External auditors, in accordance with ISA 200, are responsible for expressing an independent opinion on the financial statements of the auditee. This entails obtaining reasonable assurance, adhering to International Standards on Auditing (ISA), exercising professional skepticism, and facilitating effective communication with those overseeing the organization. When auditees outsource functions such as Financial Reporting and Internal Control, it can significantly impact the accuracy and presentation of financial statements. ISA 402 provides guidance on addressing this by offering audit considerations for entities using service organizations.
It’s noteworthy that ISA, published by the International Audit and Assurance Standard Board (IAASB), aligns with local versions, like the Nigerian Standards on Auditing (NSA) and the International Standards on Auditing (UK), with minor variations specific to local concerns.
ISA 402, also known as NSA 13 in Nigeria and ISA-UK 402 in the UK, was recently updated in 2021 with minimal changes, largely in alignment with international standards. This standard highlights the user auditor’s role when an entity engages service organizations, emphasizing the significance of collecting relevant audit evidence, understanding the user entity, and assessing the risks of material misstatement.
Numerous organizations outsource various business functions, and certain services are integral to their operations and germane to the audit. Service organization services are relevant to the audit when they affect the user entity’s information system and financial statement preparation, including controls related to asset protection.
The nature and extent of the user auditor’s work related to service organizations are contingent on the services’ significance to the user entity and their relevance to the audit. Nevertheless, ISA 402 does not apply to specific financial institution services or proprietary financial interests in other entities.
Questions of concern arise when an external auditor undertakes a statutory financial audit of a company, referred to as the “user entity.” In this scenario, the auditee has outsourced significant functions, as mentioned earlier. In this context, the primary focus for the external auditor, while performing their duties in accordance with ISA 315 and ISA 330, is a critical consideration.
ISA 315 (Revised 2019) guides the auditor in understanding the user entity, including its internal control system relevant to financial statement preparation. However, with outsourced functions, the auditor must assess how these outsourced processes impact the user entity’s information system, financial reporting, and controls.
ISA 330, on the other hand, is integral to the audit process, addressing the auditor’s responsibilities in designing and implementing audit procedures to address identified risks. In the case of outsourcing, the auditor should direct their attention to those areas directly influenced by the outsourced functions, such as the flow of information, relevant controls, accounting records, and financial reporting processes.
Therefore, when outsourced processes are involved, the external auditor’s concentration should center on evaluating how these outsourced functions interplay with the user entity’s internal controls and information system, considering the risks and material misstatements that may arise. This ensures the audit effectively addresses the impact of outsourcing on the financial statement audit.
Readers are encouraged to stay informed about these standards through forthcoming publications and to direct any inquiries to info@kcp.com.ng. Thank you.