Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

Banyan Logistics Ltd outsources its payroll processing to a cloud service provider. CA Anita, the auditor, wants to rely on the provider's controls. The provider furnishes a Type 2 SOC 1-style report from an independent service auditor covering the period April to December, while the financial year ends 31 March. What should Anita primarily do under SA 402?

Anita should evaluate the report's scope, period and exceptions and perform additional procedures for the uncovered January to March period, such as inquiry and testing at the user entity. She cannot treat a nine-month Type 2 report as full-year assurance.

  1. AAccept the report as covering the full year without further work
  2. BEvaluate the report's scope, period and findings, and obtain additional evidence, such as for the January to March gap, through inquiry, updated confirmations or testing at the user entityCorrect
  3. CRefuse to use any service organisation report in future audits
  4. DAsk the service auditor to be named in her audit report as the source of evidence

Explanation

SA 402 requires the user auditor to assess whether a Type 2 report is sufficient and appropriate for the period of reliance. A gap in coverage needs additional procedures, such as inquiries about changes and testing of controls at the user entity. Referring to the service auditor in the audit report is not permitted unless required by law, and then only with specified wording.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions