Service Organisation Auditor’s ReportsService Organisation Auditor’s Reports

Service Organisation Auditor’s Reports

19 When using a service organisation auditor’s report, the auditor shall consider the nature of and content of that report.

20 The report of the service organisation auditor will ordinarily be one of two types as follows:

Type A — Report on the Design and Implementation of Internal Control

(a) a description of the service organisation’s internal control, ordinarily prepared by the management of the service organisation; and

(b) an opinion by the service organisation auditor that:

(i) the above description is accurate;

(ii) the internal controls are suitably designed to achieve their stated objectives; and

(iii) the internal controls have been implemented.

Type B — Report on the Design, Implementation and Operating Effectiveness of Internal Control

(a) a description of the service organisation’s internal control, ordinarily prepared by the management of the service organisation; and

(b) an opinion by the service organisation auditor that:

(i) the above description is accurate;

(ii) the internal controls are suitably designed to achieve their stated objectives;

(iii) the internal controls have been implemented; and

(iv) the internal controls are operating effectively based on the results from the tests of controls. In addition to the opinion on operating effectiveness, the service organisation auditor would ordinarily identify the tests of controls performed and related results.

The report of the service organisation auditor will ordinarily contain restrictions as to its use (generally to management, the service organisation and its customers, and the entity’s auditors).

21 The auditor shall consider the scope of work performed by the service organisation auditor and shall evaluate the usefulness and appropriateness of reports issued by the service organisation auditor.

22 Type A reports may be useful to the auditor in obtaining an understanding of internal control. However, under paragraph 21 of this Auditing Standard, the auditor needs to disregard such reports as audit evidence about the operating effectiveness of controls.

23 In contrast, Type B reports may provide such audit evidence since tests of control have been performed. When a Type B report is to be used as audit evidence about operating effectiveness of controls, under paragraph 21 of this Auditing Standard, the auditor needs to consider whether the controls tested by the service organisation auditor are relevant to the entity’s transactions, account balances, and disclosures, and related assertions, and whether the service organisation auditor’s tests of control and the results are adequate (for example, the auditor considers the length of the period covered by the service organisation auditor’s tests and the time since the performance of those tests).