What is a Service Organization and how does our Association using one affect our audit?
A service organization is an entity that the Association may use to outsource aspects of its operations, such as payroll functions, sub metering utilities or collecting laundry income. In these instances, the internal control functions are being performed by an entity other than the Association or the management agent of the Association.
As the auditors for the Association, we are required to obtain an understanding of the Association’s internal controls. If the function being performed by the service organization is significant to the Association’s financial statements, then we are required by auditing standards to obtain an understanding of the service organization’s internal controls. This is a requirement of auditing standard AU-C Section 402, which went into effect for periods ending after December 15, 2012.
If a Service Organization Control (SOC) report is available, then we can use this report to obtain an understanding of the internal controls. If this report is not available, then our options would be to obtain an understanding on our own of the service organization’s internal controls, have another auditor obtain an understanding, or modify our audit opinion. The audit opinion modification would specifically state that we were unable to obtain an understanding of the internal controls of the service organization.