Service organizations and SOC reports

Tamarack does not run its own payroll. A payroll service provider calculates pay, withholds taxes, deposits net pay into employees' accounts and remits withholdings to the government, using data Tamarack sends each pay period. Its ERP is hosted and maintained by a software vendor. Its cold-storage investee keeps some inventory in a third-party warehouse. Each of these is a service organization: an outside organization that provides services that are part of the user entity's information system relevant to financial reporting. This lesson covers how the user auditor, Hollis Ward, obtains evidence about controls at service organizations, and how a service auditor reports on those controls.

User entities, service organizations and two kinds of auditor

The vocabulary matters. The user entity is the client that uses the service, here Tamarack. The service organization is the provider, here the payroll company. The user auditor audits the user entity's financial statements. The service auditor reports on the service organization's controls, usually at the request of the service organization, for the benefit of many user entities and their auditors. The user auditor's responsibilities are in AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization. The service auditor's engagement is performed under AT-C 320 (SOC 1).

In the United States, the service auditor's engagement on controls relevant to user entities' financial reporting is performed under the attestation standards, AT-C 320 as established by SSAE 18 and amended since. The resulting report is a SOC 1 report. Reports on controls relevant to security, availability, processing integrity, confidentiality or privacy use the Trust Services Criteria and are SOC 2 reports; a general-use SOC 3 report summarizes the SOC 2 results without the detailed testing. SOC for Cybersecurity and SOC for Supply Chain are further report types for broader audiences.

Type 1 and Type 2 reports

A Type 1 report gives the service auditor's opinion on the fairness of management's description of its system and the suitability of the design of controls to achieve stated control objectives, as at a specified date. A Type 2 report adds an opinion on the operating effectiveness of the controls throughout a specified period, usually 6 or 12 months, and includes a description of the service auditor's tests of controls and their results. Only a Type 2 report can provide evidence that controls operated effectively during the user entity's year; a Type 1 report helps the user auditor understand the controls and their design but cannot support reliance on their operation.

Every report also identifies whether subservice organizations are used, such as the data center provider that hosts the payroll company's servers, and whether they are treated by the carve-out method, where their controls are excluded from the description and testing, or the inclusive method, where they are included. Under the carve-out method the user auditor may need another report, from the subservice organization, if its controls are relevant.

Understanding the service and its effect on the audit

The user auditor's first step under AU-C 402 is to understand how the user entity uses the services: their nature and significance, the transactions affected, the degree of interaction between the user entity's activities and the service organization's, and the contractual terms. A service is more significant when the service organization initiates and records transactions with discretion, and less significant when it only processes data the user entity authorizes and controls.

For Tamarack, payroll is significant: wages and benefits are about 18 percent of operating expenses, and the provider calculates pay, deductions and remittances. However, Tamarack authorizes hiring, terminations and pay rates, approves each payroll register before funds are released, and reconciles payroll clearing accounts. That interaction means the user auditor can obtain evidence from Tamarack's own controls, from the provider's controls, or from substantive procedures, in combination.

If the user auditor plans to rely on controls at the service organization, it needs evidence that those controls operated effectively, which usually comes from a Type 2 report. If it does not plan to rely on them, it may still need a Type 1 or Type 2 report to understand the controls well enough to assess risks, or it may be able to obtain that understanding from the user entity.

Evaluating a Type 2 report

Receiving a report is not the end of the work. The user auditor evaluates whether the report provides sufficient appropriate evidence for its purpose. The questions include: Is the service auditor competent and independent? Is the report for the right system, services and locations? Does the period covered overlap enough with the user entity's year? Are the control objectives and controls relevant to the assertions the auditor cares about? Were there deviations, and what do they mean for the user entity? What complementary user entity controls does the report assume, and does the user entity actually have them?

The program evaluates the payroll provider's Type 2 report for Tamarack's year ending December 31, 2026. It measures the overlap of the report period with the year, lists the relevant controls and deviations, and compares the complementary user entity controls in the report with Tamarack's own controls.

# Evaluating a Type 2 service organization report for the group's payroll provider (invented).
import datetime as dt
fy_start, fy_end = dt.date(2026, 1, 1), dt.date(2026, 12, 31)
soc_start, soc_end = dt.date(2025, 10, 1), dt.date(2026, 9, 30)
covered = (min(fy_end, soc_end) - max(fy_start, soc_start)).days + 1
gap = (fy_end - soc_end).days
print(f"Report period {soc_start} to {soc_end}: covers {covered} of 365 days of the year; gap {gap} days")

controls = [  # (control, relevant to payroll assertions?, deviations found, sample size)
    ("Payroll changes approved by client-authorized users", True, 0, 40),
    ("Pay rates agree to client master file before each run", True, 2, 40),
    ("Logical access to payroll application restricted", True, 0, 25),
    ("Tax remittance reconciliations reviewed monthly", True, 0, 12),
    ("Server room environmental monitoring", False, 1, 25),
]
print("\nControls relevant to the user auditor:")
for name, relevant, dev, n in controls:
    if relevant:
        flag = "deviation - assess effect" if dev else "no deviations"
        print(f"  {name:<56}{dev}/{n}  {flag}")

cuecs = {   # complementary user entity controls listed in the report -> does the group have one?
    "User entity reviews payroll register before approval": "Controller reviews register each run",
    "User entity restricts who may submit changes": "HR director approves change forms",
    "User entity reconciles payroll clearing account monthly": None,
}
print("\nComplementary user entity controls:")
for cuec, own in cuecs.items():
    print(f"  {cuec:<58}{own or 'NOT IN PLACE - gap'}")

Report period 2025-10-01 to 2026-09-30: covers 273 of 365 days of the year; gap 92 days

Controls relevant to the user auditor:
  Payroll changes approved by client-authorized users     0/40  no deviations
  Pay rates agree to client master file before each run   2/40  deviation - assess effect
  Logical access to payroll application restricted        0/25  no deviations
  Tax remittance reconciliations reviewed monthly         0/12  no deviations

Complementary user entity controls:
  User entity reviews payroll register before approval      Controller reviews register each run
  User entity restricts who may submit changes              HR director approves change forms
  User entity reconciles payroll clearing account monthly   NOT IN PLACE - gap

The report covers October 1, 2025 to September 30, 2026, which leaves a gap of 92 days at the end of Tamarack's year. For the gap, the user auditor typically obtains a bridge letter, also called a gap letter, from the service organization's management, stating whether there have been changes in controls or known failures since the end of the report period. A bridge letter is a management representation, not assurance; the user auditor considers how long the gap is, the risks, and whether additional procedures are needed. A 3-month gap with a bridge letter and no reported changes is common and usually acceptable, combined with Tamarack's own review of each payroll register. A gap of 9 months would not be.

One relevant control had deviations: the provider's comparison of pay rates with the client master file found two exceptions in 40 items tested. The report describes them as rates updated late after approved raises. Hollis Ward considers whether the deviations could cause a material misstatement at Tamarack and whether Tamarack's controls compensate. The controller's review of each payroll register compares total pay by department with expectations, which is unlikely to catch individual rate errors, so the team adds a substantive test: recalculating pay for a sample of employees from approved rates. The deviation is also included in the deficiency evaluation in lesson 6.

The third finding is the most important. The report states that its controls achieve their objectives only if user entities reconcile the payroll clearing account monthly. Tamarack does not. Complementary user entity controls are controls the service organization assumes its customers have; if a customer lacks one, the service auditor's opinion does not cover the related risk for that customer. Hollis Ward reports the missing reconciliation to management as a deficiency and performs its own reconciliation of the clearing account at year end, investigating the 41,000-dollar unreconciled balance it finds.

When there is no report

Not every service organization provides a report. The third-party warehouse used by the cold-storage investee is small and has never commissioned one. The options then include: obtaining evidence from the user entity's own controls over the service; performing procedures at the service organization, with its agreement, such as observing an inventory count; confirming balances held by the service organization; or using another auditor to perform procedures there. If none of these provides sufficient appropriate evidence on a material item, the result is a scope limitation.

Fraud, non-compliance and the user entity's responsibilities

The user auditor asks user entity management whether the service organization has reported any fraud, non-compliance with laws and regulations or uncorrected misstatements affecting the user entity, and reads the service organization's communications. Outsourcing does not transfer the user entity's responsibility for its internal control or financial statements. Management must still understand and monitor the services, which is one reason why many audit committees now ask management each year to list the service organizations it relies on and the reports obtained.

The user auditor's report does not refer to the service auditor's report as a basis for its opinion. AU-C 402 prohibits reference in an unmodified opinion; PCAOB standards for issuer audits, including AS 2601 on service organizations, similarly leave responsibility with the auditor of the user entity.

SOC 2 reports and the audit

Clients often hand auditors a SOC 2 report because that is what their cloud vendors provide. A SOC 2 report addresses security, availability and the other trust services categories rather than financial reporting control objectives. It can still be useful: controls over logical access and change management at a hosting provider are relevant ITGCs. The user auditor must evaluate whether the SOC 2 controls address the specific risks it cares about, such as unauthorized changes to the application that calculates revenue, and should not treat a SOC 2 report as a substitute for a SOC 1 report on processing controls.