Service Organizations and SOC 1 Reports: AU-C 402 for the User Auditor

Functions that once sat in a client's accounting department may now sit with an outside provider: payroll processors, third-party administrators, loan servicers, custodians, hosted ERP or software providers, fund administrators, claims processors. When a provider processes transactions or holds assets that flow into the financial statements, the audit has to deal with it. In US GAAS this is AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization.

This guide explains the user auditor's responsibilities, the difference between a type 1 and type 2 SOC 1 report, and how to evaluate a report so it can support the audit.

Key terms

• User entity: the client that uses a service organization and whose financial statements are being audited.
• User auditor: the auditor of the user entity's financial statements. That is you.
• Service organization: a third party, or part of one, that provides services to user entities that are part of their information systems relevant to financial reporting.
• Service auditor: the practitioner who reports on controls at the service organization.
• Subservice organization: a service organization used by another service organization.

A service is relevant to the user entity's financial reporting if it affects how the user entity initiates, authorizes, records, processes and reports transactions, or if it affects how significant accounts, classes of transactions and disclosures are captured and reported.

What AU-C 402 requires, in outline

The user auditor's objective is to understand the nature and significance of the services provided and their effect on the user entity's internal control relevant to the audit, so as to identify and assess risks of material misstatement, and to design and perform procedures responsive to those risks. The main steps are as follows.

1. Obtain an understanding of how the user entity uses the services, including the nature of the services, the transactions affected, how information flows and what controls the user entity has over the service.
2. Evaluate the design and implementation of relevant controls at the user entity that relate to the services.
3. Determine whether sufficient appropriate evidence is available at the user entity, or whether it must be obtained from the service organization.
4. If it must be obtained from the service organization, the standard lists the ways: obtain a type 1 or type 2 report if one is available, contact the service organization through the user entity for specific information, visit the service organization and perform procedures there, or use another auditor to perform procedures there.

This guide concentrates on step 4's most common route, the report. Where no adequate report exists, substantive procedures on the data at the user entity are often the practical alternative (see below).

What a SOC 1 report is

A SOC 1 report is a report by a service auditor on the service organization's controls that are relevant to user entities' internal control over financial reporting. It is performed under the AICPA's attestation standards (AT-C 320), not under GAAS. The report normally contains:

• management's description of the service organization's system
• management's assertion about the fairness of the description and the suitability of the design of controls (and, for type 2, operating effectiveness)
• the service auditor's report
• for type 2, a description of the tests of controls performed by the service auditor and the results
• other information provided by the service organization, such as responses to exceptions

Do not confuse SOC 1 with SOC 2. A SOC 2 report addresses trust services criteria such as security, availability and confidentiality. It can be helpful context, but a SOC 2 report does not address controls over financial reporting and is not a substitute for a SOC 1 when the service affects the financial statements.

Type 1 vs type 2

If you plan to rely on the service organization's controls to reduce substantive testing, or if substantive procedures alone cannot provide sufficient appropriate evidence for the relevant assertion, you need a type 2 report or your own testing. A type 1 report on its own cannot support an assessment that controls operated effectively.

Evaluating a SOC 1 report

Receiving the report is not the end of the procedure. The user auditor evaluates it.

Check that it is the right report

• Does it cover the services and applications the client actually uses?
• Does the period cover most of the user entity's fiscal year, and what happens in the gap between the end of the report and the balance sheet date? Short periods may not give enough evidence.
• Is the service auditor professionally competent and independent of the service organization? Consider the service auditor's reputation, qualifications and independence from the service organization.

Read what the report says

• Read the opinion for modifications. A qualified opinion may point to exactly the control you intended to rely on.
• Read the control objectives and the controls. Do they address the risks relevant to your audit, such as accuracy of payroll calculations, completeness of loans serviced or the valuation of custodied assets?
• Review exceptions and deviations noted in the service auditor's tests, and management's responses. Evaluate whether any exceptions affect the controls you plan to rely on.

Complementary user entity controls

SOC 1 reports often list controls that the service organization assumes user entities will have in place, such as reviewing output reports, approving changes to master data or restricting access to the service organization's portal. The service auditor's opinion on the control objectives may only hold if those controls exist.

For each relevant complementary user entity control, the user auditor:

• identifies it in the report
• understands how the client addresses it
• tests the control if relying on it, or performs substantive procedures if not

The file should show a mapping from each control to the client's own processes, not only a list of the controls.

Subservice organizations

A service organization may rely on a subservice organization such as a data center or a processing vendor. The report describes it either under the carve-out method, where the subservice organization's controls are excluded and the report states the control objectives that depend on them, or the inclusive method, where they are included in the description and tested.

If carved out, evaluate whether you need evidence about those controls. That can mean obtaining the subservice organization's own SOC 1 report or considering other procedures.

The gap period

A type 2 report generally ends before the user entity's balance sheet date. For the gap, the user auditor considers:

• in practice, a bridge letter (also called a gap letter) from the service organization confirming no significant changes or control failures since the report date. The service organization, not the service auditor, normally issues it, so evaluate it as management's representation
• the significance of the gap, changes in controls, results of the user entity's own monitoring
• additional procedures where the risk justifies them

When there is no report

If the service organization does not provide a report, or the report is not adequate, the user auditor can:

• request access to the service organization to perform tests of controls, or engage a service auditor to do so on the user auditor's behalf
• perform substantive procedures on the data at the user entity, including confirming balances and transactions directly with the service organization

If sufficient appropriate evidence cannot be obtained, the auditor considers the effect on the opinion under AU-C 705. See types of audit opinions.

Reporting: no reference to the service auditor

In a report with an unmodified opinion, the user auditor does not refer to the work of the service auditor. The user auditor remains responsible for the opinion. If the opinion is modified and mentioning the service auditor helps explain the modification, AU-C 402 allows it with a statement that the reference does not reduce the user auditor's responsibility.

Documentation

Under AU-C 230, a good file shows:

• the services used and the accounts and assertions affected
• the understanding of the user entity's controls over the service
• the report obtained, the period covered and the service auditor's opinion
• evaluation of exceptions, complementary user entity controls and subservice organizations
• the bridge letter or other gap procedures
• the audit procedures planned and performed in light of the report
• your conclusion about whether the report supports reliance and to what extent

The audit risk assessment worksheet is a natural home for the link between the service and the assessed risks.

Common problems

• Filing a type 1 report as evidence of operating effectiveness.
• No evaluation of exceptions. The report is placed in the file with no reading.
• Ignoring complementary user entity controls.
• Ignoring carve-outs. The subservice provider hosts the system and no one considers it.
• No coverage of the gap. The report ends in June and the client's year ends in December.
• Treating SOC 2 as SOC 1.
• Using the report for the wrong application or location.

FAQ

What is the difference between a type 1 and type 2 SOC 1 report?

A type 1 report covers the description of the system and the suitability of control design at a point in time. A type 2 report adds tests of operating effectiveness over a period. Only a type 2 report can provide evidence that controls operated effectively.

Can I use a SOC 2 report instead of a SOC 1?

Generally no. SOC 2 addresses trust services criteria such as security and availability, not controls over financial reporting. It may give helpful context, but it does not take the place of a SOC 1 for a service that affects the financial statements.

What is a bridge letter?

A bridge letter, or gap letter, is a statement from the service organization that no significant changes or control failures occurred between the end of the SOC 1 report period and a later date, typically the user entity's year-end. It is management's representation, not an attestation by the service auditor, so the user auditor evaluates it as such.

What are complementary user entity controls?

They are controls that the service organization assumes the user entity has in place. The control objectives in the report may be achieved only if those controls exist and operate. The user auditor identifies them and evaluates whether the client has them.

Do I refer to the service auditor in my audit report?

Not in an unmodified opinion. The user auditor takes sole responsibility for the opinion.

Sources

• AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
• AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting (SOC 1)
• AICPA, SOC 2 Trust Services Criteria (TSP Section 100), as the standard distinguished from SOC 1
• AICPA, AU-C Section 705, Modifications to the Opinion in the Independent Auditor's Report; AU-C Section 230, Audit Documentation

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error