Guide to Using International Standards on Auditing in - IFAC

182
<strong>Guide</strong> <strong>to</strong> <strong>Using</strong> <strong>International</strong> <strong>Standards</strong> on Auditing in the Audits of Small- and Medium-Sized Entities Volume 1—Core Concepts
Paragraph #
Relevant Extracts from ISAs
402.19 The user audi<strong>to</strong>r shall inquire of management of the user entity whether the service
organization has reported <strong>to</strong> the user entity, or whether the user entity is otherwise aware of,
any fraud, non-compliance with laws and regulations or uncorrected misstatements affecting
the financial statements of the user entity. The user audi<strong>to</strong>r shall evaluate how such matters
affect the nature, timing and extent of the user audi<strong>to</strong>r’s further audit procedures, including
the effect on the user audi<strong>to</strong>r’s conclusions and user audi<strong>to</strong>r’s report. (Ref: Para. A41)
In responding <strong>to</strong> the assessed risks, the audi<strong>to</strong>r would consider the following matters.
Exhibit 15.3-3
Address
Can Necessary
Evidence Be
Obtained from
within Entity?
Determine Extent
of Reliance That
Can Be Placed on
the Type 1 or Type
2 Report
Testing User
Records and
Controls
Obtaining Audit
Evidence from
the Service
Organization
Making Inquiries
about Significant
Events (Fraud, etc.)
Description
If yes, obtain sufficient appropriate audit evidence concerning the relevant financial
statement assertions involved.
If no, perform additional procedures <strong>to</strong> obtain evidence, such as using another audi<strong>to</strong>r
<strong>to</strong> perform procedures at the service organization on the user audi<strong>to</strong>r’s behalf.
• Consider the audi<strong>to</strong>r’s professional competence and independence and
adequacy of standards under which the report was issued;
• Evaluate whether the description and design of controls at the service organization
is at a date or for a period that is appropriate for the user audi<strong>to</strong>r’s purposes;
• Evaluate the sufficiency and appropriateness of the evidence provided by the report
for the understanding of the user entity’s internal control relevant <strong>to</strong> the audit; and
• Determine whether complementary user-entity controls identified by the service
organization are relevant <strong>to</strong> the user entity and, if so, obtain an understanding of
whether the user entity has designed and implemented such controls.
Note that a type 1 report provides no evidence that the internal controls at the
service organization operated effectively over a period of time. If a type 2 report is
not available, it may be necessary for the audi<strong>to</strong>r <strong>to</strong> perform tests of controls at the
service organization, or use another audi<strong>to</strong>r <strong>to</strong> perform such tests.
Where possible, obtain sufficient appropriate audit evidence concerning the relevant
financial statement assertions from the records held by the user entity.
If user records are not sufficient, obtain audit evidence about the operating
effectiveness of controls at the service organization by:
• Obtaining a type 2 report, if available;
• Performing appropriate tests of controls at the service organization; or
• <strong>Using</strong> another audi<strong>to</strong>r <strong>to</strong> perform tests of controls at the service organization on
behalf of the user audi<strong>to</strong>r.
Inquire of management whether they have become aware (or received notice from
the service organization) of any fraud, non-compliance with laws and regulations, or
uncorrected misstatements that could affect the financial statements.