What does user auditor mean on the CPA exam?
Last reviewed
User auditor. The auditor of an entity that uses a service organization. Distinct from the service auditor, who reports on the service organization's own controls.
Defined against AU-C 402.08.
Worked example
A retailer outsources its inventory system to a logistics provider. The retailer's auditor wants to rely on the provider's controls over inventory quantities for the calendar year. The provider supplies a SOC 1 Type 2 report covering January 1 through September 30, and a Type 1 report on its controls as of December 31.
What can the retailer's auditor rely on, and what is still missing?
- The retailer's auditor is the user auditor: it audits the entity that uses the service organization, while the service auditor reported on the provider's own controls.
- The Type 2 report tests operating effectiveness, but only through September 30, so it supports reliance for nine months of the year.
- The Type 1 report speaks to design at a single date and gives no evidence that the controls operated during October to December, so the user auditor needs more for that quarter: inquiry of the provider about changes, and further tests or substantive work covering those months.
Answer: The user auditor can rely on the Type 2 report for January to September, and must obtain additional evidence about operating effectiveness for October to December. The Type 1 report does not fill that gap.
The trap: Treating the year-end Type 1 report as covering the last quarter. A report on design as of one date says nothing about how controls operated over a period.
Based on AU-C 402.08; AS 2601.12.
Which CPA exam sections use user auditor?
User auditor appears in the ISC section of the CPA exam.
Other terms defined against AU-C 402
- service organization: A third party whose processing affects a user entity's financial reporting, such as a payroll bureau or a claims processor.
- user entities: The customers of a service organization, whose own financial reporting or systems depend on the service organization's controls.
Related terms
- carve-out method: Excludes a subservice organization's control objectives and controls from both the description and the scope of the service auditor's report.
- complementary user entity controls: Controls a service organization assumes its customers are running.
- inclusive method: Brings a subservice organization's controls inside the description and the scope of the service auditor's report, so one report covers both organizations.
- SOC 2 report: A report on a service organization's controls against the trust services criteria, covering security plus any of availability, processing integrity, confidentiality, and privacy that are selected.
- internal audit: An in-house function that evaluates controls and processes and reports to those charged with governance.
- performance obligation: A promise in a contract to transfer a distinct good or service.