Accounts Notes: AUDIT CONSIDERATIONS RELATING TO ENTITES USING SERVICE ORGANISATIONS

Friday 25 March 2011

AUDIT CONSIDERATIONS RELATING TO ENTITES USING SERVICE ORGANISATIONS

The Auditor should consider how a service organisation affects the client’s accounting and internal control systems so as to plan and develop an effective audit approach.
Considerations for The Auditor of the Client
When the services provided by service organisations are limited to recording and processing of transactions of the client and the client retains authorization and maintenance of accountability, the client might be able to implement effective policies and procedures within its organisations. However, the client may have to rely upon the policies and procedures of the service organisation where the latter executes the transactions and maintains accountability on behalf of the client.
While planning his audit, the auditor should determine the significance of activities performed by the service organisation and their relevance to the audit. In doing so the auditor should consider: ¬
 Nature of the services provided.
 Terms of contract.
 Material financial statement assertions that are affected by the use of the service organisation.
 Inherent risks associated with those assertions.
 Extent to which the client’s systems interact with those of the service organisation.
 Client’s internal controls that are applied to the transactions processed by the service organisation.
 The capability and financial strength of the service organisation.
 Documentation of systems manual of the service organisation.
 Information available on general controls and computer systems controls relevant to the client’s application.
 Reports of the auditor or internal auditor of the service organisation.
When the auditor of the client concludes that the activities of the service organisation are significant to the entity and to his audit, he should obtain sufficient understanding of the service organisation’s accounting and internal control system. If the information he is able to gather is insufficient, he should consider the need to request the auditor of the service organisation to furnish him information on specified areas.
Service Organisation’s Auditor’s Report
When the auditor of the client uses the report of the auditor of service organisation, he should consider:
a) The professional competence of the reporting auditor; and
b) Nature and content of the report.
The report submitted to the client’s auditor would ordinarily be one of the two types as follow:
Type A - Report of Suitability of Design
The contents of this report are ¬
a. A description of the service organisation’s accounting and internal control System; and
b. An opinion by the service organisation’s auditor that
i. The above description is accurate;
ii. The systems controls have been placed in operation; and
iii. The accounting and internal control systems are suitably designed to achieve their stated objectives.
Such reports help the auditor of the client in obtaining an understanding of the accounting and internal control systems installed and operated by the service organisation.
Type B -Report on Suitability of Design and Operating Effectiveness
The contents of the report are ¬
a. A description of the service organisation’s accounting and internal control systems;
b. An opinion by the service organisation’s auditor that:
i. The above description is accurate;
ii. The systems controls have been placed in operation;
iii. The accounting and internal control systems are, suitably designed to achieve the stated objectives; and
iv. The accounting and internal control systems are operating effectively based on the results of the tests of control.
In addition to the report on operating effectiveness, the service organisation's auditor should identify the tests of controls performed and their results.
The client's auditor should consider whether the controls tested by the other auditor are relevant to the client's transactions. The client's auditor can also use such reports as an evidence of lower control risk assessment. Based on the control risk assessment, the client's auditor determines the nature, timing and extent of substantive procedures. He may also request the auditor of the service organisation to perform substantive tests in certain areas. However the audit report of the client should not contain reference to the report received from the service organisation's auditor.