Relying on a Qualified SOC 1 Report With a Five-Month Gap
You are planning the audit of Northwind's claims processing, which is outsourced to a third-party administrator (TPA). The TPA provides a SOC 1 Type 2 report covering the prior calendar year. The opinion is unqualified for three of four control objectives. The fourth - timely and accurate adjudication of pharmacy claims - is qualified because of an exception in a sample of 25 claims (2 deviations). The report period ends five months before Northwind's fiscal year-end. The TPA refuses onsite visits and will not issue a bridge letter, citing contractual confidentiality. Northwind processes 1.2 million claims a year, pharmacy claims are 30% of volume, and the contract sets a 98% accuracy service level. Internal audit has 90 hours for this area and no IT audit resource for four months.
1. Assess whether internal audit can rely on the SOC 1 report, and justify the conclusion.
Read the worked answer
Rely selectively, and not on the qualified objective.
Unqualified objectives: reliance is reasonable if you (a) confirm the report covers the actual systems and processes Northwind uses, (b) confirm the complementary user entity controls (CUECs) listed in the report are in place at Northwind, and (c) have a basis for the gap period. Reliance is on the TPA's controls plus Northwind's own monitoring - neither alone is sufficient.
Qualified objective - do not rely. Two deviations in 25 items, where the control objective is precisely the accuracy assertion you need for 30% of claim volume, is a failed control, not a rounding issue. Read the deviation description to determine whether it reflects a design flaw or an isolated operating lapse; either way, coverage of pharmacy adjudication must come from elsewhere.
Gap period (five months): the report gives no evidence for the period closest to year-end. Compensating sources: the TPA's own incident and performance reporting, Northwind's monthly SLA scorecards, and any interim subservice-organization reports. Absent a bridge letter, reliance cannot be extended across the gap without alternative evidence.
Document the reasoning - a bare "SOC 1 received, no issues" is not a conclusion.
2. Design alternative procedures for pharmacy claims within the 90-hour limit and without IT audit support.
Read the worked answer
Work on data Northwind already owns and on detective controls, not on the TPA's environment.
- Test Northwind's monitoring controls: obtain the monthly SLA reports and evidence that someone with authority reviews them and challenges breaches. Vouching to the contract's 98% threshold shows whether the monitoring is real or ceremonial.
- Analytics on the claims data file Northwind retains: duplicate claims, paid amounts inconsistent with the contracted fee schedule, adjudication turnaround outliers, and concentration by pharmacy or claimant.
- Post-payment audit results: Northwind's own recovery audits are direct evidence about the accuracy population - test a sample of their results and re-perform a handful of decisions.
- Complaint and appeal logs: independent evidence of adjudication errors that the SLA may not capture.
- Direct enquiry of the TPA in writing on the two deviations, their cause, and remediation - documentary, so the confidentiality clause is not breached.
- Confirm CUECs are operating at Northwind, including eligibility-file reconciliation and access controls.
Sequence the highest-value procedures first so the 90 hours produce a defensible conclusion even if the budget expires.
3. After these procedures the evidence on pharmacy adjudication is still incomplete. What do you report, and to whom?
Read the worked answer
Do not resolve the gap by defaulting to the SOC 1 report. Report a scope limitation on that component.
In the engagement communication: describe the area affected (pharmacy claims, 30% of volume), the reason (qualified SOC 1 objective, five-month period gap, no onsite access or bridge letter), the procedures performed and what they did and did not establish, and the residual risk in plain terms. Avoid a blanket "unqualified" conclusion over an area you could not evidence.
To the audit committee and senior management: explain the monitoring deficit as a governance issue, not an audit technicality - Northwind is contractually paying for a 98% SLA and has no reliable evidence of achievement for five months. Recommend a contract amendment requiring an annual bridge letter and onsite or virtual inspection rights at renewal.
To the external auditor: share the reliance analysis proactively so they are not surprised and do not assume internal audit covered adjudication accuracy.
Workpaper: record the judgment, the alternatives considered, and why the limitation could not be eliminated within available resources.