Using a SOC 1 report as the user auditor under AU-C 402 and AS 2601

In this lesson you will

Apply the AU-C 402 requirements for understanding a service organization
Evaluate a type 2 report for period, scope and relevance to assertions
Assess exceptions reported by the service auditor
Document the conclusion and its effect on control risk

Start with the understanding

AU-C 402.09 requires the user auditor, when obtaining an understanding of the user entity under AU-C 315, to understand how the user entity uses the services of a service organization, including the nature and significance of the services and their effect on the user entity's internal control. AU-C 402.10 requires the auditor to evaluate the design and implementation of relevant controls at the user entity that relate to the services, including those applied to transactions processed by the service organization.

If the user entity cannot give a sufficient understanding, AU-C 402.12 lists other sources: reading a type 1 or type 2 report, contacting the service organization through the user entity, visiting the service organization, or using another auditor.

Is the report good enough to use

AU-C 402.13 requires the user auditor, in determining the sufficiency and appropriateness of evidence from a type 1 or type 2 report, to be satisfied about matters including the service auditor's professional competence and independence from the service organization, and the adequacy of the standards under which the report was issued. Practical steps: confirm the service auditor is a licensed CPA firm, read the opinion paragraph for the standards applied, and look for modifications to the opinion.

Using a type 2 report for operating effectiveness

AU-C 402.17 sets four evaluations when the user auditor plans to use a type 2 report as evidence that controls are operating effectively:

a. whether the report is for a period appropriate for the user auditor's purposes; b. whether complementary user entity controls identified by the service organization address risks of material misstatement relating to relevant assertions, and if so, whether the user entity designed and implemented them and, if so, testing their operating effectiveness; c. the adequacy of the time period covered by the tests of controls and the time elapsed since the tests were performed; d. whether the tests of controls performed by the service auditor, and their results, are relevant to the assertions in the user entity's financial statements and provide sufficient appropriate evidence.

For issuer audits, AS 2601 and AS 2201.B19 through .B24 cover the same ground. AS 2201.B21 lists the factors: the time period covered by tests and its relation to management's assessment date, the scope and applications covered and how tested controls relate to the company's controls, and the results of tests and the opinion.

Mapping the report to your risks

Build a simple map:

Your risk	Service organization control objective	Controls tested	Exceptions	Relevant CUECs

Not every control objective matters to every client. Not every client risk is covered by the report. Gaps in coverage need another response, usually substantive procedures or tests at the user entity.

Exceptions in the report

The tests-of-controls section of a type 2 report lists each test and its results. For each exception relevant to your risks:

Read the nature and rate of the exception and management's response.
Consider whether the exception means the control objective was not achieved, which the opinion would usually reflect.
Decide whether the exception affects your client's transactions, and whether a user entity control would detect the issue.
Adjust your risk assessment or add procedures.

AU-C 402.A40 notes that deviations or a modified opinion do not automatically make the report useless; you consider them in assessing the service auditor's tests. A qualified opinion on a control objective that matters to you still means you cannot rely on that objective without more work.

Fraud and other matters

AU-C 402.19 requires the user auditor to inquire of management whether the service organization has reported, or the user entity is otherwise aware of, any fraud, noncompliance with laws and regulations, or uncorrected misstatements affecting the user entity's financial statements, and to evaluate the effect on further procedures.

Documentation

Use the service organization report review checklist to record the report, period, opinion, mapping, exceptions, CUEC testing and conclusion.

Worked example

Evaluating a payroll provider report for Marigold Charter Schools

Marigold Charter Schools (June 30 year-end) outsources payroll. Payroll is 71 percent of expenses. The provider issued a SOC 1 type 2 report for July 1 to March 31.

Competence and standards: the report was issued by a licensed CPA firm under the AICPA attestation standards. The opinion is unmodified except for control objective 6 (changes to employee pay rates).

Mapping: Marigold's risks are accuracy of gross-to-net calculations, authorized pay rate changes, and timely tax remittance. The report covers calculations (objective 3), rate changes (objective 6) and tax remittance (objective 8).

Exceptions: for objective 6, the service auditor found that 4 of 40 sampled rate changes lacked client authorization in the provider's system. The opinion on objective 6 is qualified.

Response: the team cannot rely on the provider's rate change controls. Marigold has a CUEC: the business office reviews a monthly pay rate change report against signed personnel action forms. The team tests a sample of those monthly reviews across the full year, including the completeness of the rate change report, and finds the control operating.

Conclusion: rely on the report for objectives 3 and 8; for rate changes, rely on Marigold's own monthly review. For the gap from April 1 to June 30, the team uses inquiry, a bridge letter and tests of Marigold's own payroll controls in that window (lesson 13).

Self-check

Answer each question before you open the answer.

List the four evaluations AU-C 402.17 requires before using a type 2 report for operating effectiveness.
Show answer
Whether the report period is appropriate; whether relevant CUECs exist and, if so, are designed, implemented and tested at the user entity; the adequacy of the test period and time elapsed since testing; and whether the tests and results are relevant to the user entity’s assertions and provide sufficient appropriate evidence.
The service auditor qualified its opinion on a control objective you planned to rely on. What now?
Show answer
You cannot rely on that objective as reported. Look for user entity controls that address the risk and test them, or perform additional substantive procedures, and adjust the risk assessment.
What must the user auditor ask management about under AU-C 402.19?
Show answer
Whether the service organization has reported, or the user entity is otherwise aware of, any fraud, noncompliance with laws and regulations, or uncorrected misstatements affecting the user entity’s financial statements.

Sources

Back to the syllabus

Standards are paraphrased from the primary sources listed above; read the source before relying on a requirement. This lesson is training material, not professional advice. Report an error