Wiley Practitioner's Guide to GAAS 2023, 2nd Edition

13AU-C 402 Audit Considerations Relating to an Entity Using a Service Organization

• Scope
• Definitions of Terms
• Objectives of AU-C 402
• Requirements
  • Types of Service Auditor's Reports
  • Considerations in Using a Service Auditor's Report
• AU-C 402 Illustration—Audit Program for an Auditor's Review of a Service Auditor's Report

SCOPE

More and more entities are outsourcing activities to service organizations. There is often a belief by the user organization that the service organization can be totally relied upon and that the user organization needs only to have limited, if any, controls.

AU-C 402 is intended to help auditors determine what additional information they might need when auditing an entity that uses a service organization. It expands on the application of AU-C 315¹ and 330 in obtaining an understanding of the user entity, including the entity's system of internal control relevant to the preparation of the financial statements. (AU-C 402.01) AU-C 402 also makes it clear that the guidance applies if an entity gets services from another organization that is part of the entity's information system. Also, it clarifies the factors that an auditor should use in determining the significance of a service organization's controls to the user organization's controls. In other words, the audit procedures that are appropriate when a service organization's procedures are significant to the audited entity are not optional. The auditor must evaluate the interaction between the audited ...