PDF Print E-mail

The Internal Audit Function at a Service Organization and ISAE 3402

The ISAE 3402 standard discusses at length the role of the internal audit function within a service organization for purposes of assurance reporting.  It is important to note that the internal audit function can potentially have a significant impact on assurance reporting for the ISAE 3402 standard.

Many internal audit functions within a service organization exist to provide analysis, assurance, and other activities directly related to the actual service organization's system of internal controls. A primary objective of an organization's internal audit department can be to ensure that the service organization's daily operational activities, safeguards, processes, and procedures are functioning properly.  As such, the service auditor has a responsibility to obtain an understanding of a service organization's internal audit function for its relevancy to the engagement being performed in accordance with the ISAE 3402 standard.

Thus, the service auditor shall determine, first and foremost, if the work of a service organization's internal audit function can even be considered relevant and adequate for the engagement.  This can be determined by the following measures:

  • Is the internal audit function objective in nature?
  • Does the internal audit function consist of personnel with the required technical competence, and skill-sets, and is their work performed in a professional manner?
  • Has the work of the internal audit function been properly supervised, with review procedures in place along with adequate documentation?
  • Can the internal audit function within the service organization effective communicate as needed with the service auditor in a transparent and professional manner?

If the service auditor can answer yes to these questions, then the following inquiries shall be undertaken for further understanding the role of the internal audit function for purposes of the ISAE 3402 standard:

  • What is the nature of the work specifically performed by the internal audit function within the service organization?
  • Additionally, what is the scope of the work performed by the internal audit function, how significant is it in assisting the service auditor in reaching their conclusions and what evidence has been used to support these conclusions?

Finally, if the service auditor is to rely on work performed by the internal audit function, it will have to thus perform procedures as needed on this specific work. This is an important point, as service auditors cannot simply rely on the work performed by the internal audit function; they are required to actually perform procedures on the work, as required in the ISAE 3402 standard.

Please note that for a Type 1 report, no reference will be given in the assurance report regarding the work of the internal audit function within a service organization.However, for a Type 2 report, a description of the internal audit function will is required as mandated in the ISAE 3402 standard.

 
3 Reasons to Choose NDB, LLP
  • Cost-effective, fixed fee audits
  • Nationally and Globally Recognized CPA Firm
  • Years of Experience Performing Assurance and Attestation Reporting

Fill out the following form to inquire about NDB's ISAE 3402 Services:
  or Reset
 
Copyright © 2010 The ISAE 3402 Resource Guide. All Rights Reserved.