substantive testing

1. If you are engaged to provide a Type 2 report for a service organisation you would have to test the controls of the service organisation (to determine whether they are operating effectively). You wouldn't perform substantive procedures to provide this report. 2. Yes

for number 1, that means if i obtain type 2 report from service organization, and have performed test of control, i don't have to perform substantive procedures ? that means if i were to provide audit procedures on service organization if i request for type 2 report from a service organization, i can't perform substantive procedures on that service organization ?

If you are auditing a client which uses the services of a service organisation you are auditing the client - testing the client's controls and performing substantive procedures. The Type 1 or 2 report provided by the service organisation is audit evidence but you are not auditing the service organisation.

sorry kim but i have difficulties understanding your answer. my question was whether an audit firm audits a audit client and that audit client uses a service organization e.g payroll, then audit firm can perform test of control, substantive test, and request type 1 and type 2 report ?

Yes - but the test of control and substantive procedures will be performed in the client's internal control system, documentation, etc. And also request type 1 OR type 2 report (since Type 2 report is effectively Type 1 report + assurance on operating effectiveness, you wouldn't need both). I was trying to clarify that the auditor of the client does not audit the service organisation (i.e. perform tests of controls/substantive procedures on the service organisation's internal control system, documentation, etc).