Advanced Audit and Assurance (International) · Using the work of others

Reliance on Management's Expert and Service Organisations (ISA 500 and ISA 402)

Updated 11 October 2026 · Fact-checked

Under ISA 500 you evaluate a management's expert's competence, capabilities, objectivity and work before using it as evidence. Under ISA 402 the user auditor understands how a service organisation affects controls, then gets evidence from a Type 1 or Type 2 report, or tests directly. Type 2 tests operating effectiveness over a period.

Understand Reliance on Management's Expert and Service Organisations

Entities often rely on outsiders. A management's expert is a person or firm with expertise outside accounting or auditing whose work management uses to prepare the financial statements. Examples are an actuary valuing a pension scheme or a surveyor valuing property. The expert is not your expert. You did not hire them, so you must test whether their work is good enough to rely on as audit evidence.

ISA 500 says that when information prepared by a management's expert is used as evidence, you evaluate the expert's competence, capabilities and objectivity. You obtain an understanding of the expert's field and work. You then evaluate the appropriateness of that work as evidence for the relevant assertion. This includes the relevance and reasonableness of the findings, the data, assumptions and methods used, and the source data.

A service organisation provides services to a user entity that are part of its information system for financial reporting. Payroll processing, outsourced accounting, custody of investments and cloud hosting are common cases. The entity's auditor is the user auditor. The service organisation's auditor is the service auditor. ISA 402 applies when the services are relevant to the user entity's financial reporting and controls.

The user auditor must understand the services, their effect on internal control, and the nature and materiality of the transactions. If the controls at the service organisation are relevant to the audit, you need evidence about them. You can get it from a service auditor's report or by testing directly.

A Type 1 report covers the description of the service organisation's system and the suitability of the design of controls at a specified date. A Type 2 report covers the same, plus the operating effectiveness of controls over a specified period. Only Type 2 supports reliance on operating effectiveness. Even then, the period must cover enough of the year and the report must show relevant tests and results.

Key rules to remember

ISA 500 evaluation of a management's expert: Competence + Capabilities + Objectivity of expert, then Appropriateness of work (data, assumptions, methods, findings); Both the person and the work must be assessed. Passing the first does not remove the need for the second.
Type 1 report: Description of system + design suitability at a point in time; Does not give evidence that controls operated effectively. It helps you understand and assess risk.
Type 2 report: Description of system + design suitability + operating effectiveness over a period; Can support a control reliance strategy if the period, controls and test results are relevant.
Reliance decision under ISA 402: Understand services, then assess risk, then Type 2 report OR direct tests at the service organisation OR substantive procedures at the user entity; If you cannot get sufficient appropriate evidence, consider the effect on your opinion.
Bridging the gap: Report period end to year end = gap, needing additional evidence; Use complementary user entity controls, inquiries and updated evidence for the gap.

How to solve Reliance on Management's Expert and Service Organisations questions

Use this method for any question on management's experts or service organisations. Link each point to the scenario facts.

1Identify which situation applies: a management's expert (ISA 500) or a service organisation (ISA 402). Some scenarios have both.
2State why it matters: the area involved, its materiality and the risk of material misstatement, for example a complex valuation or outsourced payroll.
3For an expert, assess competence (qualifications, membership of a professional body, experience), capabilities (time, resources) and objectivity (relationships with management, fee basis, threats).
4For an expert, evaluate the work: source data, assumptions, method, consistency with prior periods and with other evidence, and the reasonableness of the conclusions.
5For a service organisation, understand the services and controls, and decide whether the controls are relevant to the audit. Identify the type of report you hold and its period.
6Decide the evidence strategy: rely on a Type 2 report, use direct testing or another service auditor, or perform substantive procedures at the user entity. Cover the gap period and complementary user controls.
7Check the service auditor's competence and independence, and whether the report standard and scope fit your needs.
8Conclude on sufficiency of evidence and the impact on your opinion. Mention modification if you cannot obtain evidence.

Quickest way: Four-question check

When to use it: Use when short on time and the question asks for risks, procedures or a recommendation.

Who did the work: management's expert or service organisation?
Is the person or organisation credible: competence, capabilities and objectivity, or service auditor reputation?
Is the work or report good enough: assumptions and data, or Type 1 vs Type 2, period, scope and exceptions?
What is left for me to do: gap period, user controls, substantive tests, and the opinion impact if evidence is insufficient?

Common mistakes in Reliance on Management's Expert and Service Organisations

Treating a Type 1 report as proof that controls operated effectively.
Both reports sound like assurance over controls and the names are similar.
Fix: Link Type 1 to design at a date and Type 2 to operating effectiveness over a period. Only Type 2 supports reliance on operation.
Saying the auditor can rely on a Type 2 report without checking the period or scope.
Students assume any report covers the whole year and all relevant controls.
Fix: Check that the period overlaps the year end sufficiently, that the relevant controls were tested and what exceptions were reported. Plan for the gap period.
Assessing only the expert's qualifications and ignoring their work.
Competence is easy to quote from a scenario, so students stop there.
Fix: Always add evaluating the data, assumptions and methods and whether the findings are consistent with other audit evidence.
Confusing a management's expert with an auditor's expert.
The two sit near each other in the syllabus and both involve specialists.
Fix: Management's expert is used by the client (ISA 500). The auditor's expert is engaged by you (ISA 620). State which one applies before writing procedures.
Referring to the service auditor's report in the audit report as a way to share responsibility.
Students think reliance transfers responsibility.
Fix: The user auditor keeps full responsibility for the opinion. Do not refer to the service auditor's work in an unmodified opinion unless law or regulation requires it.
Giving generic procedures that ignore the scenario.
Students recite a list from memory under time pressure.
Fix: Tie each point to scenario facts, such as the expert's link to the finance director or a report ending months before year end.

Worked examples

Example 1

Your audit client, a manufacturer, uses an external actuary engaged by management to measure its defined benefit pension obligation. The obligation is material. The actuary is a member of a professional actuarial body and has done this work for the client for six years. The finance director set the discount rate range the actuary should use. Explain how you would evaluate the actuary's work as audit evidence.

Show the solution

Identify the situation: the actuary is a management's expert, so ISA 500 applies. The obligation is material and involves estimation uncertainty, so evaluation must be thorough.
Competence and capabilities: membership of a professional body and six years of experience with the client are positive. Confirm qualifications, relevant experience for this type of scheme and adequate resources.
Objectivity: the finance director dictated the discount rate range. This is a threat to objectivity and to the reasonableness of the key assumption. Inquire about other relationships and fee arrangements.
Evaluate the work: test the membership data given to the actuary for completeness and accuracy against payroll and scheme records.
Challenge assumptions such as discount rate, inflation, salary growth and mortality by comparing them with market data, prior years and the entity's circumstances. Consider using your own expert under ISA 620 for this.
Review the method for consistency with IAS 19 and with prior years, and check that the results flow correctly into the financial statements and disclosures.
Conclude: if the discount rate range is unsupported, propose adjustment. If you cannot get sufficient evidence, consider the effect on the opinion.

Answer: Evaluate the actuary's competence, capabilities and objectivity, then the appropriateness of their work. The main concern is the finance director's influence over the discount rate, which threatens objectivity and needs independent challenge, possibly with your own expert.

Example 2

Your client outsources payroll to a service organisation. You hold a Type 1 report dated 30 September. The client's year end is 31 December. Payroll is material and the client's own controls over payroll inputs are weak. Advise the audit senior on the evidence available and what to do.

Show the solution

Identify the situation: payroll is a service affecting the financial reporting system, so ISA 402 applies and you are the user auditor.
Assess the report: a Type 1 report covers description and design at a date only. It gives no evidence that controls operated effectively, and the date is three months before year end.
Decide the strategy: you cannot rely on operating effectiveness from this report. Options are to request a Type 2 report covering the period, to visit the service organisation or use another auditor to test controls, or to perform substantive procedures at the user entity.
Consider the weak user controls: complementary controls at the client over inputs and outputs are weak, so a control reliance approach is unlikely to work. Substantive testing is likely to be needed.
Substantive procedures: reperform payroll for a sample of employees, agree to HR records and approved changes, reconcile payroll totals to the ledger and bank, and test starters and leavers.
Obtain understanding of the service auditor's competence and independence if you use their report. Do not refer to their work in your opinion unless required.
Conclude: if you cannot get sufficient appropriate evidence, consider a modified opinion due to limitation of scope.

Answer: The Type 1 report only supports understanding of design at 30 September. With weak client controls, perform substantive procedures on payroll and ask for a Type 2 report if possible. If evidence remains insufficient, consider modifying the opinion.

Exam tips

Name the standard and the type of expert or report early. It shows the marker you have identified the issue.
Always link to the scenario: objectivity threats, report dates, report type and exceptions are usually planted facts.
For professional skills marks, give a clear recommendation, such as whether to rely on the report or test directly, and justify it commercially.
Include the effect on the audit opinion when evidence is insufficient. Many students stop at procedures.
Do not mix up the expert types: management's expert (ISA 500), auditor's expert (ISA 620) and internal audit (ISA 610).

Practice questions from Using the work of others

Reliance on Management's Expert and Service Organisations in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Reliance on Management's Expert and Service Organisations: frequently asked questions

What is the difference between a Type 1 and Type 2 report under ISA 402?

A Type 1 report covers the description of the service organisation's system and the suitability of control design at a specified date. A Type 2 report covers the same plus operating effectiveness over a period. Only a Type 2 report supports reliance on how controls operated.

How do you audit a management's expert under ISA 500?

Evaluate the expert's competence, capabilities and objectivity. Then evaluate the appropriateness of the work, including the data, assumptions and methods used and the findings. Compare the results with other audit evidence and consider your own expert if the area is complex.

Does using a service auditor's report reduce the user auditor's responsibility?

No. The user auditor is solely responsible for the audit opinion. Do not refer to the service auditor's work in an unmodified opinion unless law or regulation requires it.

What can a user auditor do if no Type 2 report is available?

You can test controls directly at the service organisation, or use another auditor to do so. You can also perform substantive procedures at the user entity. If you still cannot get sufficient appropriate evidence, consider the effect on your opinion.