A5/M5 Reporting on Controls at a Service Organization

Question 1

what is the difference b/w service auditor and user auditor?

Answer 1

• Service auditor audits service organization such as ADP provides payroll services for client
• User auditor audits client who considers the service provided by the service organization as part of its information system

Question 2

what are objectives of service auditor?

Answer 2

• Obtain reasonable assurance whether:
  + service organization management’s description of service system is fairly presented and it was designed and implemented throughout the specified period
  + the controls were suitably designed throughout the specified period
  + the controls operated effectively throughout the specified period
• Report the findings

Question 3

what are SOC 1 and SOC 2 reports?

Answer 3

• SOC 1: evaluating the impact that certain relevant controls at the service organization have on the FS of the user entity
• SOC 2 (broader): give assurance to a broader range of users regarding the controls in place at a service organization relevant to one or more of the trust services criteria of security, availability, process integrity, confidentiality, and privacy

Question 4

what are Type 1 and Type 2 reports?

Answer 4

• Type 1:
  + report on the DESIGN and IMPLEMENTATION of a service organization’s controls
  + the control objectives present a specified DATE
• Type2:
  + report on the DESIGN, IMPLEMENTATION, and OPERATING EFFECTIVENESS of a service organization’s controls
  + the control objectives present throughout a specified PERIOD

Question 5

what are objectives of user auditors when a SOC 1 service auditor’s report is available?

Answer 5

• SOC 1/Type 1 report: Only aid the user auditor in obtaining an understanding of controls
• SOC 1/Type 2 report: provides user auditor with assurance about the design, implementation, and operating effectiveness of the service organization’s internal controls; therefore, allow a reduction in the assessed level of CONTROL RISK. Moreover, the user auditor should be satisfied with the following:
  + service auditor’s competence and independence
  + adequacy of the standards used in the service auditor’s report
  + period of time covered by the report is appropriate with user auditor’s purposes