Home › CA Final › auditing › Special Aspects of Auditing in an Automated Environment › A cloud-based accounting application is hosted b…
A cloud-based accounting application is hosted by a third-party SaaS provider. Under SA 402, the auditor should obtain a:
AType 2 service organisation control (SOC) report covering the relevant period
BType 1 SOC report from any year
CLetter of comfort from the customer's CFO
DTax residency certificate of the SaaS vendor
Answer & Solution
Correct answer: A. Type 2 service organisation control (SOC) report covering the relevant period
1. Type 2 SOC reports cover both design and operating effectiveness over a period.
2. Type 1 reports are point-in-time and design-only; insufficient for reliance.
3. Letters and certificates do not address service-org control reliability.
_Source: ICAI BoS CA Final Paper 3, Ch 4 "Special Aspects of Auditing in an Automated Environment"_
Related questions
When evaluating an "Information Produced by the Entity" (IPE) report used as audit evidencA "single ID with admin privileges shared across the IT operations team" is a classic violA robotic process automation (RPA) bot performs three-way matching of PO/GRN/Invoice in thIn data-driven audit, the False-Positive Rate of an exception flag is HIGH. The auditor's Which of the following findings would most likely indicate a Material Weakness in IT generWhich is the BEST control to detect ghost employees in an automated payroll system?For Big Data analytics on the audit of a bank's loan portfolio, the MOST informative analyA company migrates ERP mid-year. Which audit consideration becomes MOST sensitive?