Guide to Using International Standards on Auditing in - IFAC

178
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Paragraph #
402.8
(continued)
Relevant Extracts from ISAs
(d) Service audi<strong>to</strong>r—An audi<strong>to</strong>r who, at the request of the service organization, provides an
assurance report on the controls of a service organization.
(e) Service organization—A third-party organization (or segment of a third-party
organization) that provides services <strong>to</strong> user entities that are part of those entities’
information systems relevant <strong>to</strong> financial reporting.
(f)
Service organization’s system—The policies and procedures designed, implemented and
maintained by the service organization <strong>to</strong> provide user entities with the services covered
by the service audi<strong>to</strong>r’s report.
(g) Subservice organization—A service organization used by another service organization <strong>to</strong>
perform some of the services provided <strong>to</strong> user entities that are part of those user entities’
information systems relevant <strong>to</strong> financial reporting.
(h) User audi<strong>to</strong>r—An audi<strong>to</strong>r who audits and reports on the financial statements of a user entity.
(i)
User entity—An entity that uses a service organization and whose financial statements are
being audited.
Many entities (including very small ones) often outsource certain financial processing activities such as:
• Payroll;
• Internet sales;
• IT services;
• Asset management (inven<strong>to</strong>ry warehousing, investments, etc.); and
• Bookkeeping services. This would include processing of transactions, maintaining accounting records,
and preparing financial statements.
These third-party organizations (providing services relevant <strong>to</strong> financial reporting) are referred <strong>to</strong> as “service
organizations.”
Where service organizations are used, the audi<strong>to</strong>r needs <strong>to</strong> consider the effect of such arrangements on the
entity’s internal control. This includes:
• Obtaining sufficient information <strong>to</strong> assess the risks of material misstatement; and
• Designing an appropriate response.
In smaller entities, the outsourced services may well be important <strong>to</strong> the ongoing operation of the entity,
but may not be relevant <strong>to</strong> the audit. This would occur where there are sufficient internal controls within the
entity <strong>to</strong> address the risks of material misstatement, or where substantive audit procedures can be performed
<strong>to</strong> address the identified risks.
CONSIDER POINT
<strong>Using</strong> a service organization <strong>to</strong> prepare financial statements does not relieve management (and those
charged with governance) of their responsibilities for the financial statements.