All 18 Internal Controls Evaluation questions
More in Internal Controls Evaluation
What are compensating controls and how do they affect the audit? What is the difference between a deficiency, a significant deficiency, and a material weakness? What are IT general controls (ITGCs) and why do they matter? How does management override of controls create risk, and how do auditors address it? What is the auditor's responsibility for reporting internal control deficiencies?
Advertisement
Auditing & Assurance › Internal Controls Evaluation

How do you evaluate controls in a system that uses a service organization (SOC reports)?

Advanced

Answer

When a client uses a service organization (e.g., payroll or cloud processing) affecting its financial reporting, the auditor considers controls at that organization. A SOC 1 (Type 1 = design at a date; Type 2 = operating effectiveness over a period) report from the service auditor provides evidence. The user auditor evaluates the report's scope, dates, and any complementary user entity controls.
Real-world example The auditor obtains the payroll provider's SOC 1 Type 2 report to gain assurance over controls it can't test directly.

Common follow-ups: SOC 1 Type 1 vs Type 2? | What are complementary user entity controls?

Audit Evidence & Procedures ISA Standards Internal Controls Evaluation
All 18 Internal Controls Evaluation questions