Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p11
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 11/22)
Character Range: 35531–38531

the service organisation.

A11.         Public sector auditors may also use another auditor to perform tests of controls or substantive procedures in relation to compliance with law, regulation or other authority.

Understanding the Controls Relating to Services Provided by the Service Organisation (Ref: Para. 10)

A12.         The user entity may establish controls over the service organisation's services that may be tested by the user auditor and that may enable the user auditor to conclude that the user entity's controls are operating effectively for some or all of the related assertions, regardless of the controls in place at the service organisation.  If a user entity, for example, uses a service organisation to process its payroll transactions, the user entity may establish controls over the submission and receipt of payroll information that could prevent or detect material misstatements.  These controls may include:

           * Comparing the data submitted to the service organisation with reports of information received from the service organisation after the data has been processed.

           * Recomputing a sample of the payroll amounts for clerical accuracy and reviewing the total amount of the payroll for reasonableness.

A13.         In this situation, the user auditor may perform tests of the user entity's controls over payroll processing that would provide a basis for the user auditor to conclude that the user entity's controls are operating effectively for the assertions related to payroll transactions.

A14.         As noted in ASA 315,[8] in respect of some risks, the user auditor may judge that it is not possible or practicable to obtain sufficient appropriate audit evidence only from substantive procedures.  Such risks may relate to the inaccurate or incomplete recording of routine and significant classes of transactions and account balances, the characteristics of which often permit highly automated processing with little or no manual intervention.  Such automated processing characteristics may be particularly present when the user entity uses service organisations.  In such cases, the user entity's controls over such risks are relevant to the audit and the user auditor is required to obtain an understanding of, and to evaluate, such controls in accordance with paragraphs 9 and 10 of this Auditing Standard.

Further Procedures When a Sufficient Understanding Cannot Be Obtained from the User Entity (Ref: Para. 12)

A15.         The user auditor's decision as to which procedure, individually or in combination, in paragraph 12 to undertake, in order to obtain the information necessary to provide a basis for the identification and assessment of the risks of material misstatement in relation to the user entity's use of the service organisation, may be influenced by such matters as:

           * The size of both the user entity and the service organisation;

           * The complexity of the transactions at the user entity and