Data Group Limited is availing the services of Zone Limited for processing of its accounting data including payroll operations. Payroll costs…

CA Final · Advanced Auditing, Assurance and Professional Ethics · MTP · January 2026
Data Group Limited is availing the services of Zone Limited for processing of its accounting data including payroll operations. Payroll costs account for 75% of the total costs of Data Group Limited. CA Mir, the auditor of Data Group Limited wants to obtain an understanding of the nature and significance of the services provided by Zone Limited and their effect on the user entity's internal control to identify and assess the risks of material misstatement. In this regard, he wants to use Type 1 or Type 2 report. What shall be the considerations of CA Mir in determining the sufficiency and appropriateness of the audit evidence? Suggest the procedures if he plans to use a Type 1 or Type 2 report as audit evidence to support the understanding about the design and implementation of controls at Zone Limited as per relevant Standard on Auditing.

Suggested Answer and Working Notes:

Using A Type 1 or Type 2 Report to Support the User Auditor's Understanding of the Service Organisation: As per SA 402, “Audit Considerations Relating to an Entity Using a Service Organisation”, in determining the sufficiency and appropriateness of the audit evidence provided by a Type 1 or Type 2 report, CA Mir, the user auditor shall be satisfied as to: (i) The service auditor's professional competence (except where the service auditor is a member of the Institute of Chartered Accountants of India) and (ii) independence from the service organisation; and The adequacy of the standards under which the Type 1 or Type 2 report was issued. If the user auditor plans to use a Type 1 or Type 2 report as audit evidence to support the user auditor's understanding about the design and implementation of controls at the service organisation Zone Ltd., CA Mir, the user auditor shall: (i) Evaluate whether the description and design of controls at the service organisation is at a date or for a period that is appropriate for the user auditor's purposes; (ii) Evaluate the sufficiency and appropriateness of the evidence provided by the report for the understanding of the user entity's internal control relevant to the audit; and (iii) Determine whether the complementary user entity controls identified by the service organisation are relevant to the user entity and, if so, obtain an understanding of whether the user entity has designed and implemented such controls.

Topics: Standard on Auditing (SA)

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic