SA 402 requires the auditor, when a client uses a service organisation for a process relevant to financial reporting — payroll processing, transaction hosting, fund administration — to obtain an understanding of the nature and significance of the services provided and their effect on the client's internal control, sufficient to identify and assess the risks of material misstatement, and then to design procedures responsive to those risks, which may include obtaining a Type 1 or Type 2 report from the service organisation's own auditor, or performing procedures at the service organisation directly.
Type 1 vs Type 2 reports — what each actually supports
| Report type | What it covers | What it does NOT give the auditor |
|---|---|---|
| Type 1 | Description of controls and whether they are suitably designed, as of a point in time | No evidence that controls operated effectively over the period — cannot support reliance on operating effectiveness |
| Type 2 | Description of controls, suitability of design, AND operating effectiveness tested over a period | Still needs evaluation of whether the period covered aligns with the audit period, and whether the tests performed by the service auditor are relevant to the client's specific risks |
What the user auditor still has to do, even with a Type 2 report in hand
- 01Evaluate the service auditor's professional competence and independenceThe report's value depends on who performed it; this cannot be assumed.
- 02Evaluate the adequacy of the period coveredA Type 2 report covering the first ten months of the year leaves a gap the user auditor still has to address for the remaining period.
- 03Consider complementary user entity controls (CUECs)Service organisation reports typically assume the client operates certain controls on its own side — if the client hasn't actually implemented those CUECs, the report's conclusions about effectiveness don't transfer across.
- 04Consider the need to contact the service auditor, or perform procedures at the service organisationWhere the available report is insufficient — e.g. a Type 1 report where operating effectiveness evidence is actually needed — SA 402 requires closing that gap, not accepting the lesser report as adequate by default.
A Type 1 report does not provide evidence of operating effectiveness. Citing it to support reliance on controls having actually worked through the year is a misuse of the report that SA 402 specifically guards against.
This is practical guidance written for audit teams, not an authoritative statement of any standard or statute. Standards, forms and timelines change. Check the current text issued by the ICAI and the relevant authority before relying on anything here in an audit file.
Related resources
- Internal audit & IFCUsing a SOC 1 Type II report in a statutory auditWhat a SOC 1 Type II report actually tells the auditor when a client outsources a process, how to test the complementary user entity controls it assumes, and what to do when none exists.
- Internal audit & IFCIFC testing: internal financial controls over financial reportingHow IFC testing differs from a substantive statutory audit, what design versus operating effectiveness testing actually means in practice, and what the file needs to show for each.
- Audit data & extractsExporting audit data from Busy, Zoho Books and MargBusy, Zoho Books and Marg each export audit data differently from Tally, and each has a specific weak point an auditor needs to plan around.
- Internal audit & IFCControl walkthrough documentation: what belongs in the fileWhat a control walkthrough has to establish beyond description, narrative versus flowchart formats, and the shortfalls that recur most often on file inspection.
Free tools, no signup
Each one reads a file entirely in your browser — or, for two of them, just answers a few questions — and nothing is ever uploaded.
- Purchase register checkDuplicate payments, round-sum amounts, weekend-dated invoices, incomplete records.
- GSTR-2B reconcilerMatches your purchase register against GSTR-2B — missing invoices either side, amount mismatches.
- Bank reconciliation checkerMatches your cash book against a bank statement — what's outstanding on each side.
- Fixed asset register checkDuplicate asset codes, missing location or useful life, negative net book value.
- Payroll red-flag scannerBank accounts shared across employees, and records missing an ID, PAN or salary.
- CARO applicability checkerAnswer a few questions about the company and see which CARO 2020 clauses likely apply.
- MSME payment delay checkerMSME-flagged invoices paid — or still unpaid — beyond the 45-day Section 22 limit.
- Related-party transaction screenerTransactions above a threshold you set with no approval reference, grouped by counterparty.
- Depreciation useful life checkerCompares a useful life in use against the Schedule II, Part C indicative figure.
- Materiality calculatorOverall and performance materiality against PBT, revenue, assets or equity, with reasoning shown.
- Sample size calculatorStatistical sample size for a test of controls or a substantive test of detail.