Service Organization Implication Flashcards
what are substantive procedures
used to detect material misstatements during the audit and include
both tests of details and analytical procedures
what is SOC 1
reports that provide assurance about a service organization’s controls relevant to user entity’s financial reporting
used by: entity’s auditors for risk assessment
restricted user report: to management of service org’s, user entities and other specified entities
what is SOC 2
detailed reports that provide assurance about a service organization’s controls over security, availability processing integrity, confidentiality, and privacy of the user entity’s data
used by: clients
restricted user report: to management of service org’s, user entities and other specified entities
what is SOC 3
undetailed reports that provide assurance about a service organization’s controls over security, availability processing integrity, confidentiality, and privacy of the user entity’s data
general use report: public use
what is Type 1?
address only accuracy of management’s description of the controls AND whether the controls are suitably designed
what is Type 2?
provide assurance about whether the controls are operating effectively
Subject matter of System and Organization Controls (SOC) reports for SOC 1 Type 1
design of controls relevant to financial reporting
Subject matter of System and Organization Controls (SOC) reports for SOC 1 Type 2
design and operating effectiveness of controls of relevant to financial reporting
Subject matter of System and Organization Controls (SOC) reports for SOC 2 Type 1
design of controls relevant to user’s operations
Subject matter of System and Organization Controls (SOC) reports for SOC 2 Type 2
design and operating effectiveness of controls relevant to user’s operations
SOC provides assurance about…
the service organization’s internal control
unmodified opinion
able to obtain reasonable assurance
disclaimer of opinion
unable to obtain reasonable assurance
F/S auditor is governed by _______
audits F/S of __________ and gives it to ___________ who relies on ______ for services of ___________
SAS; user entities; user organizations; I/C; service organizations
SOC 1 auditor is governed by _______; examines _____________ of ___________ relevant to users F/S and gives it to ___________
SSAE; controls; service organizations; service organizations
