SA 402 explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.
When a company outsources payroll, accounting, custody or IT to another business, the auditor still has to be satisfied about the numbers that pass through that provider. SA 402 sets out how the auditor gains that comfort, and what happens if the evidence cannot be obtained.
SA 402, as effective for audits of financial statements for periods beginning on or after 1 April 2010, applies where an audited entity uses a service organisation. ICAI may revise standards, so check icai.org for the current text.
The "user auditor" must understand how the audited entity (the "user entity") uses the service organisation and the effect on its controls. If that understanding is not enough, the auditor can use a Type 1 or Type 2 report, contact or visit the provider, or use another auditor. Where the auditor plans to rely on controls at the provider, a Type 2 report or tests at the provider are needed. If sufficient evidence cannot be obtained, the opinion is modified. The auditor does not refer to the service auditor's work in an unmodified report unless law requires.
Scope (paragraphs 1-5)
SA 402 expands how the user auditor applies SA 315 and SA 330 when a user entity uses a service organisation (paragraph 1). Outsourced services range from a single task to taking over an entire function, such as tax compliance (paragraph 2). They are relevant to the audit only when the services, and the controls over them, are part of the user entity's information system relevant to financial reporting (paragraph 3). That is the case if the services affect the significant classes of transactions; the IT and manual procedures for initiating, recording, processing, correcting and reporting transactions; the related records; how non-transaction events are captured; the financial reporting process including estimates and disclosures; or controls over journal entries.
The extent of work depends on the nature and significance of the services and their relevance to the audit (paragraph 4). The SA does not apply to financial institution services limited to processing transactions specifically authorised by the entity in its own account, such as a bank processing a current account or a broker processing securities transactions, nor to transactions arising from proprietary interests in other entities, such as partnerships and joint ventures (paragraph 5).
Objectives and terms (paragraphs 7-8)
The objectives are to understand the nature and significance of the services and their effect on the user entity's internal control sufficiently to assess the risks, and to design procedures responsive to those risks (paragraph 7).
| Term | Meaning in plain words |
|---|---|
| User entity / user auditor | The audited entity that uses the service, and its auditor |
| Service organisation | A third party whose services are part of the user entity's reporting systems |
| Service auditor | An auditor who, at the provider's request, issues an assurance report on the provider's controls |
| Type 1 report | The provider's description of its system, control objectives and controls at a specified date, plus the service auditor's opinion on that description and the suitability of design |
| Type 2 report | As Type 1, but also covering operating effectiveness over a period, with a description of the service auditor's tests and results |
| Complementary user entity controls | Controls the provider assumes the user entity will have in place |
| Subservice organisation | A provider used by the service organisation |
Understanding the services (paragraphs 9-12)
The user auditor understands how the user entity uses the service, including (paragraph 9): the nature and significance of the services and their effect on internal control; the nature and materiality of the transactions or processes affected; the degree of interaction between the two organisations; and the relationship and contractual terms. The auditor evaluates the design and implementation of the user entity's own controls over the services, including those applied to the transactions processed (paragraph 10), and decides whether the understanding is sufficient to assess risks (paragraph 11).
If the understanding from the user entity is not sufficient, the auditor uses one or more of: a Type 1 or Type 2 report, if available; contacting the provider through the user entity; visiting the provider and performing procedures; or using another auditor (paragraph 12).
Using a Type 1 or Type 2 report (paragraphs 13-14)
The user auditor must be satisfied about the service auditor's professional competence (except where the service auditor is an ICAI member) and independence from the service organisation, and about the standards under which the report was issued (paragraph 13). If the report supports the understanding of design and implementation, the auditor evaluates whether its date or period suits the audit, whether it gives sufficient appropriate evidence about internal control, and whether complementary user entity controls are relevant and in place (paragraph 14).
Responding to risks (paragraphs 15-18)
The user auditor decides whether sufficient appropriate evidence on the relevant assertions is available from records held at the user entity; if not, the auditor performs further procedures or uses another auditor at the service organisation (paragraph 15).
Tests of controls. If the risk assessment expects the provider's controls to operate effectively, the auditor obtains evidence from a Type 2 report, tests at the provider, or another auditor (paragraph 16). Using a Type 2 report, the auditor evaluates whether the period and the elapsed time are suitable, whether complementary user controls are relevant and tested, and whether the service auditor's tests are relevant to the user entity's assertions and sufficient (paragraph 17).
Subservice organisations. If a report excludes a subservice organisation whose services are relevant, the user auditor applies the SA to those services as well (paragraph 18).
Fraud, non-compliance and uncorrected misstatements (paragraph 19)
The user auditor asks management whether the service organisation has reported, or management is otherwise aware of, any fraud, non-compliance with laws or uncorrected misstatements affecting the user entity's statements, and evaluates the effect on the further procedures, conclusions and the report. See SA 240 and SA 250.
Reporting by the user auditor (paragraphs 20-22)
If the user auditor cannot obtain sufficient appropriate evidence about services relevant to the audit, the opinion is modified under SA 705 (paragraph 20). In a report with an unmodified opinion the user auditor does not refer to the service auditor's work unless law requires it, and then states that the reference does not reduce the user auditor's responsibility (paragraph 21). A reference in a modified opinion, where relevant to understanding the modification, carries the same statement (paragraph 22). See SA 705.
What the audited company should do
Keep copies of contracts and service level agreements, ask the provider for its latest Type 1 or Type 2 report, check what the report says about controls that the company itself must run (the complementary controls), and keep records of reconciliations between the provider's outputs and the company's ledgers. For the information system view of controls, see SA 315 part 1 and SA 330. For help reviewing outsourced arrangements, see our virtual CFO services.
Illustrative example
Swift Logistics Pvt Ltd, an invented company, outsources payroll to PayWise Services. The payroll cost is material, and the provider calculates and pays salaries from data the company supplies. The auditor reads the contract, observes how the company approves the monthly payroll input and reviews PayWise's Type 2 report covering April to March. The report has two exceptions on access controls and lists a complementary control that the company must review the payroll register against HR records. The auditor tests that control at the company, finds it was not performed for three months, and therefore performs additional substantive procedures on payroll. Had no report existed, the auditor might have visited PayWise or used another auditor.
Need help with outsourced finance functions?
If your accounts, payroll or compliance functions sit with outside providers, TaxClue's virtual CFO services team can help you set up reconciliations and review routines that an auditor can rely on. Finance leaders can also use our virtual CFO services to check what reports the providers should supply.
Key takeaways
- Outsourced services matter to the audit when they are part of the information system relevant to financial reporting.
- Type 1 reports cover design at a date; Type 2 reports add operating effectiveness over a period.
- Complementary user entity controls are the company's job and are tested.
- Fraud or errors at the provider affect the audit procedures and report.
- If evidence cannot be obtained, the opinion is modified; the service auditor is not named in an unmodified report.
Read next
- SA 315, part 1: understanding the entity and its controls
- SA 330: responses to assessed risks
- SA 610: using the work of internal auditors
Disclaimer: Based on the Standards on Auditing and quality standards issued by the Institute of Chartered Accountants of India, in the versions named in the article, and ICAI's announcement of 31 March 2026 on SQM 1 and SQM 2, as consulted on 3 October 2026. ICAI revises standards from time to time; check the current text and effective dates on icai.org. This article is general information, not legal advice; check the official text before acting.