| Course | ACC-4150 Advanced Audit |
|---|---|
| Module | Module 3 |
| Paper type | Written assignment on assurance, attestation and internal auditing |
| Length | About 894 words, 6 pages |
| Format | APA 7 student paper |
| School | Thomas Edison State University |
| Program | Bachelor of Science in Business Administration |
| Updated | October 2026 |
Free sample paper for ACC 4150 Module 3
What Garden State Payroll Partners Should Ask For: SOC Reports, Attestation Levels and an Internal Audit Function
Student Name
Bachelor of Science in Business Administration, Thomas Edison State University
ACC-4150: Advanced Audit
Mentor Name
Month Day, Year
What Garden State Payroll Partners Should Ask For: SOC Reports, Attestation Levels and an Internal Audit Function
Introduction
Garden State Payroll Partners, LLC calculates pay, withholds taxes and files payroll returns for employers across New Jersey and Pennsylvania. Its clients' auditors cannot visit Garden State every year to test its controls, and many clients now ask how it protects employee data. The managing partner has asked for advice on which assurance reports to obtain and how its internal audit department fits in.
SOC 1 or SOC 2?
System and Organization Controls (SOC) reports are attestation engagements on a service organization's controls. A SOC 1 report addresses controls relevant to user entities' internal control over financial reporting; a SOC 2 report addresses controls related to security, availability, processing integrity, confidentiality and privacy, using the trust services criteria (American Institute of Certified Public Accountants [AICPA], 2017).
Garden State should obtain a SOC 1 Type 2 report first. Payroll is a significant expense for every client, and their auditors need evidence that controls over payroll calculation, withholding and deposits operated effectively throughout the year. A Type 1 report would describe the design of controls on one date, which does not give auditors the evidence they need to rely on controls for a full year. Because clients are also asking about data protection, and payroll records hold Social Security numbers and bank details, a SOC 2 Type 2 report on security and confidentiality would answer those questions in a form management and regulators recognize.
| Feature | SOC 1 | SOC 2 |
|---|---|---|
| Main audience | Clients' controllers and their financial statement auditors | Clients' management, risk and information security staff, regulators |
| Subject | Controls affecting clients' financial reporting, such as payroll calculation and tax deposits | Controls over security, availability, processing integrity, confidentiality and privacy |
| Distribution | Restricted to user entities and their auditors | Restricted to knowledgeable users |
| Type 1 | Design of controls at a point in time | Design at a point in time |
| Type 2 | Design and operating effectiveness over a period, usually 6 to 12 months | Design and operating effectiveness over a period |
Matching the Level of Assurance to the Request
Garden State has received three other requests. Each calls for a different attestation engagement.
1. A bank financing Garden State's new office wants assurance that the company complied with its loan covenants. An examination provides reasonable assurance, the highest level, and results in an opinion. It requires the most evidence and costs the most, but the bank needs a positive conclusion.
2. A prospective investor wants some comfort on projected financial information but accepts less than an opinion. A review provides limited assurance, expressed as a conclusion that the practitioner is not aware of material changes needed, based mainly on inquiry and analytical procedures. Prospective information can be examined, but not reviewed, under attestation standards, so the investor must accept either an examination or agreed-upon procedures.
3. A large client wants a CPA to check whether Garden State deposited its payroll taxes within the deadlines for a sample of pay periods. Agreed-upon procedures fit: the practitioner performs procedures the client specifies and reports findings, with no opinion or conclusion, leaving users to draw their own.
The choice depends on what the user needs to decide, how much risk it will accept and how much it will pay. In each case, the practitioner must also be independent of Garden State and must have suitable criteria against which the subject matter can be measured, such as the loan agreement's covenant definitions or the tax deposit deadlines in federal rules. Without suitable criteria, no attestation engagement can be performed at any level.
Evaluating the Internal Audit Department
Garden State has a three-person internal audit department that tests payroll controls quarterly. The SOC report auditors, and clients' auditors, may use internal auditors' work to reduce their own testing if the function is competent and objective and applies a systematic, disciplined approach. Internal auditors' work also matters because research links strong internal audit to better reporting: Prawitt et al. (2009) found that higher internal audit quality was associated with lower levels of earnings management.
The weakness is objectivity. An internal audit function that reports to the executive it audits may hesitate to report findings against that executive. The external auditors could use the department's work on low-risk areas, such as testing new employee setup, but should perform their own testing of high-risk areas such as tax deposits and system access. Garden State should change the reporting line so the director reports functionally to the managing partner or an audit committee.
| Factor | Evidence at Garden State | Assessment |
|---|---|---|
| Competence | The director is a CPA and certified internal auditor; staff have payroll and systems experience; work papers are reviewed | Adequate |
| Objectivity | The director reports administratively to the chief financial officer, whose processes it audits | Weak |
| Systematic approach | A risk-based annual plan; documented testing that follows the IIA's Global Internal Audit Standards, effective in 2025 | Adequate |
Conclusion
Garden State should obtain a SOC 1 Type 2 report for its clients' auditors and consider a SOC 2 Type 2 report on security and confidentiality for data concerns. Its other requests call for an examination, an examination or agreed-upon procedures in place of a review of prospective information, and agreed-upon procedures. Strengthening internal audit's independence would let external auditors rely on it more and improve its value to the firm (Messier et al., 2017).
References
American Institute of Certified Public Accountants. (2017). Trust services criteria for security, availability, processing integrity, confidentiality, and privacy. AICPA.
Messier, W. F., Glover, S. M., & Prawitt, D. F. (2017). Auditing and assurance services: A systematic approach (10th ed.). McGraw-Hill Education.
Prawitt, D. F., Smith, J. L., & Wood, D. A. (2009). Internal audit quality and earnings management. The Accounting Review, 84(4), 1255-1280. https://doi.org/10.2308/accr.2009.84.4.1255
ACC 4150 Module 3 instructions, in plain terms
The third module widens the course from audits to other assurance work, and its paper is one of the seven written assignments that make up half the grade. The module moves beyond financial statement audits to the other services CPAs provide: attestation engagements at different levels of assurance, reports on service organizations' controls and the role of internal auditors. Prompts typically ask you to recommend the right type of engagement or report for a user's need, distinguish levels of assurance and evaluate whether an external auditor may use internal audit work. This sample uses an original composite service organization to answer a prompt of that kind; your own case and questions come from the course site. Note the period of the case, since thresholds and report formats depend on it.
How this ACC 4150 Module 3 example is built
The paper is organized around the client's questions. The SOC section defines both report types, compares them in a table and makes a recommendation based on who will use each report. The attestation section takes three real requests and matches each to an engagement type, explaining the level of assurance and noting a restriction on reviewing prospective information. The internal audit section evaluates three factors in a table, identifies the weak one and limits reliance to low-risk areas, with research on why internal audit quality matters. A brief conclusion collects the recommendations in the order the client asked. Every recommendation can be traced to a fact stated earlier in the paper.
ACC 4150 Module 3 rubric: what earns full marks
Mentors apply the written work rubric's criteria of accurate content, analysis and writing quality, and this assignment shares in the 50 percent of the ACC-4150 grade carried by written work. They look for correct distinctions between SOC 1 and SOC 2 and between Type 1 and Type 2, levels of assurance matched to users' needs with the correct form of report for each, and a structured evaluation of internal audit competence and objectivity. Recommendations should follow from the facts. Papers that list definitions without applying them, or that recommend reviews where standards do not permit them, lose points. Clear tables and headings help the mentor see that each part of the prompt is answered. A clear recommendation at the end of each section helps the mentor follow the argument.
ACC 4150 Module 3 help from the desk
Students frequently confuse SOC 1 and SOC 2: ask whether the user cares about financial reporting or about security and data. Remember that a Type 1 report does not test operating effectiveness, so it rarely satisfies an auditor relying on controls for a year. Match engagements to users' needs: an opinion requires an examination, limited assurance comes from a review and agreed-upon procedures give findings only. When evaluating internal audit, address competence and objectivity separately; strong skills do not cure a weak reporting line. If your case features a different kind of service provider, say a claims processor or a cloud host, a writer can work through it the same way. When unsure between two classifications, explain both and say which facts tip the balance.
Write yours, or have the desk draft it
This paper is an original model document written by our desk, not a submitted student paper and not an official Thomas Edison State University document. Read it for the moves, then write your own to the instructions in your classroom. If you want one built to your exact prompt and rubric, the first custom sample is free and arrives in 24 to 48 hours.
More ACC 4150 and Bachelor of Science in Business Administration sample papers
- ACC 4150 Module 1: Internal Control Deficiencies Written Assignment
- ACC 4150 Module 2: Completing the Audit Written Assignment
- ACC 4150 Module 4: Professional Judgment Framework Assignment
- ACC 4150 Module 5: Compliance Audit Written Assignment
- ACC 4150 Module 6: GAGAS Written Assignment
- ACC 4150 Module 7: Final Project: Comparing Major Auditing Standards
- BUS 2100 Module 6: A Landscaper's Truck and New Crew
- MKT 2010 Module 5: Distribution Decisions Assignment
- BUS 1010 Module 4: Human Resources Written Assignment
- ACC 1010 Module 4: Cash, Receivables and Inventory Homework
ACC 4150 Module 3 questions, answered
Where can I find a free ACC 4150 Module 3 sample paper?
The Module 3 analysis is printed above in full: SOC 1 and SOC 2 reports compared and recommended, three attestation requests matched to engagement types and an internal audit function evaluated.
What is the difference between a SOC 1 and a SOC 2 report?
A SOC 1 report covers controls relevant to clients' financial reporting; a SOC 2 report covers controls over security, availability, processing integrity, confidentiality and privacy.
What is the difference between Type 1 and Type 2 SOC reports?
Type 1 reports on the design of controls at a point in time; Type 2 also tests whether they operated effectively over a period.
What level of assurance does an agreed-upon procedures engagement give?
None. The practitioner reports findings from procedures the user specified, and users draw their own conclusions.
When can external auditors use internal auditors' work?
When the internal audit function is competent, objective and applies a systematic, disciplined approach, with more reliance in lower-risk areas.