Guide to Using International Standards on Auditing in - IFAC

179
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
There are two types of reports that service organizations can provide <strong>to</strong> their users:
• Type 1 reports — description and design of controls at a service organization
These reports provide evidence about the design and implementation of controls, but not their
operating effectiveness. Such reports may be informative, but are of limited use <strong>to</strong> the audi<strong>to</strong>r in
understanding whether the key controls at the service organization operated effectively during the
period being audited.
• Type 2 reports — description, design, and operating effectiveness of controls
These reports can be used by the audi<strong>to</strong>r <strong>to</strong> consider whether:
– The controls tested by the service organization audi<strong>to</strong>r are relevant <strong>to</strong> the entity’s transactions,
account balances, disclosures, and related assertions, and
– The service organization audi<strong>to</strong>r’s tests of controls and the results are adequate (i.e., the length
of the period covered by the service organization audi<strong>to</strong>r’s tests, and the time elapsed since the
performance of those tests).
Risk Assessment
Paragraph #
Relevant Extracts from ISAs
402.9 When obtaining an understanding of the user entity in accordance with ISA 315, the user
audi<strong>to</strong>r shall obtain an understanding of how a user entity uses the services of a service
organization in the user entity’s operations, including: (Ref: Para. A1-A2)
(a) The nature of the services provided by the service organization and the significance of
those services <strong>to</strong> the user entity, including the effect thereof on the user entity’s internal
control; (Ref: Para. A3-A5)
(b) The nature and materiality of the transactions processed or accounts or financial reporting
processes affected by the service organization; (Ref: Para. A6)
(c) The degree of interaction between the activities of the service organization and those of
the user entity; and (Ref: Para. A7)
(d) The nature of the relationship between the user entity and the service organization,
including the relevant contractual terms for the activities undertaken by the service
organization. (Ref: Para. A8-A11)
402.10 When obtaining an understanding of internal control relevant <strong>to</strong> the audit in accordance
with ISA 315, the user audi<strong>to</strong>r shall evaluate the design and implementation of relevant
controls at the user entity that relate <strong>to</strong> the services provided by the service organization,
including those that are applied <strong>to</strong> the transactions processed by the service organization.
(Ref: Para. A12-A14)
402.11 The user audi<strong>to</strong>r shall determine whether a sufficient understanding of the nature and
significance of the services provided by the service organization and their effect on the user
entity’s internal control relevant <strong>to</strong> the audit has been obtained <strong>to</strong> provide a basis for the
identification and assessment of risks of material misstatement.
402.12 If the user audi<strong>to</strong>r is unable <strong>to</strong> obtain a sufficient understanding from the user entity, the user
audi<strong>to</strong>r shall obtain that understanding from one or more of the following procedures:
(a) Obtaining a type 1 or type 2 report, if available;
(b) Contacting the service organization, through the user entity, <strong>to</strong> obtain specific information;
(c) Visiting the service organization and performing procedures that will provide the
necessary information about the relevant controls at the service organization; or
(d) <strong>Using</strong> another audi<strong>to</strong>r <strong>to</strong> perform procedures that will provide the necessary information
about the relevant controls at the service organization. (Ref: Para. A15-A20)