Your Client Outsources Payroll. What Does the Financial Statement Auditor Do?
Outsourcing a process does not outsource the financial statement auditor's responsibility.
User entity
Your audit client uses another organization to process something relevant to financial reporting.
Service organization
The outside provider performs the outsourced service, such as payroll processing.
SOC 1
A SOC 1 report addresses controls relevant to user entities' internal control over financial reporting.
Type 1 vs Type 2
Type 1 focuses on design at a specified date. Type 2 also addresses operating effectiveness over a period.
Complementary user controls
The service organization's controls may assume the user entity performs specified controls itself, which the user auditor must consider.
The takeaway
SOC reports provide evidence about outsourced controls, but the user auditor still evaluates the effect on the audit.
Related Summit guides
FAQ
Does SOC 2 replace SOC 1 for financial statement audit purposes?
They serve different primary purposes.
Can the user auditor ignore outsourced processes?
No.
Does Type 2 include operating-effectiveness information?
Yes.