Skip to content

CA Final · Advanced Auditing, Assurance and Professional Ethics · Digital Auditing & Assurance

While auditing Sagar Pharma Ltd, CA Nikhil finds that the entity moved its payroll application to a third-party cloud service provider (a service organisation) during the year. Management gives him a Type 2 SOC-type report from the service auditor covering only the period April to September, whereas the financial year ends 31 March. Nikhil intends to rely on the controls at the service organisation. What is the most appropriate action under SA 402?

Nikhil should obtain additional evidence for the uncovered period of October to March, through inquiries about changes at the service organisation and tests of user controls or substantive procedures. The report covers only part of the year, and outsourcing does not reduce the auditor's responsibility.

  1. ARely on the report fully because a Type 2 report always covers the whole year
  2. BIgnore the report and treat controls as ineffective without any further procedures
  3. CObtain additional evidence about the remaining period, such as inquiries and testing of user-entity controls, before relying on the controlsCorrect
  4. DReduce the audit scope on payroll because the service provider is independent of the entity

Explanation

Where the service auditor's report covers only part of the period, the user auditor needs additional evidence for the uncovered period, such as inquiry about changes and tests of user-entity controls or substantive procedures. Full reliance is wrong because the period is uncovered. Outsourcing does not reduce the user auditor's responsibility for the audit opinion.

Did you get it right without looking?

One question tells you little. A timed set on Digital Auditing & Assurance shows your real accuracy, how long you take and where you lose marks.

Practise Digital Auditing & AssuranceFree diagnostic mock

More Digital Auditing & Assurance questions