Outsourcing and service organisations: ISA 402

Many companies no longer do every job themselves. They pay another business to run the payroll, host the information technology (IT) systems, clean the offices or even carry out the internal audit. That is outsourcing, and it creates a problem for the auditor. The company’s figures may be produced by someone who is not the auditor’s client, whose records the auditor cannot simply ask to see.

This topic covers what is outsourced, the advantages and disadvantages, the special case of outsourcing internal audit, and International Standard on Auditing (ISA) 402, which tells the auditor what to do when a client uses a service organisation. May 2026 Question 3 asked for the factors to consider before outsourcing internal audit and for its disadvantages, and both answers are lists in this topic.

What is outsourced

Outsourcing work to external suppliers and service organisations is common. The syllabus lists:

• payroll operations;
• internal auditing;
• financial and management accounting activities, such as data processing or pensions;
• IT services;
• tax compliance and tax consultancy;
• due diligence for acquisitions and mergers; and
• non-financial services, such as catering, cleaning, fleet management and recruitment.

Entire functions can be outsourced, such as all financial accounting from book-keeping to the final statements. Or only part of a function may be, such as payroll, with the rest done in house.

A problem for both internal and external auditors is that they must satisfy themselves that the outside agencies do their work properly. It may be necessary to check that the information the agency provides is correct and that its internal controls are effective.

Advantages and disadvantages

Advantages

• Cost savings. It may be cheaper than doing the work in house.
• Skills. The provider may have expertise the entity lacks.
• Up-to-date techniques and technology that the entity cannot easily get.
• Management focus. Management can spend time on core activities and less on monitoring the outsourced one.

Disadvantages

• Specification. The provider must understand the entity’s requirements. If the work is not specified properly, the provider may not do everything the entity needs.
• Reliance on timing. The entity depends on the provider to deliver on time. This matters especially for payroll.
• Priority and customer care. Management must make sure the provider gives the entity an appropriate level of priority, with regular reviews of service level and quality.
• Management of the arrangement. It must be effectively managed and controlled.

Outsourcing the internal audit function

Some entities outsource internal audit, often to the accountancy firm that provides the external audit. Several factors need to be considered.

Factors to consider (May 2026 Question 3(a))

1. The accounting firm must have a greater level of independence than the entity’s own internal audit staff. If it is not properly independent of the executive management, it should not be given any internal audit work.
2. It may have access to more highly trained specialist staff.
3. It has more employees available for urgent assignments.
4. It is regulated by professional codes of conduct and standards of behaviour, which may not be true of an in-house department.
5. It can be sued for breach of contract or negligence, and should have professional indemnity insurance to meet claims.

Disadvantages (May 2026 Question 3(c))

1. Professional firms are not under the entity’s control in the same way as in-house staff, so the arrangement needs to be managed and controlled.
2. Fees for internal audit work can be high.
3. The firm may not know the entity and its operations as well as in-house auditors who work there every day, and if the work is not properly specified it may not do everything required.
4. There may be threats to the independence of the external audit where the firm is both internal and external auditor.
5. The entity relies on the provider for timing, so management must review service level and quality regularly.
6. If the external auditor must review its own internal audit work, the effort is duplicated and costs the client more.

Outsourcing other finance and accounting functions

An important feature is that the service provider may control the accounting records from which the financial statements are drawn. If payroll is outsourced, the data on employee costs and payroll liabilities, such as tax, may be held by the provider and not by the audit client. The auditor is engaged by the client and has no contract with the service organisation.

The contract between the client and the service organisation should therefore oblige the service organisation to give the auditor access to the information the auditor needs.

The issues for the auditor are:

1. Materiality. Is the outsourced operation material to the statements? Payroll is likely to be, so the auditor must consider how to get sufficient appropriate evidence about payroll costs.
2. Accessibility of records. The auditor must be able to get the relevant records and should agree the arrangements with the service organisation.
3. Control risk. The auditor assesses control risk in the outsourced operation. A systems audit is possible only if the auditor is satisfied with the service organisation’s controls. Otherwise substantive procedures are needed.
4. Compliance. Where the outsourced work is regulated, the auditor considers how to gather evidence of compliance, such as tax deductions in payroll.
5. Transfer of information. The auditor checks how, how often and how reliably information is transferred between the service organisation and the client.

When an exam asks about outsourcing a particular function, think about the function itself:

• logistics and practical issues;
• confidentiality of the source information, for example pension details in payroll;
• the speed of technology change in that area; and
• responsibility, since directors remain legally responsible for proper accounting records even if the work is outsourced.

ISA 402: a client using a service organisation

ISA 402 applies when services of a service organisation, and the controls over them, are part of the client’s information system. Such controls most often relate to financial reporting, but others, such as controls over the safeguarding of assets, can also be relevant. The auditor’s objectives are to:

1. understand the nature and significance of the services and their effect on the client’s internal controls, enough to identify and assess the risks of material misstatement; and
2. design and perform audit procedures in response to those risks.

Understanding the services (ISA 315)

The auditor understands how the client uses the services and evaluates the client’s controls over them. For example, a client may have controls over the submission and receipt of payroll data that prevent or detect material misstatement. Testing those controls may let the auditor conclude that payroll is not materially misstated whatever controls the service organisation has.

If the auditor cannot get enough understanding from the client, one or more of these procedures is used:

• obtain a Type 1 or Type 2 report;
• contact the service organisation, through the client, for specific information;
• visit the service organisation and perform appropriate procedures; or
• use another auditor to perform the procedures.

Type 1 and Type 2 reports

Before relying on either report, the user auditor must be satisfied about the service auditor’s professional competence and independence from the service organisation, and about the standards under which the report was issued.

Responding to the assessed risks (ISA 330)

The auditor decides whether sufficient appropriate evidence is available from records held at the client. If not, the auditor performs further procedures or uses another auditor at the service organisation. To test controls, the auditor uses one or more of: a Type 2 report, tests of controls at the service organisation, or another auditor to do those tests.

Other requirements

• The auditor asks management whether the service organisation has reported any fraud, non-compliance or uncorrected misstatements to it.
• If the auditor cannot get sufficient appropriate evidence about the services, the auditor modifies the opinion.
• The report does not refer to the service auditor unless law requires it. Even then, or if the reference helps explain a modified opinion, the report must make clear that it does not reduce the auditor’s responsibility for the opinion.

ISAE 3402

International Standard on Assurance Engagements (ISAE) 3402, Assurance reports on controls at a service organisation, covers the engagement by a professional accountant to give a report for user entities and their auditors on controls at a service organisation that are likely to be relevant to the users’ internal control over financial reporting. It complements ISA 402, because reports under ISAE 3402 can be appropriate evidence under ISA 402.

It is effective for periods ending on or after 15 June 2011. The service auditor aims to obtain reasonable assurance, on suitable criteria, about whether:

1. the description of the system fairly presents the system as designed and implemented throughout the period (or at a date for Type 1);
2. the controls related to the control objectives were suitably designed throughout the period (or at the date for Type 1); and
3. where included in the scope, the controls operated effectively throughout the period.

The service auditor then reports on these matters in line with the findings.

Background: ISA 402 uses these terms: the user entity is the client, the user auditor audits the client, the service organisation provides the services and the service auditor reports on the service organisation’s controls. A Type 2 report often ends before the client’s year end, so the user auditor performs extra procedures to cover the gap period.

Reports usually list complementary user entity controls that the client must operate for the service organisation’s controls to work.

The rules in more depth

Why the client’s own controls still matter

Even if the auditor cannot test the service organisation, the client’s controls over what it sends and receives can be tested. A client that reconciles the payroll register to the bank payments and to the approved headcount each month has a control that does not depend on the provider.

Why the auditor does not refer to the service auditor

The opinion is the auditor’s own. Referring to another auditor in the report might suggest the responsibility is shared, which it is not.

Independence when the external auditor is also the internal auditor

The independence of the external audit is threatened if the firm performs management functions or reviews its own work. The earlier topics on non-audit services give the safeguards.

Worked example: outsourced payroll

Scenario. Tiger Distribution Plc outsources its payroll to PayServe Ltd. Annual payroll cost is ₦1.8 billion. Materiality for the audit is ₦150 million. PayServe gives a Type 2 report covering 1 January to 30 September 2025. The client’s year end is 31 December 2025. The report has two exceptions in 25 tests of the controls over changes to bank details.

Step 1: materiality. Payroll is ₦1.8 billion ÷ ₦150 million = 12 times materiality, so it is material and the auditor needs evidence.

Step 2: the report. The auditor checks the service auditor’s competence and independence and the standard used (ISAE 3402). The two exceptions in 25 tests are 8%, and they relate to bank details, a fraud risk. The auditor discusses them with management, finds out whether they were corrected and treats the control over bank detail changes as not reliable unless it is supported.

Step 3: the gap. The report covers nine months. The auditor performs procedures for 1 October to 31 December: for example, reperforming the payroll for a sample of months, agreeing payments to the bank and approved headcount, and asking management and PayServe whether anything has changed.

Step 4: the client’s controls. The auditor tests Tiger’s own monthly reconciliation of the payroll register to bank payments and to the approved list of employees, which does not depend on PayServe.

Step 5: compliance and fraud. The auditor checks tax deductions against the regulations and asks management whether PayServe has reported any fraud or non-compliance. If sufficient evidence cannot be obtained, the opinion is modified for the limitation.

How to score full marks

• Make the factors specific to the outsourced function. Say “payroll” or “internal audit”, not “the function”.
• For outsourcing internal audit, list five factors and six disadvantages. Remember that independence is both a factor and a disadvantage, in different ways.
• Give the auditor’s five issues. Materiality, access, control risk, compliance, transfer of information.
• Distinguish Type 1 from Type 2. A date and design, against a period and operating effectiveness.
• End with the report. Modified opinion if evidence is insufficient, and no reference to the service auditor.

Common mistakes in the exam

• Saying that the auditor can rely on the service organisation without checking.
• Saying that outsourcing removes the directors’ responsibility for accounting records.
• Confusing Type 1 and Type 2.
• Referring to the service auditor in the audit report.
• Forgetting that the auditor has no contract with the service organisation.
• Giving only the benefits of outsourcing internal audit when the question asks for disadvantages.

Quick revision

• Outsourced: payroll, internal audit, accounting, IT, tax, due diligence, non-financial services.
• Advantages: cost, skills, technology, management focus. Disadvantages: specification, timing, priority, management.
• Outsourcing internal audit: independence, specialists, staff, codes of conduct, indemnity insurance. Drawbacks: control, fees, knowledge, independence threat, timing, duplication.
• Auditor issues: materiality, access, control risk, compliance, transfer of information.
• ISA 402: understand, respond. Type 1: date, design. Type 2: period, operation.
• Insufficient evidence leads to a modified opinion. No reference to the service auditor.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.