Outsourcing a process does not outsource responsibility for the controls over it. Payroll processors, lockbox providers, cloud accounting platforms, third-party logistics firms and outsourced AP teams all perform steps that feed the financial statements. This post covers how to inventory those providers, decide what evidence is needed, and use service organization reports, with anchors in the SEC's guidance, the IIA's third-party Topical Requirement and NIST CSF 2.0.
What management still owns
The SEC's interpretive guidance for management defines ICFR as a process designed by or under the supervision of the principal executive and financial officers, and management's evaluation has to identify the controls that address financial reporting risks whether or not another party performs a step. Rule 13a-15(d) requires evaluation each quarter of changes in ICFR, and moving a process to a provider is such a change. See /us/blog/rule-13a-15-quarterly-evaluations-disclosure-controls-and-changes-in-icfr.
Step 1: Inventory and tier
List every third party that touches financial data or performs a financial process. Tier by effect on the financial statements and on operations:
| Tier | Definition | Example | Evidence expected |
|---|---|---|---|
| 1 | Performs a process or hosts a system that directly feeds financial reporting | Payroll processor, cloud ERP, lockbox bank, outsourced AP | Service organization report, user controls, direct monitoring |
| 2 | Supports operations with indirect financial effect | Freight carrier, warehouse operator | Contract terms, periodic confirmations, site visits |
| 3 | Limited or no financial effect | Office suppliers | Standard onboarding |
Step 2: Decide what the provider covers
Split each outsourced process into steps: which steps the provider performs, which the company retains, and which controls the company needs to monitor the provider. The SEC guidance gives the structure: for IT-dependent controls, management considers both the application controls and the ITGCs over the applications providing the functionality. When a provider runs the application, the provider's ITGCs are part of that picture.
Step 3: Use service organization reports
A report on the provider's controls can give evidence of design and operation. The key decisions are the type of report, the period, the scope and the exceptions. A report covering ten months leaves a gap before year-end that needs bridging. A report that excludes a subservice organization carves it out, and management then needs its own evidence for that part. See /us/blog/service-organizations-soc-1-reports-au-c-402 and /us/blog/reviewing-soc-reports-complementary-user-entity-controls. The glossary entries /us/glossary/complementary-user-entity-controls and /us/glossary/subservice-organization define the terms.
Document, for each report: whether the report scope covers the controls relevant to your risks, the period, any qualifications, each exception and its effect on you, and each user entity control the provider expects you to perform, with the owner and evidence on your side.
Step 4: Monitor
Standard monitoring controls: review of provider service level reports; reconciliation of provider output to the general ledger (for example, payroll register to the general ledger, lockbox deposits to the bank); periodic meetings; and a process for incident notification. NIST CSF 2.0 includes outcomes for this: GV.SC-07 (risks posed by a supplier and its products and services are understood, recorded, prioritized, assessed, responded to and monitored over the relationship), GV.SC-06 (planning and due diligence before entering formal relationships), GV.SC-05 (cybersecurity requirements integrated into contracts) and DE.CM-06 (external service provider activities and services are monitored to find potentially adverse events).
IIA Topical Requirement
The IIA's Third-Party Topical Requirement became effective September 15, 2026. Under the Standards, internal auditors must conform with the relevant requirements when an engagement's scope includes an identified topic. A procurement or outsourcing engagement that covers selection, monitoring or exit of third parties falls in scope. See /us/blog/internal-audit-topical-requirements-cybersecurity-third-party-and-organizational-behavior.
Worked example
In this hypothetical, a company outsources payroll to a provider that issues a service organization report covering January 1 to September 30. The company's fiscal year ends December 31.
- Scope. The report covers payroll processing and tax filing, but carves out the provider's data center host.
- Exceptions. One exception: new client setup reviews were not performed for 2 of 25 samples.
- Gap period. October through December are uncovered.
- User controls. The report expects the user to approve payroll registers, review change reports and notify of terminations.
Actions: obtain a bridge letter from the provider for the remaining period and test the company's own monthly register review for October through December; map the provider's user entity controls to the company's H2R controls and test each (see /us/blog/hire-to-retire-payroll-rcm-key-controls-and-test-steps); document why the new-client setup exception does not affect the company, since its payroll setup is not new; and obtain assurance on the carved-out data center host or conclude that company controls over data accuracy compensate.
Contract terms
Contracts should give the company the right to receive service organization reports, to audit or inspect where the report is insufficient, to be notified of incidents, and to receive data on exit. IIA Standard 13.2 Engagement Risk Assessment requires auditors to gather information about the governance, risk management and control processes of the activity under review and the criteria for evaluating them; contract terms are a practical source of those criteria.
Mistakes to avoid
- Filing the report and not reading the exceptions.
- Ignoring carve-outs.
- No owner for the user entity controls.
- Leaving small cloud tools that touch financial data off the inventory.
- Assuming the provider's report covers the company's configuration choices.
CORAA prepares ready-to-review audit files for US CPA firms from client books; the firm keeps the client, the review and the signature. See /us.
Sources
- SEC, Release No. 33-8810, Section II.A.1.d, Role of Information Technology General Controls: https://www.sec.gov/rules/interp/2007/33-8810.pdf
- SEC, 17 CFR 240.13a-15(d) and (f): https://www.ecfr.gov/current/title-17/section-240.13a-15
- The IIA, IPPF and Global Internal Audit Standards documents (Third-Party Topical Requirement dates): https://www.theiia.org/en/standards/documents/
- NIST, The NIST Cybersecurity Framework (CSF) 2.0, NIST CSWP 29 (February 26, 2024), GV.SC-05 to GV.SC-07 and DE.CM-06: https://csrc.nist.gov/pubs/cswp/29/the-nist-cybersecurity-framework-csf-20/final
- The IIA, Global Internal Audit Standards (2024), Standard 13.2 Engagement Risk Assessment: https://www.theiia.org/en/standards/2024-standards/global-internal-audit-standards/
Part of CORAA University · Internal controls and SOX: related guides, calculators and templates.
AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error