Audit Report

Why have you called this post “Audit Report”? It has nothing to do with audit reports on financial statements. Type 1/2 reports prepare by the auditor of the service organisation for the service organisation’s client customers and/or auditors are “assurance reports”.

A Type 1 report:
(i) A description, prepared by management of the service organization, of the service organization’s system, control objectives and related controls that have been designed and implemented as at a specified date; and
(ii) A report by the service auditor with the objective of conveying reasonable assurance that includes the service auditor’s opinion on the description of the service organization’s system, control objectives and related controls and the suitability of the design of the controls to achieve the specified control objectives.

A Type 2 report comprises:
(i) A description, prepared by management of the service organization, of the service organization’s system, control objectives and related controls, their design and implementation as at a specified date or throughout a specified period and, in some cases, their operating effectiveness throughout a specified period; and
(ii) A report by the service auditor with the objective of conveying reasonable
assurance that includes:
a. The service auditor’s opinion on the description of the service organization’s system, control objectives and related controls, the suitability of the design of the controls to achieve the specified control objectives, and the operating effectiveness of the controls; and
b. A description of the service auditor’s TESTS OF CONTROLS and the results
thereof.

In short only a Type 2 report provides the auditor with evidence of the operating effectiveness of the controls.

Note that obtaining either report is not an requirement – and only asked for if the auditor needs it. For example, the payroll needs input to be provided by the client – starters/leavers/hours worked/rates of pay/overtime etc – the client itself should exercise controls over the payroll output (e.g. reconciling totals, test checking computations, etc).

The auditor may simply test the client’s controls. Think: input -> process -> output …. the only real difference between the client running the payroll and a service organsiation is that the process is not performed by the client’s computer but the service organisation’s.