Audit Considerations Relating To Entities Using Service Organizations ( PSA402 Revised

and Redrafted)

Objective:
❖ To obtain an understanding of the nature and significance of the services provided by the
service organization and their effect on the user entity's internal control.

Requirements:

1.Obtaining an understanding of the services provided by a service organization

● Nature of services provided - effect on entity's internal control
● Nature and materiality of transactions/accounts processed affected by service
organization
● Degree of interaction
● Contractual terms
● Internal control - evaluate controls that relate to services provided by the service
organization
● Determine sufficiency for basis for identifying and assessing RMM
● Unable to obtain
○ Type 1 or type 2 report
○ Contracting service organization through the user entity
○ Visiting service organization and performing procedures
○ Using another auditor

Using Type 1 or Type 2 report to support the user Auditor’s understanding of the service
organization
❖ Type 1 report
➢ Description by management
■ Service organizations system, control objectives and related controls
■ Designed and implemented
➢ Report by service auditor
■ Auditor’s opinion on description

❖ Type 2 report
➢ Description by management
■ Type 1 + Operating effectiveness through the period
➢ Report by service auditor
■ Auditor’s opinion on description
■ Description of service auditor’s TOC and results

● Evaluate description is up to date oe specified period

● Sufficiency and appropriateness
2. Responding to the assessed RMM
● SA 330
○ Determine SAAE
○ Perform audit procedures
User auditor’s risk assessment includes
● Expectation that controls and service organization are operating effectively
● Test of controls
○ Type 2 report
○ Performing TOC and service organization
○ Using another auditors to perform test
3. Sub- Service Organization
● Relevant services
● Requirements of this SA
4. Fraud / Non - compliance / Misstatement in relation to service organization
● Inquire management of user entity
● Evaluate the effect on further audit procedures and AR
5. Reporting by the User auditor
● Unable to obtain SAAE reg. To service organization - modify opinion SA 705
● Not refer to the work of service auditor in an modification of opinion - specify
● Does not reduce the user auditor’s responsibility on the opinion