Service Organization Controls (SOC Reports): CPA Exam Guide

Understanding Service Organizations in Auditing

Many entities outsource significant business functions to service organizations, such as payroll processing, data hosting, claims processing, and investment management. When a service organization's controls are relevant to the user entity's financial reporting, the user auditor must consider how those controls affect the risk of material misstatement. AU-C Section 402 provides guidance on the auditor's responsibilities when an entity uses a service organization, and this topic is frequently tested on the CPA AUD exam.

A service organization is a third-party organization that provides services to a user entity that are part of the user entity's information system relevant to financial reporting. A subservice organization is a service organization used by another service organization. The user auditor is the auditor of the financial statements of the entity that uses a service organization, and the service auditor is the auditor who reports on the controls at the service organization.

Types of SOC Reports

SOC 1 Reports (SSAE 18)

SOC 1 reports are designed for user entities and their auditors and address controls at the service organization that are relevant to the user entity's internal control over financial reporting. These reports are issued under SSAE 18 (AT-C Section 320) and are the reports most relevant to financial statement audits.

Type 1 vs. Type 2 Reports

A Type 1 report covers the description of the service organization's system and the suitability of the design of controls as of a specified date. It provides evidence about whether controls were suitably designed and placed in operation but does not provide evidence about whether they operated effectively over a period. A Type 2 report covers the description of the system, the suitability of design, and the operating effectiveness of controls throughout a specified period (typically six to twelve months). Type 2 reports are more useful to user auditors because they provide evidence about operating effectiveness.

SOC 2 and SOC 3 Reports

SOC 2 reports address controls relevant to security, availability, processing integrity, confidentiality, and privacy based on the AICPA Trust Services Criteria. SOC 3 reports are general-use reports that provide a summary-level opinion. While important for operational purposes, SOC 2 and SOC 3 reports are generally not designed for use in financial statement audits and are less likely to be tested on the CPA exam in the audit context.

User Auditor's Responsibilities

Obtaining an Understanding

The user auditor must obtain an understanding of how the service organization's services affect the user entity's internal control and assess the risks of material misstatement. This includes understanding the nature of the services provided, the significance of those services to the user entity's internal control, and the nature of the relationship between the user entity and the service organization.

Using the Service Auditor's Report

The user auditor may use a Type 1 or Type 2 report to obtain an understanding of the service organization's controls and, in the case of a Type 2 report, to obtain evidence about the operating effectiveness of those controls. However, the user auditor must evaluate the service auditor's professional competence and independence, understand the scope of the service auditor's work, and consider whether the report covers an appropriate period.

Complementary User Entity Controls

Service organization reports typically identify complementary user entity controls (CUECs), which are controls that the service organization assumes the user entity will implement. The user auditor must test these controls because the service organization's controls are designed to operate effectively only when the CUECs are also operating effectively. For example, a payroll service organization may assume that the user entity reviews payroll reports and approves paychecks before distribution.

When a SOC Report Is Not Available

If a SOC report is not available, the user auditor may contact the service organization through the user entity to obtain information about controls, visit the service organization and perform procedures, or use another auditor to perform procedures at the service organization. If the user auditor cannot obtain sufficient evidence about the service organization's controls, the user auditor considers the effect on the audit report, which may result in a qualification or disclaimer of opinion.

CPA Exam Tips

• Know the difference between Type 1 and Type 2 SOC reports. Type 2 provides evidence about operating effectiveness over a period; Type 1 addresses only design and implementation as of a point in time.
• The user auditor cannot simply rely on a SOC report without evaluation. The user auditor must assess the service auditor's competence and independence and consider the scope and timing of the report.
• Complementary user entity controls must be tested by the user auditor. A SOC report alone is not sufficient evidence.
• A Type 2 report that covers a period shorter than the user entity's reporting period requires the user auditor to obtain additional evidence for the uncovered period.
• The user auditor's report should not reference the service auditor or the SOC report when issuing an unmodified opinion.