Skip to content

ACCA Strategic Professional · Advanced Audit and Assurance (International) · Other current issues

Brightwell Co moved its accounting system to a cloud provider that supplies a SOC 1 Type 2 report. The auditor wants to reduce substantive testing by relying on controls at the service organisation. Which course of action best complies with ISA 402?

The auditor must evaluate the service auditor's report for relevant scope, the period covered, the controls tested and the client's own complementary controls, plus any uncovered gap period. It cannot be accepted automatically, even if it is a Type 2 report, because ISA 402 requires an assessment of sufficiency and appropriateness.

  1. AEvaluate the report's scope, period covered, and whether controls tested are relevant to the financial statements, and consider complementary user entity controls and any gaps in the periodCorrect
  2. BAccept the report automatically as the type 2 report covers the entire year-end process
  3. CRely on the report only if the service auditor is a member of the same network as the user auditor
  4. DIgnore the report because the cloud provider is not part of the client's management

Explanation

ISA 402 requires the user auditor to assess whether the report gives sufficient appropriate evidence about the design and operating effectiveness of controls relevant to the audit. This includes the period covered, the service auditor's competence, controls tested, and whether user entity controls are in place. Automatic acceptance is wrong because the period may not cover the whole year, or scope may exclude relevant controls.

Did you get it right without looking?

One question tells you little. A timed set on Other current issues shows your real accuracy, how long you take and where you lose marks.

Practise Other current issuesFree diagnostic mock

More Other current issues questions