When an audit client outsources payroll, bookkeeping, investment custody or its accounting system to a third party, ISA (UK) 402 requires the auditor to understand what that service organisation does and how it affects the client’s controls, then obtain evidence from the client’s own records and controls, from a type 1 or type 2 controls report, or from work at the service organisation. A type 1 report covers design at a point in time only; a type 2 report also tests operating effectiveness over a period and is the usual basis for relying on the provider’s controls.

Which outsourced services does ISA (UK) 402 cover?

ISA (UK) 402 paragraph 3 says a service organisation’s services are relevant to the audit when they, and the controls over them, form part of the client’s information system relevant to preparing the accounts. That includes services that affect how transactions are initiated, recorded and processed, the accounting records themselves, the financial reporting process and the related IT environment. Paragraph A4 gives examples: maintaining the client’s accounting records, managing its assets, and initiating, recording or processing transactions as its agent. Paragraph A3 includes application service providers that supply packaged software and a technology environment for processing transactions.

Typical UK examples are a payroll bureau, an outsourced bookkeeper, a hosted accounting or billing system, an investment manager or custodian, and a shared service centre. Paragraph 5 excludes a bank that simply processes transactions the client has specifically authorised on its own account, and a broker processing securities trades. Paragraph A5 confirms that a small company using a bookkeeping service, even to prepare its accounts, does not pass its responsibility for those accounts to the bookkeeper. Firms on the other side of the arrangement will find the provider’s duties in running a payroll bureau.

What must the auditor understand about the arrangement?

Paragraph 9 requires the auditor to understand the nature and significance of the services and their effect on internal control; the nature and materiality of the transactions and accounts affected; the degree of interaction between the client and the provider; the contractual relationship; and, in a UK addition, whether the arrangements affect the auditor’s reporting on accounting records required by law.

Paragraph A7 explains interaction. Where the client authorises transactions and the provider processes them, the client can usually operate effective controls itself. Where the provider initiates, records and accounts for transactions, the client may have to rely on controls at the provider. Paragraph A8 lists contract terms worth reading, including whether a type 1 or type 2 report will be provided, whether the auditor has access to records held by the provider, and whether the auditor may communicate directly with the service auditor.

Paragraph 10 requires the auditor to identify the client’s own controls over the outsourced service and evaluate their design and implementation. For payroll, paragraph A12 suggests comparing data sent to the bureau with the reports returned, recomputing a sample of pay, and reviewing the total for reasonableness. Those client controls, described further in internal controls for small businesses, are often the cheapest source of evidence.

What is the difference between type 1 and type 2 reports?

Type 1 report Type 2 report
Covers Description and design of controls as at a specified date Description, design and operating effectiveness of controls throughout a specified period
Service auditor’s opinion On the description and suitability of design On description, design and operating effectiveness, plus a description of tests performed and results
Evidence that controls worked None (paragraph A22) Yes, for the period and controls tested

The definitions are in paragraph 8(b) and 8(c). Paragraph A16 says these reports may be issued under ISAE 3402 or under other recognised standards that may use different names. Before relying on either, paragraph 13 requires the auditor to be satisfied about the service auditor’s competence and independence and the adequacy of the standards used.

Both reports usually list complementary user entity controls. Paragraph 8(a) defines these as controls the provider assumes its customers will operate. Paragraph A36 gives an example: the service may assume the client authorises transactions before sending them for processing. Paragraphs 14(c) and 17(b) require the auditor to identify which are relevant, check the client has them, and, when relying on a type 2 report, test them.

When does the auditor need a type 2 report?

Paragraph 16 applies when the auditor’s risk assessment expects controls at the provider to operate effectively. Evidence must then come from a type 2 report, tests of controls at the provider, or another auditor testing them on the auditor’s behalf. Paragraph 17 requires the auditor to evaluate whether the period covered suits the audit, test any relevant complementary user entity controls, consider the time elapsed since testing, and check that the tests are relevant to the client’s assertions.

Paragraph A32 says a report with little overlap with the client’s financial year gives less evidence, and paragraph A35 says a report whose testing period falls completely outside the year cannot on its own support reliance. Paragraphs A33 and A34 suggest obtaining evidence about changes outside the report period, for example by extending tests or testing the client’s monitoring.

If the auditor cannot get enough understanding from the client, paragraph 12 lists the options: a type 1 or type 2 report, contacting the provider through the client, visiting the provider, or using another auditor. Paragraph A18 suggests that where a whole finance function is outsourced and no report exists, a visit may be the most effective route.

Can the auditor manage without any controls report?

Often, yes. Paragraph 15 requires the auditor first to consider whether sufficient evidence is available from records held at the client, and only if not to perform procedures at the provider. Paragraph A26 sets out the options and their weaknesses. Confirmations from the provider are reliable only where the client keeps independent records to compare them with; otherwise a confirmation merely repeats the provider’s own records. Analytical procedures on reports from the provider can also help, depending on the assertion and detail available.

Where the provider itself uses another provider, such as a payroll bureau hosting its system with a data centre company, paragraph 18 requires the auditor to apply the standard to that subservice organisation if its services are relevant and the report excludes them.

Does outsourcing affect the duty to keep accounting records?

Companies Act 2006 section 386 requires every company to keep adequate accounting records, and section 498 requires the auditor to form an opinion on whether it has done so and to report if not. Paragraph A11-3 of ISA (UK) 402 points out that UK company law appears to require the company itself to keep the records, so whether it “keeps” them, rather than causing them to be kept, depends on the outsourcing terms, in particular whether the company owns, can access or holds copies of them. Paragraph A11-2 suggests that where there is doubt, the auditor may encourage the directors to take legal advice before the report is signed. Section 499 gives the auditor a right to information and explanations from any person holding or accountable for the company’s books. Our page on accounting records requirements covers the underlying rules.

Illustration: a payroll bureau with a type 2 report

Illustration only. A manufacturer with a year end of 30 September 2026 outsources payroll for 80 staff to a bureau. The bureau provides a type 2 report covering 1 April 2025 to 31 March 2026, so only the first six months of the client’s year are covered.

  • The auditor checks who the service auditor is and which standard the report uses, then reads the control objectives over payroll calculation, data input and access, noting two exceptions and the bureau’s response.
  • The report lists two complementary user entity controls: the client authorises starters, leavers and pay changes, and reviews the bureau’s exception report each month. The auditor tests both at the client.
  • For the uncovered six months, the auditor asks the bureau, through the client, about changes to its system and staff, and performs a proof in total of payroll cost.

What does it mean for the audit report?

Paragraph 19 requires the auditor to ask management whether the provider has reported any fraud, non compliance with laws or uncorrected misstatements, and to consider the effect. If the auditor cannot obtain sufficient appropriate evidence about relevant outsourced services, paragraph 20 requires a modified opinion under ISA (UK) 705, explained in audit opinions. Paragraph 21 prohibits referring to the service auditor’s work in an unmodified report unless law or regulation requires it.

Common mistakes include accepting a type 1 report as evidence that controls worked, ignoring the gap between the report period and the year end, skipping the complementary user entity controls, and relying on a provider’s confirmation when the client keeps no independent records.

Solar Protect provides tax investigation insurance for businesses and fee protection schemes for accountancy practices. Read how our cover works or get a quote.

Related Accountapedia entries

Sources

Reviewed by Christine Anderson, Broker, Solar Protect. Last reviewed 19 October 2026. Part of Accountapedia, the Solar Protect guide to UK tax and accounting. This page is general information, not personalised advice.