Definition
Under AU-C 402, a service organization is a third-party organization, or a segment of one, that provides services to user entities that are part of those entities' information systems relevant to financial reporting. Typical examples are payroll processors, outsourced accounting, trust and custody providers, third-party administrators and cloud hosting for the general ledger.
Why it matters in an audit or review
If the services affect how the client's transactions are initiated, recorded, processed or reported, the user auditor must understand them as part of risk assessment. The auditor then decides whether to obtain a service auditor's report, perform procedures at the service organization, or test the client's own controls over the services. Using a service organization does not transfer the client's responsibility for its financial statements.
Example
A company outsources 401(k) administration to a third-party administrator. Contributions, participant records and investment reporting run through the TPA's systems. In the plan audit, the auditor obtains the TPA's SOC 1 Type 2 report and checks that the plan sponsor's user controls, such as reviewing the contribution reports, are operating.
Common mistakes
Treating a vendor as a service organization because it is important rather than because it affects financial reporting information.
Sources
- AICPA, AU-C Section 402, Audit Considerations Relating to an Entity Using a Service Organization
- AICPA, AT-C Section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities' Internal Control Over Financial Reporting
Definitions paraphrase AICPA and FASB guidance; read the standard itself before relying on a requirement. Example figures are illustrative. This page is guidance, not professional advice. Report an error