The SOC 2 Report With a Carve-Out
Internal audit is planning to rely on a payroll SaaS provider's SOC 2 Type II report for the financial statement audit. The report covers a nine-month period that ended 14 months ago; the current period is covered only by a vendor bridge letter that states 'no material changes' without evidence. The report uses the carve-out method and lists four complementary user entity controls, including access recertification and review of configuration changes. The vendor reported one exception: four of 60 sampled changes lacked evidence of testing, and management states it has 'retrained staff.' Payroll affects 12,000 employees and EUR 310 million in annual pay. The audit committee wants to reduce planned substantive testing by 40% based on the report. The vendor will not permit a site visit before year-end.
1. Can internal audit rely on the SOC 2 report? What is the defensible reliance decision?
Read the worked answer
Partial reliance is possible, but not the 40% reduction requested. The report is nine months long and ends 14 months ago, leaving a five-month gap in the audit period; a bridge letter asserting 'no material changes' without evidence is not sufficient for a payroll process of this significance. The carve-out method excludes subservice organizations, so obtain a complementary subservice report or perform alternative procedures. The four CUECs-access recertification and configuration change review among them-must be tested at the user entity, because the vendor assumes they operate. The change-management exception (4 of 60) is not automatically material, but 'retrained staff' is not evidence of remediation. Decision: rely on the report for the design and operating effectiveness of in-scope controls only after (a) obtaining a current bridge letter with evidence, (b) testing the CUECs, (c) performing roll-forward procedures for the gap, and (d) expanding change testing. Do not reduce substantive testing by 40%; reduce it only in areas where both the report and CUECs are clean.
2. Design the additional procedures, including the sample response to the change-management exception.
Read the worked answer
Design around the exception and the gap. For change management, obtain the population of changes for the full audit period, not just the vendor's sample; select a risk-based sample stratified by emergency, major, and routine changes, and test approval, testing evidence, and segregation of duties. If the vendor's exception suggests a population-wide evidence gap, increase the sample or use a full-population data analytics test for missing fields. For the gap period, perform roll-forward procedures: inspect a sample of changes, access recertifications, and incident tickets, and obtain a management representation. Test the four CUECs at the user entity, especially quarterly access recertification, and verify that terminated employees were removed. Use a control owner outside payroll if possible. Document the reliance decision and the residual risk. The judgement is that a clean opinion on a stale period does not cover the current period; the audit response must be proportional to the significance of payroll and the weakness of the bridge evidence.
3. How should the finding be classified and communicated to the audit committee, given the committee's desire to reduce testing?
Read the worked answer
Report the reliance limitation and the control exception as an internal audit issue, even if the financial statement audit concludes no misstatement. Classify severity by likelihood and impact: payroll is significant, so a population-level change-testing gap is at least a significant deficiency if it could affect pay accuracy or unauthorized changes; it becomes material weakness only if there is a reasonable possibility of material misstatement. Avoid collapsing it into 'vendor issue'-the user entity's CUECs and monitoring are part of the control environment. Draft a finding with condition, criteria, cause, effect, and recommendation; require a management action plan with an owner and date. Communicate to the audit committee in plain language: what we could rely on, what we could not, and what we did instead. If management disagrees, include the disagreement. The professional judgement is to protect the committee from a false comfort that the SOC 2 report alone provides assurance.