What it is
When an audit client uses a service organization, the auditor may use a service auditor’s report as evidence about controls at the service organization. AU-C 402 asks the user auditor to understand the services, obtain and evaluate the report and respond to what it does and does not cover.
This checklist walks through that evaluation: the services and the entity’s reliance, report type and period, the opinion and scope, the control objectives and the service auditor’s tests, subservice organizations, complementary user entity controls and the conclusion on whether the report is enough.
When to use it
- Evaluating a SOC 1 report for an audit client that outsources payroll, processing or hosting.
- Documenting the gap between the report period and the client’s year end.
- Mapping complementary user entity controls to the client’s own controls.
What’s inside
- Services used, significance and decision on how to obtain evidence
- Report type, period, scope, opinion and service auditor considerations
- Control objective table and exceptions
- Subservice organizations and complementary user entity controls tables
- Conclusion and sign-off
Standard cited
This template follows AU-C 402. It is written in our own words, except for phrases the standard requires the document to contain, with [bracketed placeholders] for client details, amounts in USD and dates as MM/DD/YYYY. Check it against the current standard and your firm’s methodology before use.
Questions
What if the report period ends before the client’s year end?
There is a gap to cover. Obtain a bridge letter from the service organization and consider other procedures for the gap period, depending on the risk.
What are complementary user entity controls?
Controls the user entity must operate for the service organization’s control objectives to be met. If the audit relies on the service organization’s controls, test the entity’s corresponding controls or document the effect of not testing them.
Does a Type 1 report support reliance on controls?
A Type 1 report covers design at a point in time, not operating effectiveness, so it does not by itself support reliance on how the controls operated. A Type 2 report covers operation over a period.
Related templates
- SOC 1 Readiness Checklist (SSAE 18, AT-C 320)
- IPE Testing Worksheet (Information Produced by the Entity)
- Audit Risk Assessment Worksheet (SAS 145)
Last updated 11/05/2026. All free templates.