Guide to Using International Standards on Auditing in - IFAC

180
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Where service organizations are used, the audi<strong>to</strong>r would consider the matters set out in the exhibit below.
Exhibit 15.3-2
Address
What Services
(Relevant <strong>to</strong>
the Audit) are
Provided?
What Relevant
Internal Controls
are in Place?
Extent of Reliance
Placed on Controls
in Place at Service
Organization?
Description
• Identify:
– The nature of services provided,
– Materiality of transactions processed, and
– Accounts or financial reporting processes affected.
• Review the terms of the contract or service-level agreement between the user
entity and the service organization.
• Determine the degree of interaction (activities) between the service
organization and the entity.
• Review reports by service organizations, service audi<strong>to</strong>rs (including
management letters), internal audi<strong>to</strong>rs, or regula<strong>to</strong>ry authorities on controls at
the service organization.
• Are the controls at the service organization relevant <strong>to</strong> the audit? If no, a
substantive approach is sufficient. If yes, the audi<strong>to</strong>r must get comfort that
the controls at the service organization are appropriately designed and
implemented.
• Are there controls established by the user (that could be tested) that mitigate
material-processing risks, regardless of controls at the service organization? For
example, user controls over payroll could include:
– Comparing data submitted <strong>to</strong> the service organization with reports from
the service organization after data processing,
– Re-computing a sample of the payroll amounts for clerical accuracy, and
– Reviewing the <strong>to</strong>tal amount of the payroll for reasonableness.
• Obtain any type 1 or type 2 reports available. Contracts with service
organizations often include the provision of such reports;
• Contact the service organization <strong>to</strong> obtain specific information;
• Visit the service organization and perform required procedures; or
• Use another audi<strong>to</strong>r <strong>to</strong> perform required procedures.
CONSIDER POINT
Check the wording of service organization reports for possible restrictions as <strong>to</strong> use. Such restrictions
can apply <strong>to</strong> management, the service organization and its cus<strong>to</strong>mers, and the entity’s audi<strong>to</strong>rs.