s assessed risks of material misstatement, whereas, ISA 402 does not (paragraph 25).
Compliance with this Auditing Standard enables compliance with ISA 402.
Part AUDITING STANDARD ASA 402 - ASA 402 - Audit Considerations Relating to Entities Using Service Organisations - April 2006 - AUDITING STANDARD ASA 402 | Zoe