Considerations of the AuditorConsiderations of the Auditor

Considerations of the Auditor

7 A service organisation may establish and execute policies and procedures that affect the entity’s internal control. These policies and procedures are physically and operationally separate from the entity. When the services provided by the service organisation are limited to recording and processing the entity’s transactions and the entity retains authorisation and maintenance of accountability, the entity may be able to implement effective policies and procedures within its organisation. When the service organisation executes the entity’s transactions and maintains accountability, the entity may deem it necessary to rely on policies and procedures at the service organisation.

8 An auditor appointed to provide an opinion on an entity’s financial report may also have additional statutory or regulatory responsibilities, which may be affected by the entity’s use of a service organisation. For example, sections 307(c) and 307(d) of the Corporations Act 2001 require the auditor to form an opinion on whether the entity has kept proper financial records, and other records and registers as required by that Act.

9 In obtaining an understanding of the entity and its environment, the auditor shall determine the significance of service organisation activities to the entity and the relevance to the audit.

10 In doing so, the auditor ordinarily obtains an understanding of the following, as appropriate:

• the nature of the services provided by the service organisation;
• the terms of contract and relationship between the entity and the service organisation;
• the extent to which the entity’s internal control interacts with the systems at the service organisation;
• the entity’s internal control relevant to the service organisation activities such as:

♦ those that are applied to the transactions processed by the service organisation; and

♦ how the entity identifies and manages risks related to use of the service organisation;

• the service organisation’s capability and financial strength, including the possible effect of the failure of the service organisation on the entity;
• information about the service organisation such as that reflected in user and technical manuals; and
• information available on controls relevant to the service organisation’s information systems such as general IT controls and application controls.

11 The auditor would ordinarily consider the existence of third-party reports from service organisation auditors, internal auditors, or regulatory agencies as a means of obtaining information about the internal control of the service organisation and about its operation and effectiveness. When the auditor intends to use work of the internal auditor, ASA 610 Considering the Work of Internal Audit provides mandatory requirements and explanatory guidance on evaluating the adequacy of the internal auditor’s work for the auditor’s purposes.