Existing paragraph 1 is amended to read as follows:
This Auditing Standard deals with the user auditor’s responsibility to obtain sufficient appropriate audit evidence when a user entity uses the services of one or more service organisations. Specifically, it expands on how the user auditor applies ASA 315[1] and ASA 3302 in obtaining an understanding of the user entity, including the entity’s system of internal control relevant to the preparation of the financial report relevant to the audit, sufficient to identify and assess the risks of material misstatement and in designing and performing further audit procedures responsive to those risks.
Existing paragraph 3 is amended to read as follows:
Services provided by a service organisation are relevant to the audit of a user entity’s financial report when those services, and the controls over them, are part of the user entity’s information system , including related business processes, relevant to financial reporting the preparation of the financial report. Although m Most controls at the service organisation are likely to relate to financial reporting be part of the user entity’s information system relevant to the preparation of the financial report, there may be other or related controls that may also be relevant to the audit, such as controls over the safeguarding of assets. A service organisation’s services are part of a user entity’s information system, including related business processes, relevant to financial reporting if these services affect any of the following:
How information relating to significant classes of transactions, account balances and disclosures flows through the user entity’s information system, whether manually or using IT, and whether obtained from within or outside the general ledger and subsidiary ledgers. The classes of transactions in the user entity’s operations that are significant to the user entity’s financial report; This includes when the service organisation’s services affect how:
(b) The procedures, within both information technology (IT) and manual systems, by which the user entity’s transactions are initiated, recorded, processed, corrected as necessary, transferred to the general ledger and reported in the financial report; Transactions of the user entity are initiated, and how information about them is recorded, processed, corrected as necessary, and incorporated in the general ledger and reported in the financial report; and
Information about events or conditions, other than transactions, is captured, processed and disclosed by the user entity in the financial report.
(c) The related accounting records, either in electronic or manual form, supporting information and specific accounts in the user entity’s financial report and other supporting records relating to the flows of information in paragraph 3(a)that are used to initiate, record, process and report the user entity’s transactions; this includes the correction of incorrect information and how information is transferred to the general ledger;
(d) How the user entity’s information system captures events and conditions, other than transactions, that are significant to the financial report;
(ce) The financial reporting process used to prepare the user entity’s financial report from the records described in paragraph 3(b), including as it relates to disclosures and to accounting estimates relating to significant classes of transactions, account balances and disclosures accounting estimates and disclosures; and
(d) The entity’s IT environment relevant to (a) to (c) above.
(f) Controls surrounding journal entries, including non-standard journal entries used to record non-recurring, unusual transactions or adjustments.
…
Existing paragraph 7 is amended to read as follows:
The objectives of the user auditor, when the user entity uses the services of a service organisation, are:
To obtain an understanding of the nature and significance of the services provided by the service organisation and their effect on the user entity’s system of internal control relevant to the audit, sufficient to provide an appropriate basis for the identification and assessment of identify and assess the risks of material misstatement; and
To design and perform audit procedures responsive to those risks.
…
Footnote 3 in paragraph 9 is amended to read as follows:
See ASA 315, paragraph 1119.
Existing paragraph 10 is amended to read as follows:
When obtaining an understanding of the entity’s system of internal control relevant to the audit in accordance with ASA 315,4 the user auditor shall identify controls in the control activities component[4] evaluate the design and implementation of relevant controls at the user entity, from those that relate to the services provided by the service organisation, including those that are applied to the transactions processed by the service organisation, and evaluate their design and determine whether they have been implemented.[5] (Ref: Para. A12–A14)
As a result of the footnotes deletion and insertion above, subsequent footnotes of this Auditing Standard are re-numbered and references to these footnotes are updated accordingly.
Existing paragraph 11 is amended to read as follows:
The user auditor shall determine whether a sufficient understanding of the nature and significance of the services provided by the service organisation and their effect on the user entity’s system of internal control relevant to the audit has been obtained to provide an appropriate basis for the identification and assessment of the risks of material misstatement.
Existing paragraph 12 is amended to read as follows:
If the user auditor is unable to obtain a sufficient understanding from the user entity, the user auditor shall obtain that understanding from one or more of the following procedures:
…
(d) Using another auditor to perform procedures that will provide the necessary information about the relevant controls at the service organisation. (Ref: Para. A15–A20)
Existing paragraph 14 is amended to read as follows:
If the user auditor plans to use a type 1 or type 2 report as audit evidence to support the user auditor’s understanding about the design and implementation of controls at the service organisation, the user auditor shall:
…
(b) Evaluate the sufficiency and appropriateness of the evidence provided by the report for the understanding of the user entity’s internal controls at the service organisation relevant to the audit; and
Existing footnote 7 in paragraph A14 is amended to read as follows:
See ASA 315, paragraph 3026(a)(iii).
Existing paragraph A19 is amended to read as follows:
Another auditor may be used to perform procedures that will provide the necessary information about the relevant controls at the service organisation related to services provided to the user entity. If a type 1 or type 2 report has been issued, the user auditor may use the service auditor to perform these procedures as the service auditor has an existing relationship with the service organisation. The user auditor using the work of another auditor may find the guidance in ASA 600 useful as it relates to understanding another auditor (including that auditor’s independence and professional competence), involvement in the work of another auditor in planning the nature, timing and extent of such work, and in evaluating the sufficiency and appropriateness of the audit evidence obtained.
Existing paragraph A22 is amended to read as follows:
A type 1 or type 2 report, along with information about the user entity, may assist the user auditor in obtaining an understanding of:
…
A type 1 or type 2 report may assist the user auditor in obtaining a sufficient understanding to identify and assess the risks of material misstatement. A type 1 report, however, does not provide any evidence of the operating effectiveness of the relevant controls.
Existing paragraph A29 is amended to read as follows:
The user auditor is required by ASA 330 to design and perform tests of controls to obtain sufficient appropriate audit evidence as to the operating effectiveness of relevant controls in certain circumstances. In the context of a service organisation, this requirement applies when:
…
Existing paragraph A30 is amended to read as follows:
If a type 2 report is not available, a user auditor may contact the service organisation, through the user entity, to request that a service auditor be engaged to provide a type 2 report that includes tests of the operating effectiveness of the relevant controls or the user auditor may use another auditor to perform procedures at the service organisation that test the operating effectiveness of those controls. A user auditor may also visit the service organisation and perform tests of relevant controls if the service organisation agrees to it. The user auditor’s risk assessments are based on the combined evidence provided by the work of another auditor and the user auditor’s own procedures.
Existing paragraph A33 is amended to read as follows:
It may also be necessary for the user auditor to obtain additional evidence about significant changes to the relevant controls at the service organisation outside of the period covered by the type 2 report or determine additional audit procedures to be performed. Relevant factors in determining what additional audit evidence to obtain about controls at the service organisation that were operating outside of the period covered by the service auditor’s report may include:
…
The effectiveness of the control environment and the user entity’s process to monitor the system of internal control monitoring of controls at the user entity.
Existing paragraph A34 is amended to read as follows:
Additional audit evidence may be obtained, for example, by extending tests of controls over the remaining period or testing the user entity’s process to monitor the system of internal control monitoring of controls.
Existing paragraph A39 is amended to read as follows:
The user auditor is required to communicate in writing significant deficiencies identified during the audit to both management and those charged with governance on a timely basis.11 The user auditor is also required to communicate to management at an appropriate level of responsibility on a timely basis other deficiencies in internal control identified during the audit that, in the user auditor’s professional judgement, are of sufficient importance to merit management’s attention.12 Matters that the user auditor may identify during the audit and may communicate to management and those charged with governance of the user entity include:
Any controls within the entity’s process to monitor the system of internal control monitoring of controls that could be implemented by the user entity, including those identified as a result of obtaining a type 1 or type 2 report;