Definition
The service auditor is the practitioner who examines and reports on a service organization's controls. Under AU-C 402 and AT-C 320, the term applies to the person who reports on controls at a service organization that may be relevant to user entities' internal control over financial reporting. By extension it is used in SOC 2 work. The service auditor's client is the service organization, and the report is used by user entities and their auditors.
Why it matters in an audit or review
The user auditor decides whether the service auditor is competent and independent before relying on the report. AU-C 402 asks the user auditor to evaluate the service auditor's professional competence and independence from the service organization, as well as the standards under which the report was issued.
Example
Illustrative: a payroll vendor's SOC 1 is issued by a small firm. The user auditor checks the firm's peer review status, confirms the report is dated within the client's fiscal year and reads the opinion. If the report is dated before the year-end, the auditor asks for a bridge letter.
Common mistakes
- Assuming any CPA firm can serve as service auditor without checking independence from the service organization.
- Confusing the service auditor with the user auditor.
Sources
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error