AU-C 402: Audit Considerations for Service Organizations

AU-C 402 is the AICPA auditing standard that tells an independent auditor how to handle the audit when the client outsources financially relevant work to a third party. It requires the user auditor to obtain enough evidence about the outside provider’s controls to form a reliable opinion on the client’s financial statements.¹ Without that evidence, the auditor cannot properly assess control risk or vouch for the integrity of financial data flowing through the outsourced system.

When AU-C 402 Applies

The standard uses four roles. The user entity is the company being audited. The user auditor is the CPA firm engaged to opine on its financial statements. The service organization is the outside provider handling services relevant to the user entity’s financial reporting: payroll processors, investment custodians, claims administrators, managed IT hosts, and similar. The service auditor is the independent CPA firm the service organization hires to examine and report on its own controls.¹

AU-C 402 applies when the outsourced services touch the user entity’s financial transactions in a meaningful way. If the service organization initiates, records, processes, or reports transactions that flow into the financial statements, the standard is in scope.¹ Purely administrative arrangements such as janitorial services or standard utility provision do not trigger it. The working test is whether the user entity’s financial statements would risk material misstatement without reliance on the service organization’s controls. Note that regardless of what is outsourced, the user entity keeps ultimate responsibility for its own internal control over financial reporting.

Understanding the Service Organization

The user auditor’s first task is to understand how the outsourced work connects to the audit. That means identifying which financial statement assertions are affected: completeness and existence of recorded transactions, valuation, and so on. Those answers shape every audit decision that follows.

Several sources build that understanding:

The contract between the user entity and the service organization, which sets out responsibilities and control expectations.
Discussions with user entity personnel about how they monitor the outsourced function and how data flows between the two organizations.
Documentation from the service organization itself, including system descriptions, control manuals, and prior-period assurance reports.
On-site visits where the contract permits, though these are uncommon in practice.

Complementary User Entity Controls

Complementary user entity controls, or CUECs, are controls the service organization’s system is designed to rely on the user entity to perform. A payroll processor may assume the user entity independently reviews and approves each payroll run before it is finalized. If that review never happens, a critical link in the control chain is broken.

The user auditor has to confirm that the relevant CUECs are properly designed and actually operating at the user entity. Skip that, and the broader service organization control structure cannot be relied on, regardless of how clean the SOC report looks.¹

Using SOC Reports as Audit Evidence

The primary way a user auditor gains assurance over a service organization’s controls is a Service Organization Control (SOC) report. A SOC 1 report focuses on controls relevant to user entities’ internal control over financial reporting, which makes it the report most directly aligned with AU-C 402.²

Type 1 vs. Type 2

A Type 1 report describes the service organization’s system and evaluates the design of its controls as of a single date. It answers one question: are the controls suitably designed? It says nothing about whether they operated over time. A Type 1 report is generally not enough on its own to support a reduction in the assessed level of control risk.²

A Type 2 report covers everything in a Type 1 and adds testing of operating effectiveness over a defined period. That is what typically allows a user auditor to reduce the scope of substantive testing at the user entity level.²

What to Read in the Report

Every SOC 1 report contains parts the user auditor should examine closely: the service auditor’s opinion on whether the system description is fairly presented and control objectives were achieved; the system description itself; the tests of controls and results in a Type 2, including any exceptions; and the CUECs the service organization expects its clients to implement.

Coverage matters as much as content. A report addressing dozens of control objectives helps nothing if none of them map to the financial statement assertions at risk in the user entity’s audit.

SOC 2 Reports

User auditors sometimes encounter SOC 2 reports, which address security, availability, processing integrity, confidentiality, or privacy rather than financial reporting controls specifically. AICPA Interpretation No. 1 of AU-C Section 402 addresses whether and how a user auditor may use a SOC 2 report in a financial statement audit.³ A SOC 2 may contain useful information, but the user auditor has to evaluate whether the trust service criteria covered align with control objectives relevant to internal control over financial reporting, and identify any CUECs and other controls that bear on financial reporting risks.¹

Evaluating the Service Auditor’s Report

Receiving the report does not end the work. AU-C 402 requires the user auditor to evaluate it before deciding how much reliance to place on it.

Competence and Independence of the Service Auditor

The user auditor assesses the service auditor’s professional competence and independence, typically by reviewing qualifications and reputation. Concerns about the service auditor’s objectivity make the entire report unreliable as audit evidence.

Period Coverage

The SOC report’s period has to cover the user entity’s audit period. If the report ends several months before the user entity’s fiscal year-end, a gap exists, and the user auditor cannot assume controls kept working through the uncovered window. Bridging procedures fill the gap: inquiries of the service organization about significant changes, review of interim communications, or additional testing at the user entity to cover the intervening months. The longer the gap, the more work required.

Exceptions and Qualified Opinions

Any exceptions or deviations in the testing results need evaluation. Not every exception undermines the relevant control objective, but each has to be assessed.

If the service auditor issued a qualified, adverse, or disclaimer opinion, the user auditor cannot rely on the affected controls, and that missing assurance has to be treated as a control deficiency. Two responses are available:

Direct testing at the service organization’s location, which requires its cooperation and is often expensive but provides the strongest evidence.
Expanded substantive testing at the user entity, compensating for missing control-level assurance by testing the underlying data more aggressively.

Subservice Organizations

Service organizations often outsource part of their own operations to another provider, called a subservice organization. A payroll processor might use a separate cloud infrastructure provider to host its systems. When that happens, controls relevant to the user entity’s financial reporting may sit at the subservice organization, not the primary service organization.

Under the inclusive method, the subservice organization’s controls are folded into the service organization’s SOC report, and the service auditor examines both in a single report. Under the carve-out method, which is more common, the subservice organization is acknowledged in the report but its controls are not tested.

When carve-out is used, the user auditor has to treat the subservice organization much like an additional service organization and apply AU-C 402 to it as well. That typically means obtaining a separate SOC report for the subservice organization or performing alternative procedures. How much extra work is required depends on how significant the subservice organization’s functions are to the user entity’s financial reporting.

Effect on the Audit Opinion

When the user auditor has obtained sufficient evidence about the service organization’s controls, using a service organization generally has no effect on the audit opinion. The user auditor issues an unmodified opinion and should not reference the service organization or the service auditor’s report in it.⁴ Referencing the service auditor could imply a division of responsibility, and the user auditor bears sole responsibility for the opinion on the user entity’s financial statements.

The exception is when the user auditor cannot obtain sufficient evidence and the gap is material. Then the user auditor issues a modified opinion, qualified or adverse depending on severity. If the service auditor’s report is referenced when explaining the basis for modification, the wording has to make clear that the reference is not a basis for sharing responsibility. The basis-for-modification section also has to explain how the control failure or missing evidence affected the ability to opine on the financial statements.

1
American Institute of Certified Public Accountants. AU-C Section 9402 – Audit Considerations Relating to an Entity Using a Service Organization
2
AICPA & CIMA. Employee Benefit Plans: SOC 1 Reports and Service Organizations Resource Center
3
AICPA & CIMA. Interpretation No. 1 of AU-C Section 402
4
U.S. Government Accountability Office. Financial Audit Manual Volume 2