Service auditors: map periods and customer controls
An outsourced payroll process does not remove the issuer’s financial-reporting responsibilities. A service auditor’s report can provide relevant evidence, but only for the systems, objectives, periods and tests it actually covers. The user’s own controls can leave a separate gap even when the provider’s report is satisfactory.
This guide concerns a PCAOB issuer audit and AS 2601 as displayed on October 25, 2026. The payroll provider, reports and controls in the example are fictional. No restricted service-auditor report has been obtained or represented as read. A public investor may know that a report exists without having enough access to assess its contents.
Identify the process and the type of evidence
AS 2601 .06–.12 links outsourced processing to the user’s information system and distinguishes understanding controls from evidence of operating effectiveness. A report describing controls placed in operation is not, by itself, evidence of their operation sufficient to reduce assessed control risk.
Start with the exact service legal entity, system, process, relevant assertion and report date or operating period. A report on a vendor’s security practices does not automatically establish evidence about the payroll calculations or financial-reporting controls relevant to this engagement.
Read whether the report includes tests of operating effectiveness, the tests actually performed, their timing, exceptions and any expected controls at the user. Do not infer these from a marketing statement saying the provider is “audited.”
The objective also matters. A payroll calculation control may address accuracy without establishing that every employee is authorized or that the issuer recorded the expense in the correct period. Match each claimed benefit to a particular financial-statement assertion.
Work two incomplete time windows
Assume the fictional issuer’s reporting period is January through December. Payroll is 10 per month, or 120 for the year, all in thousands. A relevant service-auditor report provides the assumed operating evidence for a specified provider control from January through September.
The report’s described arrangement also depends on a particular user review of authorized payroll changes. Assume this review was not performed during January–September and began, with supporting operating evidence, only in October–December. Assume both controls are necessary for the specific control-reliance conclusion being tested and that no other evidence has yet filled the gaps.
| Period | Provider-control evidence | Required user-review evidence | Specified combined chain evidenced? |
|---|---|---|---|
| January–September | Present for stated control | Missing; control not performed | No |
| October–December | Not covered by this report | Present | No |
The time union covers twelve months in a superficial calendar sense: nine months at the provider and three at the user. The required intersection is zero months under the stated evidence conditions. Adding 9 + 3 does not establish twelve months of the combined control chain.
The first window processes 90 of payroll and the last 30 under the equal-month assumption. Those are transaction amounts associated with the windows, not identified misstatements or losses. The example does not show that payroll expense of 120 is wrong.
Resolve each gap on its own terms
AS 2601 .13–.16 discusses user controls, evidence at the service organization and the combined evaluation, including the period covered by tests. Evidence supporting one part of the arrangement cannot automatically substitute for another required control.
For October–December, seek relevant evidence about the provider’s control operation for that period. This might involve an appropriate later report or other suitable procedures, assessed by the user auditor. A provider statement that nothing changed is a representation to evaluate, not a mechanical extension of all earlier tests.
For January–September, a later provider report does not repair the absent user review. Determine whether another effective control or other audit evidence addresses the relevant risk. If the review never existed, a later signature on a recreated checklist cannot prove contemporaneous operation.
Suppose a later report supplies appropriate provider evidence for October–December. The final quarter may then have both required components under the exercise’s assumptions. The first nine months still lack the specified user component. Correcting one gap does not turn the original year into fully supported control reliance.
The auditor may alter substantive procedures instead of relying on that control chain. A control-evidence gap is not itself a calculated payroll misstatement or an automatic opinion modification. The ultimate question includes whether sufficient appropriate evidence can be obtained through the relevant procedures.
A single-date report changes the evidence mechanism
In a separate hypothetical case, a provider report describes controls placed in operation at September 30 without operating-effectiveness testing for a period. It can help the user auditor understand the arrangement, but it is not nine months of operating evidence.
The difference is not merely that three months are missing. The evidence type itself differs. A spreadsheet that fills January–September with “covered” because the report is dated September 30 misstates what was examined.
A report issued in November can still cover a period ending in September. Keep issuance date and covered period in different fields. Counting from the report’s publication date would create another incorrect window.
A system migration changes the population
Now suppose payroll migrates from System A to System B on October 1. A report covering System A cannot automatically support System B because the vendor’s legal name remains unchanged.
Identify transferred data, new configuration, authorization roles, interfaces and relevant processing controls. A report for a different product or service organization needs an explicit relevance assessment. The current system’s name in a procurement list does not prove its financial-reporting control coverage.
Similarly, a control tested for one customer configuration may not address an issuer-specific customization. Record what is standardized and what depends on user setup. Treat the missing setup evidence as a scope question, not as an excuse to assume failure or success.
Keep service work separate from divided audit responsibility
AS 2601 .14–.21 keeps the user auditor responsible for evaluating the evidence and explains why the service auditor’s report is not cited as a partial basis for the user’s financial-statement opinion under this arrangement.
This differs from the divided-responsibility relationship described in an audit-participant filing. A service provider may have a control report without another firm having audited a defined portion of the issuer’s financial statements. Do not turn vendor assurance into an invented asset-coverage percentage.
The report’s restrictions and distribution conditions also matter for access. An investor unable to read it should record the provider’s or issuer’s public description as an attributed statement. The absence of access is not proof that the report contains exceptions, but it prevents claiming the report’s detailed tests were verified.
Execute a control-and-period matrix
| Field | Evidence to obtain | Inference prevented |
|---|---|---|
| Service identity | Legal provider, system and process | Brand treated as universal scope |
| Objective | Relevant assertion and control | Security label treated as accounting assurance |
| Evidence type | Design or operation, tests and results | Single-date description treated as annual testing |
| Period | Start, end and issue date | Publication date treated as coverage |
| User responsibilities | Specified review and operation records | Provider report replacing required user work |
| Exceptions | Nature, affected controls and follow-up | “Report exists” treated as a clean result |
| Gap response | Additional work and remaining limits | Calendar union treated as combined evidence |
Public disclosures may identify outsourced payroll, dependence on a provider or a control issue. Detailed reports, user review logs and service testing often remain private. State which matrix cells are public, privately verified by authorized parties, or unavailable to the researcher.
When documents conflict, align system version, customer scope, period, control objective and whether an exception was actually remediated. A planned remediation date is not evidence that the control operated throughout the earlier window.
Update the matrix when a new report, migration, changed user control, exception follow-up or additional procedure becomes available. Preserve the old gap rather than silently replacing it with the latest report date. The conclusion should describe the particular supported chain and the evidence still needed.
Record test frequency, not only the calendar interval
A report’s nine-month period does not mean every transaction or every execution was tested. A monthly provider control and a user approval required for each payroll change operate at different frequencies. Read the nature and extent of the reported tests before interpreting what the period contributes.
For example, three months of user operation records may contain twelve authorized changes. Retain the twelve-event population and the actual evidence rather than replacing it with a single “quarter covered” tick. A period matrix organizes evidence; it does not enlarge the service auditor’s test scope or eliminate exceptions.
FAQ
Do nine provider months plus three user months establish a full year?
No. Necessary controls must be supported for the relevant overlapping periods.
Does a service-auditor report eliminate the user auditor’s responsibility?
No. The user auditor must evaluate the report and other relevant evidence.