Auditor Responsibilities for Audits with Service Organizations: What Nonprofit Auditors Need to Know Under AU-C 402
Nonprofits frequently outsource essential operations such as payroll, IT security, and donor management to third-party service organizations. When those services affect internal control over financial reporting, auditors must follow the requirements of AU-C 402. This article explains how user entity auditors evaluate service organization involvement, review SOC 1 reports, and address issues like subservice organizations and complementary user entity controls.





