Nonprofit organizations increasingly rely on third-party vendors to run key business processes. These vendors, known as service organizations, often handle activities that impact internal control over financial reporting. When that happens, the nonprofit’s auditor becomes a user entity auditor, and the nonprofit becomes a user entity.
If the services provided by a service organization affect internal control over financial reporting, the user entity auditor must follow specific requirements under AU-C 402, Audit Considerations Relating to an Entity Using a Service Organization. This article explains how auditors identify service organization involvement, what AU-C 402 requires, and how SOC 1 reports are commonly used to support audit planning and evidence.
Common Examples of Service Organizations Used by Nonprofits
Service organizations are used for many reasons, including staffing constraints, specialized expertise, and cost efficiencies. Auditors should be alert to the most common outsourced processes, such as:
- Payroll processing
- Managed IT security
- Data center hosting
- Accounting software providers
- Bill payment automation
- Employee benefits administration
- Human resource administration
- Donor database and donor management platforms
- Endowment fund accounting
- Fundraising administration
- Grant management software providers
Practical consideration: Auditors should be familiar with AU-C 402.03 through .05 to determine whether a vendor’s services fall within the scope of the standard.
Auditor Responsibilities Under AU-C 402
When a service organization’s services are relevant to internal control over financial reporting, AU-C 402 requires the auditor to achieve two key objectives:
1. Obtain an Understanding of the Services and Their Effect on Internal Control
The auditor must understand the nature and significance of the services and how they affect the user entity’s system of internal control. This includes considering:
- The nature of the services provided and their significance to the user entity
- The materiality of the transactions or reporting processes affected
- The nature of the relationship and the degree of interaction between the service organization and the user entity
This understanding supports proper identification and assessment of risks of material misstatement.
2. Respond Adequately to Identified Risks
After assessing the risks, the auditor must design and perform audit procedures that respond appropriately to those risks.
If the auditor cannot obtain sufficient information through the user entity alone, AU-C 402 provides alternatives. One common approach is to obtain and evaluate a System and Organization Controls report, commonly referred to as a SOC report.
SOC 1 Reports and Why Auditors Use Them
SOC 1 reports are issued by a service auditor engaged by the service organization. SOC 1 engagements are performed under AT-C 320 and focus on controls relevant to user entities’ internal control over financial reporting.
SOC reports are typically provided to the user entity by the service organization and may also be requested from the service organization if not readily available.
SOC 1 Type 1 vs Type 2: What’s the Difference
The service auditor will issue either a Type 1 or Type 2 SOC 1 report.
SOC 1 Type 1
A Type 1 report addresses:
- The fairness of management’s description of the system
- The suitability of the design of controls
- As of a point in time
SOC 1 Type 2
A Type 2 report addresses:
- The fairness of management’s description of the system
- The suitability of the design of controls
- The operating effectiveness of controls
- Over a period of time
A Type 2 report provides broader coverage because it includes testing of operating effectiveness. If the user auditor expects to rely on controls as operating effectively, a Type 1 report cannot serve as sufficient audit evidence for operating effectiveness.
Practical consideration: Guidance suggests a report period covering at least nine months of the user entity’s financial statement period may be relied upon, and in some cases multiple reports may be needed to cover the full period.
Subservice Organizations: Carve-Out vs Inclusive Method
Service organizations may rely on subservice organizations to perform parts of the process. SOC 1 reports will address subservice organizations using one of two approaches:
Carve-Out Method
- Controls at the subservice organization are not included in the SOC examination scope
- For Type 2 reports, operating effectiveness at the subservice organization is not covered in the opinion
This is more common.
Inclusive Method
- Subservice organization controls and activities are included in the scope of the SOC engagement
When a carve-out is used, the user auditor should evaluate what that omission means for the user entity’s internal control over financial reporting and determine what additional procedures are needed.
Complementary User Entity Controls
SOC 1 reports may list complementary user entity controls. These are controls that the service organization assumes the user entity has implemented because they are necessary to achieve the control objectives described.
If complementary controls are identified, the user auditor should evaluate whether the user entity has implemented them and determine how they affect the audit approach and reliance on the SOC report.
Key Considerations When Using SOC 1 Reports as Audit Evidence
When relying on a SOC 1 report, auditors should consider:
- Whether the opinion is qualified
- How the Type 2 report period aligns with the period under audit
- The service auditor’s independence and competence
- Whether the report uses carve-out or inclusive method for subservice organizations
- Whether the report provides sufficient evidence for understanding controls and operating effectiveness
- The presence and implementation of complementary user entity controls
- Whether the standards used for the report are appropriate
Practical consideration: Type 2 reports are generally most useful when they address a substantial portion of the user entity’s financial statement period.
Audit Deficiencies Continue to Be Identified
Peer review findings continue to show recurring deficiencies when service organizations are involved. Common issues include:
- Failure to document an understanding of service organization controls impacting the client
- Weak documentation of SOC 1 report evaluation
- Incomplete evaluation of complementary user entity controls
Practical consideration: Some nonprofit audit methodologies include specific forms and templates to document service organization procedures and SOC 1 analysis, helping auditors meet AU-C 402 requirements more consistently.
As nonprofits continue to outsource key business processes, auditors must be prepared to identify service organizations that affect internal control over financial reporting and comply with AU-C 402. Obtaining a clear understanding of outsourced services, assessing related risks, and properly evaluating SOC 1 reports, subservice organization scope, and complementary user entity controls are essential steps for a compliant and well-supported audit approach.
A consistent, well-documented AU-C 402 process helps reduce peer review findings, strengthens audit quality, and supports reliable financial reporting for nonprofit stakeholders.
