CPA Exam — AUDPerforming Further Procedures and Obtaining EvidenceMedium
A client uses an external service organization to process its payroll. The external auditor plans to rely on the service organization's controls. Which of the following is the MOST effective approach for the external auditor to obtain assurance regarding the operating effectiveness of these controls?
- APerform substantive procedures on the client's payroll balances and transactions.
- BObtain a Type 2 SOC report from the service organization's auditor.
- CRequest management's representation letter confirming the service organization's controls are effective.
- DObtain a Type 1 SOC report from the service organization's auditor.
Show answer & explanationAnswer & explanation
Correct answer: B. Obtain a Type 2 SOC report from the service organization's auditor.
A Type 2 SOC report provides evidence regarding the operating effectiveness of the service organization's controls over a period of time, which is directly what the external auditor needs to rely on those controls. A Type 1 report only describes the controls and suitability of their design.
Why the other options are wrong
- A. Performing substantive procedures is an alternative if controls cannot be relied upon, but it's not an approach to 'obtain assurance regarding the operating effectiveness of controls.'
- C. Management's representation is not sufficient audit evidence for the operating effectiveness of controls at a service organization.
- D. A Type 1 SOC report only describes controls at a specific point in time and the suitability of their design; it does not provide evidence of operating effectiveness.
Using the Work of a Service Organization (SOC Reports)
External auditors may rely on System and Organization Controls (SOC) reports, specifically SOC 1 Type 2 reports, to obtain assurance about the operating effectiveness of controls at a service organization that processes transactions for the client.
- SOC 1 reports cover controls relevant to financial reporting.
- Type 1 reports describe controls at a point in time.
- Type 2 reports describe controls and test their operating effectiveness over a period.
- External auditors rely on Type 2 reports for control effectiveness.
Memory trick: To RELY on controls, you need proof they actually WORKED.