Standard Philippine on Auditing 402
AUDIT CONSIDERATIONS RELATING TO
ENTITIES USING SERVICE ORGANIZATIONS
PSA 402
PHILIPPINE STANDARD ON AUDITING 402
AUDIT CONSIDERATIONS RELATING TO
ENTITIES USING SERVICE ORGANIZATIONS
CONTENTS
Paragraphs
Introduction
1-3
Consideration of the Client Auditor
4-10
Service Organization Auditors Report
11-18
Material Misstatements of Facts
14-18
Effective Date
19
Acknowledgment
20-21
Philippine Standards on Auditing (PSAs) are to be applied in the audit of financial statements.
PSAs are also to be applied, adapted as necessary, to the audit of other information and to
related services.
PSAs contain the basic principles and essential procedures (identified in bold type black
lettering) together with related guidance in the form of explanatory and other material. The
basic principles and essential procedures are to be interpreted in the context of the explanatory
and other material that provide guidance for their application.
To understand and apply the basic principles and essential procedures together with the related
guidance, it is necessary to consider the whole text of the PSA including explanatory and other
material contained in the PSA not just that text which is black lettered.
In exceptional circumstances, an auditor may judge it necessary to depart from a PSA in order
to more effectively achieve the objective of an audit. When such a situation arises, the auditor
should be prepared to justify the departure.
PSAs need only be applied to material matters.
PSA 402
The PSAs issued by the Auditing Standards and Practices Council (Council) are based on
International Standards on Auditing (ISAs) issued by the International Auditing Practices
Committee of the International Federation of Accountants.
The ISAs on which the PSAs are based are generally applicable to the public sector, including
government business enterprises. However, the applicability of the equivalent PSAs on
Philippine public sector entities has not been addressed by the Council. It is the understanding
of the Council that this matter will be addressed by the Commission on Audit itself in due
course. Accordingly, the Public Sector Perspective set out at the end of an ISA has not been
adopted into the PSAs.
PSA 402
Introduction
1.
The purpose of this Philippine Standard on Auditing (PSA) is to establish standards and
provide guidance to an auditor whose client uses a service organization. This (PSA ) also
describes the service organization auditor's reports which may be obtained by client
auditors.
2.
The auditor should consider how a service organization affects the clients
accounting and internal control systems so as to plan the audit and develop an
effective audit approach.
3.
A client may use a service organization such as one that executes transactions and
maintains related accountability or records transactions and processes related data (e.g., a
computer systems service organization). f a client uses a service organization, certain
policies, procedures and records maintained by the service organization may be relevant
to the audit of the financial statements of the client.
Considerations of the Client Auditor
4.
A service organization may establish and execute policies and procedures that affect a
client organization's accounting and internal control systems. These policies and
procedures are physically and operationally separate from the client organization. When
the services provided by the service organization are limited to recording and processing
client transactions and the client retains authorization and maintenance of accountability,
the client may be able to implement effective policies and procedures within its
organization. When the service organization executes the client's transactions and
maintains accountability, the client may deem it necessary to rely on policies and
procedures at the service organization.
5.
The auditor should determine the significance of service organization activities to
the client and the relevance to the audit. In doing so, the client auditor would need to
consider the following, as appropriate:
Nature of the services provided by the service organization.
Terms of contract and relationship between the client and the service
organization.
The material financial statement assertions that are affected by the use of the
service organization.
Inherent risk associated with those assertions.
PSA 402
-2
Extent to which the client's accounting and internal control systems interact with
the systems at the service organization.
Client's internal controls that are applied to the transactions processed by the
service organization.
Service organization's capability and financial strength, including the possible
effect of the failure of the service organization on the client.
Information about the service organization such as that reflected in user and
technical manuals.
Information available on general controls and computer systems controls relevant
to the client's applications.
Consideration of the above may lead the auditor to decide that the control risk assessment
will not be affected by controls at the service organization; if so, further consideration of
this PSA is unnecessary.
6.
The client auditor would also consider the existence of third-party reports from service
organization auditors, internal auditors, or regulatory agencies as a means of providing
information about the accounting and internal control systems of the service organization
and about its operation and effectiveness.
7.
If the client auditor concludes that the activities of the service organization are
significant to the entity and relevant to the audit the auditor should obtain sufficient
information to understand the accounting and internal control systems and to assess
control risk at either the maximum, or a lower level if tests of control are
performed.
8.
If information is insufficient, the client auditor would consider the need to request the
service organization to have its auditor perform such procedures as to supply the
necessary information, or the need to visit the service organization obtain to the
information. A client auditor wishing to visit a service organization may advise the client
to request the service organization to give the client auditor access to the necessary
information.
PSA 402
-39.
The client auditor may be able to obtain an understanding of the accounting and internal
control systems affected by the service organization by reading the third-party report of
the service organization auditor. In addition, when assessing control risk for assertions
affected by the systems' controls of the service organization, the client auditor may also
use the service organization auditor's report. If the client auditor uses the report of a
service organization auditor, the auditor should consider making inquiries
concerning that auditors professional competence in the context of the specific
assignment undertaken by the service organization auditor.
10.
The client auditor may conclude that it would be efficient to obtain audit evidence from
tests of control to support an assessment of control risk at a lower level. Such evidence
may be obtained by:
Performing tests of the client's controls over activities of the service organization.
Obtaining a service organization auditor's report that expresses an opinion as to
the operating effectiveness of the service organization's accounting and internal
control systems for the processing applications relevant to the audit.
Visiting the service organization and performing tests of control.
Service Organization Auditor's Reports
11.
When using a service organization auditors report, the client auditor should
consider the nature of and content of that report.
12.
The report of the service organization auditor will ordinarily be one of two types as
follows:
Type A -- Report on suitability of design
(a)
a description of the service organization's accounting and internal control systems,
ordinarily prepared by the management of the service organization; and
PSA 402
-4(b)
an opinion by the service organization auditor that:
(i)
the above description is accurate;
(ii) the systems' controls have been placed in operation; and
(iii) the accounting and internal control systems are suitably designed to achieve
their stated objectives.
Type B -- Report on suitability of design and operating effectiveness
(a)
a description of the service organization's accounting and internal control systems,
ordinarily prepared by the management of the service organization; and
(b)
an opinion by the service organization auditor that:
(i)
the above description is accurate;
(ii) the systems' controls have been placed in operation;
(iii) the accounting and internal control systems are suitably designed to achieve
their stated objectives; and
(iv) the accounting and internal control systems are operating effectively based
on the results from the tests of control. In addition to the opinion on
operating effectiveness, the service organization auditor would identify the
tests of control performed and related results.
The report of the service organization auditor will ordinarily contain restrictions as to use
(generally to management, the service organization and its customers, and client
auditors).
13.
The client auditor should consider the scope of work performed by the service
organization auditor and should assess the usefulness and appropriateness of
reports issued by the service organization auditor.
14.
While Type A reports may be useful to a client auditor in gaining the required
understanding of the accounting and internal control systems, an auditor would not use
such reports as a basis for reducing the assessment of control risk.
PSA 402
-515.
In contrast, Type B reports may provide such a basis since tests of control have been
performed. When a Type B report is to be used as evidence to support a lower control
risk assessment, a client auditor would consider whether the controls tested by the service
organization auditor are relevant to the client's transactions (significant assertions in the
client's financial statements) and whether the service organization auditor's tests of
control and the results are adequate. With respect to the latter, two key considerations are
the length of the period covered by the service organization auditor's tests and the time
since the performance of those tests.
16.
For those specific tests of control and results that are relevant, a client auditor
should consider whether the nature, timing and extent of such tests provide
sufficient appropriate audit evidence about the effectiveness of the accounting and
internal control systems to support the client auditor's assessed level of control risk.
17.
The auditor of a service organization may be engaged to perform substantive procedures
that are of use to a client auditor. Such engagements may involve the performance of
procedures agreed upon by the client and its auditor and by the service organization and
its auditor.
18.
When a client auditor uses a report from the auditor of a service organization, no
reference should be made in the client auditor's report on the service organization.
Effective Date
19.
This PSA is effective for audits of financial statements for periods ending on or after June
30, 2003. Earlier application is encouraged.
Acknowledgment
20.
This PSA, Audit Considerations Relating to Entities Using Service Organizations, is
based on International Standard on Auditing 402 of the same title issued by the
International Auditing Practices Committee of the International Federation of
Accountants.
21.
There are no significant differences between this PSA and ISA 402.
PSA 402
-6This Philippine Standard on Auditing 402 was unanimously approved on June 24, 2002 by the
members of the Auditing Standards and Practices Council:
Benjamin R. Punongbayan, Chairman
Antonio P. Acyatan, Vice Chairman
Felicidad A. Abad
David L. Balangue
Eliseo A. Fernandez
Nestorio C. Roraldo
Editha O. Tuason
Joaquin P. Tolentino
Joycelyn J. Villaflores
Carlito B. Dimar
Froilan G. Ampil
Erwin Vincent G. Alcala
Horace F. Dumlao
Isagani O. Santiago
Eugene T. Mateo
Emma M. Espina
Jesus E. G. Martinez