Document ID: chunk:federal_register_of_legislation:F2023C01156:reg:14:p13
Version: federal_register_of_legislation:F2023C01156
Segment Type: reg
Provision Reference: reg 14 (pt 13/22)
Character Range: 40864–43913

service organisation.  The user auditor, using the work of another auditor, may find the guidance in ASA 220[10] useful as it relates to determining the competence and capabilities of the other auditor (including that auditor's independence), the direction and supervision of the other auditor, the nature, timing and extent of the work assigned to the other auditor, and evaluating the sufficiency and appropriateness of the audit evidence obtained.

A20.         A user entity may use a service organisation that in turn uses a subservice organisation to provide some of the services provided to a user entity that are part of the user entity's information system relevant to financial reporting.  The subservice organisation may be a separate entity from the service organisation or may be related to the service organisation.  A user auditor may need to consider controls at the subservice organisation.  In situations where one or more subservice organisations are used, the interaction between the activities of the user entity and those of the service organisation is expanded to include the interaction between the user entity, the service organisation and the subservice organisations.  The degree of this interaction, as well as the nature and materiality of the transactions processed by the service organisation and the subservice organisations are the most important factors for the user auditor to consider in determining the significance of the service organisation's and subservice organisation's controls to the user entity's controls.

Using a Type 1 or Type 2 Report to Support the User Auditor's Understanding of the Service Organisation (Ref: Para. 13‑14)

A21.         The user auditor may make enquiries about the service auditor to the service auditor's professional organisation or other practitioners and enquire whether the service auditor is subject to regulatory oversight.  The service auditor may be practicing in a jurisdiction where different standards are followed in respect of reports on controls at a service organisation, and the user auditor may obtain information about the standards used by the service auditor from the standard setting organisation.

A22.         A type 1 or type 2 report, along with information about the user entity, may assist the user auditor in obtaining an understanding of:

(a)                The aspects of controls at the service organisation that may affect the processing of the user entity's transactions, including the use of subservice organisations;

(b)                The flow of significant transactions through the service organisation to determine the points in the transaction flow where material misstatements in the user entity's financial report could occur;

(c)                The control objectives at the service organisation that are relevant to the user entity's financial report assertions; and

(d)                Whether controls at the service organisation are suitably designed and implemented to prevent or detect processing errors that could result in