SOC (AUSC) | Notion

AU-C Section 9402 “Audit Considerations Relating to an Entity Using a Service Organization: Auditing Interpretations of AU-C Section 402”

BACKGROUND

As part of the financial statements audit, the engagement team may identify service organizations relevant for the audit. We assess the type of service (qualitative feature) and its significance (quantitative feature) to determine the relevance for the audit.

CONSIDERATIONS

We should assess:

The degree of interactions and nature of relationships between the entity and service organization (including contract terms) as well as the nature of services provided to the user entity:

Service Organization	Nature of the Relationship with the Entity	Degree of Interaction with the Entity’s Activities	Nature of Services	Contractual Terms

The nature and materiality of accounts and processes affected by the service organization:

Service Organization	Service	Effect Type	Nature	Materiality

The significance of those services to the user entity.
The effect of those services on the user entity’s internal control.

ADDITIONAL GUIDANCE

When the service is determined to be relevant, we shall obtain an understanding of the services performed by reading:

Contract(s)
Service-level agreement(s)
SOC 1 Type II reports (if available)
other documents between the user entity and the service organization
We shall request the most recent

NOTE: SOC 2 reports are generally not expected to suffice the goals of AU-C Section 402 but can be considered as deemed necessary based on the facts and circumstances of the engagement.