ASA 402 - Audit Considerations Relating to Entities Using Service Organisations - April 2006

Administered by Department of the Treasury

Legislation au F2006L01379 Not in force Legislative Instrument

Legislation content

 (April 2006)

 

 

 

 

Explanatory Statement

 

ASA 402 Audit Considerations Relating to Entities Using Service Organisations

 

 

Issued by the Auditing and Assurance Standards Board

 

Explanatory Statement

Reasons for Issuing ASA 402 Audit Considerations Relating to Entities Using Service Organisations

The Auditing and Assurance Standards Board (AUASB) issues Auditing Standard ASA 402 Audit Considerations Relating to Entities Using Service Organisations due to the requirements of the legislative provisions explained below.

The Corporate Law Economic Reform Program (Audit Reform and Corporate Disclosure) Act 2004 established the AUASB as an independent statutory body under section 227A of the Australian Securities and Investments Commission Act 2001, as from 1 July 2004. Under section 336 of the Corporations Act 2001, the AUASB may make Auditing Standards for the purposes of the corporations legislation. These Auditing Standards are legislative instruments under the Legislative Instruments Act 2003.

Process of making Auditing Standards

Section 1455 of the Corporations Act 2001 and Corporations Regulation 10.5.01 gave interim legal endorsement from 1 July 2004 to the majority of Auditing Standards made by the former Auditing & Assurance Standards Board of the Australian Accounting Research Foundation. The AUASB has reviewed the Auditing Standards and has proceeded to make them as legally enforceable Auditing Standards under the Corporations Act 2001.

The Auditing Standards have been made also in accordance with the Financial Reporting Council’s Strategic Direction to the AUASB dated 6 April 2005, pursuant to section 225 of the ASIC Act.

The Strategic Direction, inter alia, provides that the AUASB develops Auditing Standards that:

  • have a clear public interest focus and are of the highest quality;
  • use the International Standards on Auditing (ISAs) of the International Auditing and Assurance Standards Board (IAASB) as a base;
  • conform with the Australian regulatory environment; and
  • are capable of enforcement.

In implementing the Strategic Direction, the AUASB has undertaken a process of thorough review and revision that has:

  • addressed the enforceability of mandatory requirements;
  • clarified auditors’ obligations under the Auditing Standards;
  • provided for sector neutrality in the Auditing Standards; and
  • included other amendments as necessary.

Purpose of Auditing Standard ASA 402 Audit Considerations Relating to Entities Using Service Organisations

The purpose of Auditing Standard ASA 402 is to establish mandatory requirements and to provide explanatory guidance to an auditor where the entity uses a service organisation.

Auditing Standard ASA 402 is to be read in conjunction with the Preamble to AUASB Standards, which sets out the intentions of the AUASB on how the Auditing Standards are to be understood, interpreted and applied.

Operative Date

This Auditing Standard is operative for financial reporting periods commencing on or after 1 July 2006.

Main changes from Auditing Standard AUS 404 (July 2002) Audit Implications Relating to Entities Using a Service Entity

The main differences between ASA 402 and AUS 404 are that in ASA 402:

  1. The word ‘shall’, in the bold-type paragraphs, is the terminology used to describe an auditor’s mandatory requirements, whereas an auditor’s degree of responsibility is described in AUS 404 by the word ‘should’.
  2. The explanatory guidance paragraphs provide guidance and illustrative examples to assist the auditor in fulfilling the mandatory requirements, whereas in AUS 404 some obligations are implied within certain explanatory paragraphs. Accordingly, such paragraphs have been redrafted to clarify that the matter forms part of the explanatory guidance.
  3. The application is extended to cases where the service organisation uses the services of a sub-service organisation.
  4. The following additional mandatory requirements are included (these mandatory requirements are either not contained in AUS 404 or have been expanded or re-worded in this Auditing Standard):

(a)                The auditor shall consider how an entity’s use of a service organisation affects the entity’s internal control so as to identify and assess the risk of material misstatement and to design and perform further audit procedures (paragraph 5). In AUS 404, the auditor should assess the effect that a service entity has on audit risk to enable the auditor to plan and develop an effective audit approach.

(b)                In obtaining an understanding of the entity and its environment, the auditor shall determine the significance of service organisation activities to the entity and the relevance to the audit (paragraph 9).

(c)                If the auditor concludes that the activities of the service organisation are significant to the entity and relevant to the audit, the auditor shall obtain a sufficient understanding of the entity and its environment, including its internal control, to identify and assess the risks of material misstatement and design further audit procedures in response to the assessed risk (paragraph 13).

(d)                If the auditor uses the report of a service organisation auditor, the auditor shall consider the professional competence of that auditor in the context of the specific assignment undertaken by the service organisation auditor (paragraph 17).

(e)                When using a service organisation auditor’s report, the auditor shall consider the nature of and content of that report (paragraph 19).

(f)                 The auditor shall consider the scope of work performed by the service organisation auditor and shall evaluate the usefulness and appropriateness of reports issued by the service organisation auditor (paragraph 21). In AUS 404, when the auditor uses a report issued by the service entity auditor, the user auditor should consider the scope of the work performed and assess whether the report is sufficient and appropriate for its intended use by the user auditor.

(g)                For those specific tests of control and results that are relevant, the auditor shall consider whether the nature, timing and extent of such tests provide sufficient appropriate audit evidence about the operating effectiveness of the internal control to support the auditor’s assessed risks of material misstatement (paragraph 24). In AUS 404, for those specific tests of control that are relevant, the user auditor should consider whether the nature, timing and extent of such tests by the service entity auditor provide sufficient appropriate audit evidence about the effectiveness of the design and operation of the internal control structure to support the user auditor’s assessed level of control risk.

(h)                When the auditor uses a report from the auditor of a service organisation, no reference shall be made in the entity’s auditor’s report to the auditor’s report on the service organisation (paragraph 27).

5.                   The mandatory requirements contained in paragraphs .21, .25 and .30 of AUS 404 are not included.

Consultation prior to issuing this Auditing Standard

The AUASB has consulted publicly as part of its due process in developing this Auditing Standard. Exposure Draft ED 16/05 Proposed Auditing Standard: Audit Considerations Relating to Entities Using Service Organisations (Re-issuance of AUS 404) was issued on 28 October 2005 with a 45 day comment period. Submissions were received by the AUASB and it has considered these submissions as part of the development and finalisation of this Auditing Standard.

Overview

The Auditing and Assurance Standards Board (AUASB) issued Auditing Standard ASA 402 Audit Considerations Relating to Entities Using Service Organisations in 2006, addressing the need for mandatory requirements and guidance for auditors dealing with entities that use service organisations. The standard was enacted under the Corporate Law Economic Reform Program (Audit Reform and Corporate Disclosure) Act 2004, which established the AUASB as an independent statutory body. The purpose of ASA 402 is to establish clear, enforceable requirements for auditors when entities utilise service organisations, ensuring that auditors identify and assess risks of material misstatement effectively. The standard applies to financial reporting periods commencing on or after 1 July 2006 and builds upon previous standards, enhancing clarity and enforceability. It mandates specific actions for auditors, including considering how the use of a service organisation affects internal control and assessing the significance of the service organisation's activities to the audit. Additionally, it clarifies auditors' obligations when using reports from service organisation auditors, ensuring that these reports are appropriately evaluated and considered in the audit process.

Scope and Application

Auditing Standard ASA 402 Audit Considerations Relating to Entities Using Service Organisations applies to auditors of entities that engage the services of a service organisation. This includes auditors of public and private companies, partnerships, and other entities as defined under the Corporations Act 2001. The standard is operative for financial reporting periods commencing on or after 1 July 2006, and it is a legislative instrument made under the Corporations Act 2001. The standard provides mandatory requirements and explanatory guidance for auditors when an entity uses a service organisation, and it extends to cases where the service organisation itself uses the services of a sub-service organisation. Auditors must consider the effect of the service organisation on the entity’s internal control, obtain a sufficient understanding of the entity’s environment, and evaluate the reports of service organisation auditors to ensure the adequacy of audit evidence. This Auditing Standard is part of a broader legislative framework aimed at ensuring the quality and enforceability of auditing standards in Australia, reflecting the public interest focus and sector neutrality as outlined in the Financial Reporting Council’s Strategic Direction.

Key Provisions

Auditing Standard ASA 402 Audit Considerations Relating to Entities Using Service Organisations (ASA 402) sets out the mandatory requirements and provides explanatory guidance for auditors when entities use service organisations. Key provisions include the requirement for auditors to consider the impact of the service organisation on the entity's internal control, to determine the significance and relevance of service organisation activities to the audit (Sections 5, 9, and 13). Auditors must also assess the professional competence of the service organisation auditor and the nature and content of their reports (Sections 17 and 19). Furthermore, auditors must evaluate the usefulness and appropriateness of the service organisation auditor's reports, as well as the scope of work performed (Sections 21 and 24). Auditors are prohibited from making references to the service organisation auditor’s report in their own audit report (Section 27). The obligations imposed by ASA 402 on auditors include a thorough assessment of how service organisations affect the entity's internal control to identify and mitigate the risk of material misstatement. Auditors must also obtain a sufficient understanding of the entity's environment and internal control if the service organisation's activities are significant and relevant to the audit. Additionally, auditors must evaluate the professional competence of service organisation auditors and the adequacy of their reports and the scope of their work. Failure to comply with ASA 402 may result in various consequences. While the Auditing and Assurance Standards Board (AUASB) does not specify explicit penalties for non-compliance with ASA 402, breaches may lead to scrutiny from regulatory bodies, including the Australian Securities and Investments Commission (ASIC). Such scrutiny could potentially result in enforcement actions, including fines and other penalties under the Corporations Act 2001. Additionally, non-compliance may also result in legal liability for negligence, misrepresentation, or failure to meet professional standards. The maximum penalties for corporate offences under the Corporations Act 2001 can include substantial fines for both individuals and corporations, as well as potential imprisonment for serious offences. The exact penalties would depend on the specific breach and the discretion of the court.

Legal classification tags

Area of Law
Corporate Law & Governance
Instrument
Regulation
Concepts
Definitions & Interpretation
Regulatory Standards
Compliance Obligations

Interactions

Authorises

All Versions

Sourced from the Federal Register of Legislation at 26 August 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au.