ISA 402 specifically excludes services provided by financial institutions that are limited to executing transactions specifically authorized by the entity using accounts held at the banking institution e.g. bank processing transactions from a current account or a broker executing transactions on behalf of the entity.
1. Identification of a service organisation
A service organization is a third-party organization that provides services to an entity that are relevant to the entity’s internal control as it relates to financial reporting.
Step 1: Is an external party used for initiation, recording and processing of transactions into the general ledger that are used to prepare the financial statements; or do the services of the external party affect the accounting records, specific accounts in the financial statements or other supporting documentation that are required for the preparation of the financial statements?
Step 2: Do the services of the external party affect significant account balances, classes of transaction, disclosures or other information in the financial statements?
Step 3: Can the external third-party exercise discretion / judgement when performing those services?
2. Understanding the nature of the services
In assessing the nature of the service(s) provided by the third-party organisation, it is important to inspect the terms of the contractual agreement (contract or service line agreement) between the user entity (i.e. the client) and the third party.
The lesser the interaction between the client and the third party, the more reliance is placed on the controls at the third party.
3. Degree of interaction and level of discretion and reliance
It is important to understand, based on the agreement, whether the third party is limited to executing transactions authorized by the client OR do they have discretion to make investment or operational decisions on behalf of the client.
Execution of transactions: If the third-party (for example a financial institution), acts on explicit instruction of the client to execute/process a transaction and the client authorises and reviews all activities à NOT a service organization under ISA 402 (ISA402.5 exception applies).
Discretion to make investment decisions: If the third party (for example a financial institution), performs valuation of investments and has the discretion to decide where and when to invest the client monies (unit trusts, private equity, etc), i.e. investment manager and those valuations are directly used by management in preparation of their financial statements (valuation and reporting) à Service organisation under ISA 402 (ISA402.5 exception does not apply).
Example of a service organisation
Money market account with bank (where the bank exercises investment services at their discretion)
A company invests funds into a money market account at the Bank who has full discretion when and where to invest the funds of the company. The company has no direct control / discretion over those investments. The Bank manages the investments and has full decision-making powers. This would be considered a service organisation under ISA 402 as the Bank is making decisions affecting the financial reporting and balances of the company, and reliance would therefore be placed on the bank's internal controls for audit purposes.
Example where it is NOT a service organisation
Bank Money Market Account (Processing Authorised Transactions)
The company deposits funds into a fixed deposit money market account with the Bank. The Bank’s role would be limited to processing the transactions (i.e., accepting deposits, crediting interest, and redeeming the funds), which would qualify for exemption under ISA 402.5.
