Hard1 markMultiple Choice
Area II: Risk AssessmentAUDService OrganizationsEvidence

CPA · Question 19 · Area II: Risk Assessment

An auditor is auditing the financial statements of a nonissuer that uses a service organization for its investment transaction processing. The auditor is unable to obtain a SOC 1 Type 2 report and the user entity's controls over the investment activities are not sufficient to provide evidence. Which of the following is the auditor's MOST appropriate course of action?

Answer options:

A.

Issue a disclaimer of opinion due to a scope limitation.

B.

Perform procedures at the service organization to obtain sufficient appropriate audit evidence.

C.

Rely on the service organization's management representation letter.

D.

Assess control risk at maximum and perform only substantive analytical procedures.

How to approach this question

If you can't get a report (SOC 1), you have to do the work yourself. Go to the source.

Full Answer

B.Perform procedures at the service organization to obtain sufficient appropriate audit evidence.✓ Correct
AU-C 402 states that if the auditor cannot obtain sufficient evidence from the user entity's records or a SOC report, the auditor should perform procedures at the service organization (or request the service auditor to perform specific procedures) to obtain the necessary evidence.

Common mistakes

Jumping straight to a scope limitation (Disclaimer) without trying to perform the procedures.

Practice the full CPA AUD Practice Exam 2

78 questions · hints · full answers · grading

More questions from this exam