Assurance&Non Assurance Engagements
Assurance&Non Assurance Engagements
Assurance&Non Assurance Engagements
The auditor uses the term ‘audit engagement’ when the entity has to undergo the
auditing procedure. This could imply varied things and therefore it is necessary that
the auditor clarifies what she/he exactly means by the term. Irrespective of the
definition followed by the auditor, he/she makes it a point to follow certain specific
guidelines and procedure for offering the services.
Full Engagement
Audit engagement consists of several steps that basically revolve around planning,
substantiation, control testing and finalization. The very first step involves providing a
letter to the client reminding him about the audit. Once the client has been contacts,
both the auditor and client meet with each other to determine how, why and when the
auditing would take place. In addition to this, the client also needs to provide the
auditor with relevant resources for conducting the procedure smoothly. Following
this, the auditor carries out surveys to find out more about the organization and its
controls. This is followed by testing of controls and garnering of as much detail and
information as is possible. On the basis of the results and information, the auditor
prepares a temporary draft and shares the same with client. Once the client has gone
through the draft report, he responds to the recommendations and findings made in it.
After this, the auditor prepares a final audit report and may also request the client to
fill a survey form to better understand his/her performance. The audit is completed
after a follow up meeting with client, which usually happens within 6mon t h s .
Objectives of the Practitioner
A practitioner is an the individual(s) conducting the engagement (usually the
engagement partner or other members of the engagement team, or, as applicable, the
firm) by applying assurance skills and techniques to obtain reasonable assurance or
limited assurance, as appropriate, about whether the subject matter information is free
from material misstatement In conducting an assurance engagement, the objectives of
the practitioner are:
a) To obtain either reasonable assurance or limited assurance, as appropriate,
about whether the subject matter information (that is, the reported outcome of
the measurement or evaluation of the underlying subject matter) is free from
material misstatement;
b) To express a conclusion regarding the outcome of the measurement or
evaluation of the underlying subject matter through a written report that
clearly conveys either reasonable or limited assurance and describes the basis
for the conclusion; and
c) To communicate further as required by relevant ISAEs.
In all cases when .reasonable assurance or limited assurance, as appropriate, cannot be
obtained and a qualified conclusion in the practitioner's assurance report is insufficient
in the circumstances for purposes of reporting to the intended users, the ISAEs require
that the practitioner disclaim a conclusion or withdraw (or resign) from the
engagement, where withdrawal is possible under applicable laws or regulations.
Elements of Assurance Engagements
There are five elements that must all be present in order to qualify the engagement as
an assurance engagement.
1. A three-party relationship involving a practitioner, a responsible party, and
intended users;
2. An appropriate subject matter;
3. Sufficient appropriate evidence;
4. Suitable Criteria;
5. A written assurance report in the form appropriate to a reasonable assurance
engagement or a limited assurance engagement.
Merely obtaining more evidence may not compensate for its poor quality
The auditor should consider the cost of obtaining the usefulness of the evidence.
Suitable Criteria
The following are the characteristics of criteria to be considered suitable:
•Relevance – contribute to conclusions that assist decision-making by the intended
users.
•Completeness – the relevant factors that could affect the conclusions are
not omitted. Includes benchmarks for presentation and disclosure
•Reliability – allows reasonably consistent evaluation or measurement of the subject
matter including where relevant, presentation and disclosure, when used in similar
circumstances by similarly qualified practitioners
•Neutrality – free from bias
•Understandability – contribute to conclusions that are clear, comprehensive, and not
subject to significantly different interpretations
TYPES OF ASSURANCE ENGAGEMENTS
1. As to level of assurance:
Reasonable Assurance – the objective is a reduction in assurance
engagement risk to an acceptably low level as the basis for a positive
form of expression of a practitioner’s conclusion. (e.g., audit of
historical financial statements)
Limited Assurance – the objective is a reduction in assurance engagement risks to
a level that is acceptable in the circumstances of the engagement, but where the
risk is greater that for a reasonable assurance engagement, as the basis for a
negative form of expression of the practitioner’s conclusion. (e.g., review of
historical financial statements.
2. As to structure of engagement:
• Assertion-based – the evaluation or measurement of the subject matter is
performed by the responsible party, and the subject matter information is in the
form of assertion to the intended users.
• Direct Reporting – the practitioner either directly performs the evaluation or
measurement of the subject matter, or obtains a representation from the
responsible party that has performed the evaluation or measurement that is not
available to intended users. The subject matter information is provided to the
intended users in the assurance report.
Importance of Assurance Engagements;
1. Potential bias in providing information
2. Remoteness between a user and the organization
3. Complexity of the transactions, information, or processing systems
4. Investors need to manage their risk and thereby minimize financial surprises as
consequences to investors, and others, of relying on inaccurate information can be
quite significant.
Limitations of Assurance Engagements
Level of assurance. The level of assurance that the financial statements of a client are
fairly presented is at its highest for an audit and at its lowest (none at all) for a
compilation, with a review somewhere in between.
Reliance on management. In all three cases, the auditor begins with the account
balances provided by management, but an audit requires in a significant amount of
corroboration of this information. A review requires some testing of the information,
while a compilation almost entirely relies on the presented information.
Understanding of internal control. The auditor only tests the internal controls of the
client in an audit; no testing is conducted for a review or a compilation.
Work performed. An audit requires a significant number of hours to complete,
since there are many audit procedures to be performed. A review requires
substantially fewer hours, while the effort associated with a compilation is
relatively minor.
Price. It requires vastly more effort for an auditor to complete an audit, so audits
are much more expensive than a review, which in turn is more expensive than a
compilation.
Another issue is the level of demand for each of these services. The users of
financial statements, such as investors and lenders, nearly always demand an audit,
since it provides the greatest assurance that what they are reading is a fair
representation of the financial results, financial position, and cash flows of the
reporting entity.
INTERNATIONAL STANDARD ON ASSURANCE ENGAGEMENTS-ISAE
3000
This International Standard on Assurance Engagements (ISAE) deals with assurance
engagements other than audits or reviews of historical financial information, which
are dealt with in International Standards on Auditing (ISAs) and International
Standards on Review Engagements (ISREs), respectively.
Assurance engagements include both attestation engagements, in which a party other
than the practitioner measures or evaluates the underlying subject matter against the
criteria, and direct engagements, in which the practitioner measures or evaluates the
underlying subject matter against the criteria. This ISAE contains requirements and
application and other explanatory material specific to reasonable and limited
assurance attestation engagements.
This ISAE contains requirements and application and other explanatory material
specific to reasonable and limited assurance attestation engagements. This ISAE may
also be applied to reasonable and limited assurance direct engagements, adapted and
supplemented as necessary in the engagement circumstances.
This ISAE is premised on the basis that:
• The members of the engagement team and the engagement quality control reviewer
(for those engagements where one has been appointed) Code of Ethics for
Professional Accountants issued by the International Ethics Standards Board for
Accountants (IESBA Code) related to assurance engagements,
• The practitioner who is performing the engagement is a member of a firm or other
professional requirements, or requirements in law or regulation, regarding the
firm’s responsibility for its system of quality control.
Quality control within firms that perform assurance engagements, and compliance
with ethical principles, including independence requirements, are widely recognized
as being in the public interest and an integral part of high-quality assurance
engagements. Professional accountants in public practice will be familiar with such
requirements. If a competent practitioner other than a professional accountant in
public practice chooses to represent compliance with this or other ISAEs.
This ISAE covers assurance engagements other than audits or reviews of historical
financial information, as described in the International Framework for Assurance
Engagements (Assurance Framework). Where a subject-matter specific ISAE is
relevant to the subject matter of a particular engagement, not all engagements
performed by practitioners are assurance engagements. Other frequently performed
engagements that are not assurance engagements, ie
(a) Engagements covered by International Standards on Related Services (ISRS),
such as agreed-upon procedure and compilation engagements;
(b) The preparation of tax returns where no assurance conclusion is expressed; and
(c)Consulting (or advisory) engagements, such as management and tax consulting.
The following engagements, which may be consistent are not considered assurance
engagements in terms of the ISAEs:
(a) Engagements to testify in legal proceedings regarding accounting, auditing,
taxation or other matters; and
(b) Engagements that include professional opinions, views or wording from
which a user may derive some assurance, if all of the following apply:
(i) Those opinions, views or wording are merely incidental to the overall
engagement;
(ii) Any written report issued is expressly restricted for use by only the intended
users specified in the report;
(iii) Under a written understanding with the specified intended users, the
engagement is not intended to be an assurance engagement; and
(iv) The engagement is not represented as an assurance engagement in the
professional accountant’s report.
Accepting Appointment to Perform Assurance Engagement
The engagement may be an audit, or it may be a non-audit or assurance engagement.
Acceptance decisions are crucially important, because new clients and/or engagements
can pose threats to objectivity, or create risk exposure to the firm, which must be
carefully evaluated.
One of the current issues being debated in the profession is whether there should be an
outright ban on the provision of non-audit services to audit clients. In addition, new
International Standard on Auditing (ISA) requirements compel the firm to establish
whether preconditions for an audit are present when faced with a potential new audit
engagement. All of these factors mean that acceptance decisions must be taken with
care.
IFAC’s Code of Ethics for Professional Accountants states: ‘Before accepting a new
client relationship, a professional accountant in public practice shall determine
whether acceptance would create any threats to compliance with the fundamental
principles. Potential threats to integrity or professional behaviour may be created
from, for example, questionable issues associated with the client (its owners,
management or activities).’
This means that when approached to take on a new client, the firm should investigate
the potential client, its owners and business activities in order to evaluate whether
there are any questions over the integrity of the potential client which create
unacceptable risk. These investigative actions are usually performed as ‘know your
client/customer’ or ‘customer due diligence’ procedures, which are also carried out in
order to comply with anti-money laundering regulations.
Once a client has been accepted, the firm should consider the suitability of the specific
engagement it has been asked to perform. In particular there may be ethical threats
which mean that the engagement should not be accepted, in particular whether there
are any threats to objectivity. Potential threats could arise for example, if members of
the audit firm hold shares in the client or there are family relationships. If threats are
discovered, it may not mean that the client must be turned down, as safeguards could
potentially reduce the threats to an acceptable level.
Obviously, these matters need to be evaluated in the specific context of the potential
engagement, and should be fully documented. Different types of potential engagement
will give rise to different matters that should be evaluated. For example, if the firm is
asked to perform the audit of a large group of companies with operations in many
countries, then resourcing the audit may be the most significant issue.
The fee may be large, leading to a self-interest threat of fee dependence. On the other
hand, if asked to perform the audit of a small owner-managed company, fee
dependence is less likely to be an issue, but threats potentially created by the auditor
appearing to make management decisions could be significant. In answering
requirements on client and engagement acceptance, candidates are warned that their
comments must be made specific to the scenario presented to them in order to pass the
requirement.
IFAC’s Code makes it clear that acceptance decisions are not to be treated as a one-off
matter. The Code states: ‘It is recommended that a professional accountant in public
practice periodically review acceptance decisions for recurring client engagements.’
Changes in the circumstances of either the client, or the audit firm may mean that an
engagement ceases to be ethically or professionally acceptable or creates a heightened
level of risk exposure. Therefore, client continuance assessments are important and
should be fully documented.
Preconditions for an audit
Once a firm has decided to go ahead with an audit engagement, it must comply with
the requirements of ISA 210, Agreeing the Terms of Audit Engagements. ISA 210 was
revised as part of the International Auditing and Assurance Standards Board’s Clarity
Project, with new requirements to perform specific procedures in order to establish
whether the preconditions for an audit are present.
ISA 210 defines preconditions for an audit as follows: ‘The use by management of an
acceptable financial reporting framework in the preparation of the financial statements
and the agreement of management and, where appropriate, those charged with
governance to the premise on which an audit is conducted’. This means that the
auditor must do two things. First, the auditor must determine the acceptability of the
financial reporting framework to be applied in the preparation of the financial
statements.
This includes evaluating whether law or regulation prescribes the applicable financial
reporting framework, considering the purpose of the financial statements, and the
nature of the reporting entity (for example, whether a listed company or a public
sector entity). In most cases this will simply be a matter of confirming with the client
that the financial statements will be prepared under International Financial Reporting
Standards, or other national reporting framework.
Second, the auditor must obtain the agreement of management that it acknowledges
and understands its responsibility:
• For the preparation of the financial statements in accordance with the applicable
financial reporting framework.
• For internal controls to enable the preparation of financial statements which are
free from material misstatement, whether due to fraud or error.
• To provide the auditor with access to all information necessary for the purpose of
the audit.
In relation to the final bullet point, if management impose a limitation on the scope of
the auditor’s work in the terms of a proposed audit engagement, the auditor should
decline the audit engagement if the limitation could result in the auditor having to
disclaim the opinion on the financial statements. The engagement should also be
declined if the financial reporting framework is unacceptable, or if management fail to
provide the agreement outlined above. (ISA 580, Written Representations also
requires that management provide written representations regarding its responsibilities
in relation to the preparation of financial statements.)
It is very common for audit clients to approach their auditor for the provision of
additional services, ranging from audit related services such as tax planning and
bookkeeping, to other engagements such as due diligence and forensic investigations.
The audit firm must again carefully consider whether it is ethically and professionally
acceptable to take on the additional service.
The main ethical threat created by the provision of non-audit services is the threat to
objectivity. The threats created are most often self-review, self-interest and advocacy
threats and if a threat is created that cannot be reduced to an acceptable level by the
application of safeguards, the non-audit service shall not be provided. The UK
Auditing Practices Board’s (APB) Ethical Standard 5, Non-audit services provided to
audit clients contains similar principles, and emphasizes the ‘management threat’
which exists when the audit firm makes decisions and judgments that are properly the
responsibility of management.
• Increase the rigour with which auditors assess threats to their independence
• Introduce a new non-audit services disclosure regime and
• Increase the role of Audit Committees in overseeing the retention of a
company’s auditors to undertake non-audit services.
The final bullet point is important as it links to corporate governance. Under many
codes of corporate governance, including the UK Corporate Governance Code, the
client’s audit committee should be involved with any decision as to whether the audit
firm can be engaged to provide a non-audit service. Therefore, when approached to
provide a non-audit service to an audit client, there should be full discussion with
those charged with governance, including the audit committee, with a view to seeking
approval for the engagement to go ahead.
The purpose SRE 2410 is to form standards and offer guidance on the professional
responsibilities of an auditor when he/she assumes any engagement for reviewing the
interim financial information of the audit client. The standard also prescribes the
content and form of the report. An auditor engaged to execute a review of the interim
financial information must execute the review as per SRE 2410. Let us understand in
detail about SRE 2410.
An auditor must comply with all the ethical requirements applicable to the audit of the
entity’s annual financial statements. An auditor must ensure that quality control
procedures are implemented which are relevant to individual engagement. An auditor
must plan and perform his/her review with the professional attitude and skepticism,
knowing that conditions might exist which require a material adjustment to the interim
financial information.
The client and the auditor must agree and align on the engagement terms. These terms
are generally recorded in the engagement letter. It helps in avoiding
misunderstandings with respect to:
REPORTS
The practitioner forms a conclusion on the basis of the evidence obtained, and
provides a written report containing a clear expression of that conclusion that
conveys the assurance obtained about the subject matter information.
Assurance Standards establish basic elements for assurance r e por t s .
In an attestation engagement, the practitioner's conclusion can be worded either:
a.In terms of a statement made by the measurer or evaluator, that is, the party
responsible for measuring or evaluating the underlying subject matter (for example:
— In our opinion the responsible party's statement that internal control is effective,
in all material respects, based on XYZ criteria, is fairly stated); or
b.In terms of the underlying subject matter and the criteria (for example: —in our
opinion internal control is effective, in all material respects, based on XYZ criteria).
In a direct engagement, the practitioner's conclusion is worded as for (b) above, that
is in terms of the underlying subject matter and the criteria.
Can the practitioner’s conclusion be worded in terms of:
The underlying subject A statement made by the
matter and the measurer or evaluator
criteria? who
is not the practitioner?
Attestation yes yes
engagement
Direct engagement yes No
(the practitioner is the
measurer or evaluator in a
direct engagement, so there is
no statement made by
another party)
Non-assurance Engagements
If an engagement lacks the five elements of assurance
Engagements, it is considered non- assurance (residual definition). Examples of non-
assurance engagement are the following:
1. Agreed-upon procedures
2. Compilations engagements
3. Preparation of Income tax returns where no conclusion
conveying assurance is expressed
4. Management advisory services and Consulting
5. Engagement that includes rendering of professional opinions
not intended to be an assurance report
Attestation and direct reporting engagements
Attestation engagement―An assurance engagement in which a party other than the
practitioner measures or evaluates the underlying subject matter against the criteria. A
party other than the practitioner also often presents the resulting subject matter
information in a report or statement. In some cases, however, the subject matter
information may be presented by the practitioner in the assurance report. In an
attestation engagement, the practitioner’s conclusion addresses whether the subject
matter information is free from material misstatement. The practitioner’s conclusion
may be phrased in terms of:
• The underlying subject matter and the applicable criteria;
• The subject matter information and the applicable criteria; or
• A statement made by the appropriate party.
Direct engagement―An assurance engagement in which the practitioner measures
or evaluates the underlying subject matter against the applicable criteria and the
practitioner presents the resulting subject matter information as part of, or
accompanying, the assurance report. In a direct engagement, the practitioner’s
conclusion addresses the reported outcome of the measurement or evaluation of the
underlying subject matter against the criteria.