Over the last five years, auditing requirements have increased. Gone are the days of “that person that checks stuff once a year.” Service organisations are required to comply with legislative, statutory and regularity requirements. They also required to validate the completeness and accuracy of financial reporting.
Clients and their auditors will, therefore, find it difficult to gain comfort in how your service organisation controls critical financial outcomes without an Assurance Report (Type II engagement). This could then result in numerous client requests for information and/or multiple site visits.
An assurance report ensures that the service organisation has adopted a control environment mentality. In addition, there are numerous control objectives that break down the service to an end to end service process outcome. Within each control, the objective is a series of control activities, which essentially are quality gates that consistently ensure an accurate, timely and standardised controlled end to end process.
For example; the Payroll Outcome assurance environment may include controls incorporating;
- System Administration
- Payroll Processing
- Payroll Administration
- Release Management
- Product Development
- End of Financial Year
- Payroll Reporting
- Interface & Batch Management
The Aurion Process
Aurion Corporation embarked on this journey for our Business Process Outsourcing service (BPOS) in July 2014. This was in partnership with PricewaterhouseCoopers (PwC). In the beginning, the initial six months was initially focused on developing the control environment and undertaking a change management activity of technology, process and people. This was done to ensure the value, purpose and outcome of this undertaking was understood. Then in June 2015 we delivered our first ASAE3402 Type II report to our BPO client base, and is since published annually.
This set us up for success in many ways;
- Standard quality activities to achieve a timely and accurate quality process objective
- Consistent acceptance criteria
- Reduced the risk of processing inconsistency
- Provided our clients with clear controls that they needed to meet to ensure we (as their service provider) could provide accuracy and timely service
- And lastly, clients and their respective auditors can now access our report annual and gain instant comfort and understanding of how we control and test the BPO Service.
Another significant benefit of an assurance report is the process results in the identification of opportunities for improvement in operational areas.
This is something that Aurion has experienced first-hand. In partnership with PwC thus we commenced a project to accredit our Hosted Service offering (including Software as a Service (SaaS) to the ASAE3402 Type II assurance standards. We provided our Hosted / SaaS service clients with an ASAE3402 Type II report in June of this year. And, in turn, incorporated these hosted environment controls to our BPO Services report this year.