Hard1 markMultiple Choice
Area 2: Risk AssessmentAUDService OrganizationsSOC Reports

CPA · Question 23 · Area 2: Risk Assessment

An auditor is reviewing a client's use of a service organization for payroll processing. The auditor receives a Type 2 SOC 1 report. What does this report provide that a Type 1 report does not?

Answer options:

A.

A description of the service organization's system.

B.

Assurance that the controls are suitably designed.

C.

Assurance on the operating effectiveness of the service organization's controls over a period of time.

D.

An opinion on the fairness of the service organization's financial statements.

How to approach this question

Distinguish SOC 1 Type 1 (Design/Snapshot) vs Type 2 (Effectiveness/Movie).

Full Answer

C.Assurance on the operating effectiveness of the service organization's controls over a period of time.✓ Correct
Assurance on the operating effectiveness of the service organization's controls over a period of time.
A Type 2 report includes the service auditor's opinion on the fairness of the presentation of the description of the system AND the suitability of the design AND the operating effectiveness of the controls. A Type 1 report only covers design and description.

Common mistakes

Thinking Type 1 allows for control risk reduction (it doesn't).

Practice the full CPA AUD Practice Exam

78 questions · hints · full answers · grading

More questions from this exam