SKY Hospital is a very renowned hospital for Orthopedic Surgeries in Pune having sophisticated infrastructure. SKY Hospital has recently implemented…

CA Final · Advanced Auditing, Assurance and Professional Ethics · MTP · May 2026
SKY Hospital is a very renowned hospital for Orthopedic Surgeries in Pune having sophisticated infrastructure. SKY Hospital has recently implemented a comprehensive information system, developed and managed by CT Contractors, which is used for maintaining complete and integrated records of indoor patients. This system captures and processes details relating to patients’ diagnosis, treatment plans, medications administered, as well as billing and corresponding receipt transactions, thereby supporting both clinical and financial reporting functions of the hospital. CA Yash is the statutory auditor of SKY Hospital. During the course of audit, he became aware that the hospital is using a system developed and managed by CT Contractors. Since the hospital relies on this system for maintaining patient and billing records, CA Yash is concerned whether the controls implemented at CT Contractors are operating effectively or not. For this purpose, CA Yash requested CT Contractors to provide an assurance report issued by a practicing chartered accountant, containing an opinion on the description of the CT Contractor's system and the effectiveness of the controls in place. Which type of report should be obtained by CA Yash in terms of relevant Standard on Auditing? What aspects are to be considered by CA Yash in using such assurance report as audit evidence that controls at CT Contractors are operating effectively?

Suggested Answer and Working Notes:

(a) In the given scenario, CA. Yash, as the statutory auditor of SKY Hospital, is concerned about the effectiveness of controls at the service organization, specifically the system managed by CT Contractors. To address this concern, CT Contractors should provide a Type 2 assurance report from a practicing chartered accountant as per SA 402, “Audit Considerations Relating to an Entity Using a Service Organisation”. This report will offer an opinion on the description of the system in use at SKY Hospital, as well as evaluate the effectiveness of the controls implemented by CT Contractors. Using a Type 2 report as audit evidence that controls at the service organisation are operating effectively: If, the user auditor plans to use a Type 2 report as audit evidence that controls at the service organisation are operating effectively, the user auditor shall determine whether the service auditor's report provides sufficient appropriate audit evidence about the effectiveness of the controls to support the user auditor's risk assessment by: (a) Evaluating whether the description, design, and operating effectiveness of controls at the service organisation is at a date or for a period that is appropriate for the user auditor's purposes; (b) Determining whether complementary user entity controls identified by the service organisation are relevant to the user entity and, if so, obtaining an understanding of whether the user entity has designed and implemented such controls and, if so, testing their operating effectiveness; (c) Evaluating the adequacy of the time period covered by the tests of controls and the time elapsed since the performance of the tests of controls; and (d) Evaluating whether the tests of controls performed by the service auditor and the results thereof, as described in the service auditor's report, are relevant to the assertions in the user entity's financial statements and provide sufficient appropriate audit evidence to support the user auditor's risk assessment.

Topics: Standard on Auditing (SA)

Open in Interactive Practice Hub · Full Practice Hub · Chapter Weightage · More in this subject

Related Questions in this Topic