Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

Meridian Services Ltd. outsources its payroll processing to a cloud service provider. The auditor of Meridian wants to use the provider's SOC 1 Type 2 report on controls. The report covers 1 April to 31 December, while the financial year ends 31 March. The report has a qualified opinion on one access control, and the provider lists complementary user entity controls that Meridian must operate. What is the most appropriate auditor response?

The auditor should evaluate the report's relevance and reliability, address the qualified access control and the uncovered three months through additional procedures, and test the complementary user entity controls at Meridian. Full reliance ignores the gaps, and total rejection is unnecessary.

  1. ARely fully on the report because it is Type 2
  2. BReject the report entirely and perform no further work on payroll
  3. CAssess the report's competence and relevance, consider the qualification and the three-month gap through additional procedures such as a bridging inquiry or tests, and test Meridian's complementary user entity controlsCorrect
  4. DRely on the report only if the provider's auditor is a member of ICAI

Explanation

Under the standard on audit considerations for service organisations, the auditor evaluates the report's sufficiency and appropriateness. The qualified control and the uncovered period need additional evidence, and the user entity must operate its own complementary controls. Full reliance ignores these gaps, and complete rejection is unnecessary. ICAI membership of the provider's auditor is not a requirement.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions