What does service organization mean on the CPA exam?
Service organization. A third party whose processing affects a user entity's financial reporting, such as a payroll bureau or a claims processor. Its controls become part of the user's control environment.
Defined against AU-C 402.08.
Which CPA exam sections use service organization?
Service organization appears in the AUD section of the CPA exam.
Other terms defined against AU-C 402
- user auditor: The auditor of an entity that uses a service organization.
- user entities: The customers of a service organization, whose own financial reporting or systems depend on the service organization's controls.
Related terms
- SOC 2 report: A report on a service organization's controls against the trust services criteria, covering security plus any of availability, processing integrity, confidentiality, and privacy that are selected.
- carve-out method: Excludes a subservice organization's control objectives and controls from both the description and the scope of the service auditor's report.
- control environment: The governance and management functions and the attitudes, awareness, and actions of those charged with governance and management concerning the entity's system of internal control.
- complementary user entity controls: Controls a service organization assumes its customers are running.
- inclusive method: Brings a subservice organization's controls inside the description and the scope of the service auditor's report, so one report covers both organizations.
- direct financing lease: A lessor lease where control transfers only because a third-party guarantee makes collection probable.