Attestation Engagement StandardAt one time attest services provided by CPAs were limited to expressing a positive opinion on historical financial statements on the basis of an audit made in accordance with generally accepted auditing standards (GAAS). However, CPAs are increasingly requested to provide assurance on representations other than historical financial statements and in forms other than the positive opinion. A practitioner who is engaged to issue or does issue an examination, a review, or an agreed-upon procedures report on subject matter, or an assertion about the subject matter that is the responsibility of another party should do so in accordance with the eleven attestation standards described in this post.

Advertisement

The guidance on attest services also provides for reports based on agreed-upon procedures or agreed-upon criteria as long as the use of the report is limited to the parties who agreed upon the procedures or criteria. The main objective of adopting the attestation standards was to provide guidance and establish a broad framework for the variety of attest services demanded of CPAs.

There are 11 (eleven) attestation standards and two levels of attest assurance that can be reported for general distribution, as follows:

  • Positive assurance in reports that express conclusions on the basis of an examination.
  • Moderate assurance in reports that express conclusions on the basis of a review.

 

The 11 standards are classified into 3 main group:

  • General Standard (1 to 5)
  • Standard of Field Work (6 to 7)
  • Standard of Reporting (8 to 11)

 

General Standard

1. First general standard – The engagement shall be performed by a practitioner having adequate technical training and proficiency in the attest function. (AT 101.19)

2. Second general standard – The engagement shall be performed by a practitioner having adequate knowledge of the subject matter. (AT 101.21)

3. Third general standard – The practitioner shall perform the engagement only if he or she has reason to believe that the subject matter is capable of evaluation against reasonable criteria that are suitable and available to users. (AT 101.23):

  • Suitable criteria must be: (1) Objective – Free from bias. (2) Measurable – Permit reasonably consistent measurements (qualitative or quantitative) of subject matter. The practitioner should consider whether the criteria are sufficiently precise to permit people having competence in and using the same measurement criterion to be able to obtain materially similar measurements. (3) Complete – Relevant factors that would alter a conclusion about the subject matter are not omitted. (4) Relevant – Be relevant to the subject matter. Regardless of who establishes the criteria, the responsible party or client is responsible for selecting the criteria. The client is responsible for determining whether the criteria are appropriate for its purpose.
  • The criteria must be available to users in one or more of the following ways (1) Publicly (2) Through inclusion in a clear manner in the presentation of the subject matter or the assertion, or in the practitioner’s report. (3) By being well understood by most users, although not formally available.

Note: If the criteria are only available to specified parties, such as the terms of a contract or criteria issued by an industry association and available only to those in the industry, the practitioner’s report should be restricted to parties that have access to the criteria.

4. Fourth general standard – In all matters relating to the engagement, an independence in mental attitude shall be maintained by the practitioner. (AT 101.35)

5. Fifth general standard – Due professional care shall be exercised in the planning and performance of the engagement. (AT 101.39)

 

 
Standard of Fieldwork

6. First standard of fieldwork – The work shall be adequately planned and assistants, if any, shall be properly supervised. (AT 101.42) Factors to be considered in planning an attest engagement include the following (AT 101.45):

  • The criteria to be used.
  • Preliminary judgments about attestation risk and materiality.
  • Nature of the subject matter or the items within the assertion that are likely to require revision or adjustment.
  • Conditions that may require extension or modification of attest procedures.
  • Nature of report (see reporting standards) to be issued.

 

7. Second standard of fieldwork – Sufficient evidence shall be obtained to provide a reasonable basis for the conclusion that is expressed in the report. (AT 101.51) [Note: The standard also covers engagements designed solely to meet the needs of specified users who have participated in establishing the nature and scope of the engagement (agreedupon procedures or agreed-upon criteria)]. In establishing an appropriate combination of procedures to accumulate evidence and appropriately restrict attestation risk, the practitioner should consider the following:

  • Evidence obtained from sources outside an entity, such as through confirmation, provides greater assurance of an assertion’s reliability than evidence secured solely from within the entity.
  • Information obtained from the attester’s direct personal knowledge, such as through physical examination, observation, computation, operating tests, or inspection, is more persuasive than information obtained indirectly.
  • The more effective the controls over the subject matter, the more assurance they provide about the subject matter or the assertion.

In an attest engagement designed to provide a high level of assurance (an examination), the practitioner should select from all available procedures any combination that can limit attestation risk to an appropriately low level. In an attest engagement designed to provide a moderate level of assurance (a review), the practitioner’s procedures are ordinarily limited to inquiries and analytical procedures and do not include search and verification procedures, such as confirmation and physical examination.

Note: In an attest engagement designed solely to meet the needs of specified parties who have participated in establishing the nature and scope of the engagement, the practitioner is required to perform only those procedures that have been designed or agreed to by the parties.) If the practitioner cannot obtain a written assertion from the responsible party, the practitioner should consider the effects on his or her ability to obtain sufficient evidence to form a conclusion about the subject matter. If the practitioner’s client is the responsible party, the practitioner should ordinarily conclude that a scope limitation exists. If the practitioner’s client is not the responsible party, the practitioner may be able to conclude that he or she has sufficient evidence to form a conclusion about the subject matter.

 

 

Standard of Reporting

8. First standard of reporting – The report shall identify the subject matter or the assertion being reported on and state the character of the engagement. (AT 101.63) The statement of the character of the attest engagement includes:

  • A description of the nature and scope of the work performed, and
  • A reference to the professional standards governing the engagement.

 

Note: When the assertion does not accompany the practitioner’s report, the first paragraph of the report should also contain a statement of the assertion. This requirement would be met by using a “hot link” within the practitioner’s report to management’s assertion.)

 

9. Second standard of reporting – The report shall state the practitioner’s conclusion about the subject matter or the assertion in relation to the criteria against which the subject matter was evaluated. However, if conditions exist that, individually or in combination, result in one or more material deviations from the criteria, the practitioner should modify the report and should ordinarily express his or her conclusion directly on the subject matter, not on the assertion. (AT 101.66)

10. Third standard of reporting – The report shall state all of the practitioner’s significant reservations about the engagement, the subject matter, and, if applicable, the assertion related thereto (AT 101.71). Reservations about the engagement include unresolved problems that the practitioner had in complying with the attestation, other interpretative standards, or specified agreed-upon procedures. Reservations about the engagement also include scope limitations. Scope restrictions may require the practitioner: (a) To qualify the assurance provide; (b) To disclaim any assurance; or c. To withdraw from the examination or review engagement.

Ordinarily, if the scope limit is pervasive or imposed by the client, a disclaimer of opinion or withdrawal is appropriate. In a review engagement, the review is incomplete and the practitioner should withdraw from the engagement when:

  • The practitioner is unable to perform the necessary inquiry and analytical procedures.
  • The client is the responsible party and does not provide a written assertion.

 

Reservations about the subject matter or assertion refers to questions about whether the subject matter or assertion is fairly stated, in all material respects, based on established or stated criteria, including adequacy of disclosure. They can result in either qualified or adverse opinions. Reservations also include questions about measurement, form, arrangement, content or underlying judgments and assumptions applicable to the subject matter or the assertion. Reservations may require modification of the practitioner’s report.

11. Fourth standard of reporting The report shall state that the use of the report is restricted to specified parties under the following circumstances (AT 101.78):

  • When the criteria used to evaluate the subject matter are determined by the practitioner to be appropriate only for a limited number of parties who either participated in their establishment or can be presumed to have an adequate understanding of the criteria.
  • When the criteria used to evaluate the subject matter are available only to specified parties.
  • When reporting on subject matter and a written assertion has not been provided by the responsible party.
  • When the report is on an attest engagement to apply agreed-upon procedures to the subject matter.

 

A number of circumstances may affect the need to restrict a report, including:

  • The purpose of the report.
  • The criteria used in preparation of the subject matter.
  • The extent to which the procedures performed are known or understood.
  • The potential for the report to be misunderstood when taken out of context.

Although a practitioner should consider informing the client that restricted-use reports are not intended for distribution to nonspecified parties, regardless of whether they are included in a document containing a separate general-use report, a practitioner is not responsible for controlling a client’s distribution of restricted-use reports.

Restricted-use reports should contain:

  • A statement indicating that the report is intended solely for the information and use of the specified parties.
  • An identification of the specified parties to whom use is restricted.
  • A statement that the report is not intended to be and should not be used by anyone other than these specified parties.

Note: A practitioner may restrict the use of any report. If a practitioner issues a single combined report covering both subject matter or presentations that require restrictions and those that do not require restrictions, the use of a single combined report should be restricted to the specified parties. If a separate restricted-use report is included in a document that contains a general-use report, this does not affect the intended use of either report (i.e., the restricted-use report remains restricted and the general-use report continues to be for general use.

 

Examination Reports

In an attest engagement designed to achieve a high level of assurance (an examination), the practitioner’s conclusion should be expressed in the form of an opinion. The practitioner should clearly state, in his opinion, whether: (1) the subject matter is based on (or in conformity with) the criteria, in all material respects, or (2) the assertion is presented (or fairly stated), in all material respects, based on the criteria. Reports may be qualified or modified because of the subject matter, the assertion, or the engagement. Reports also may emphasize certain matters relating to the engagement. The form of the practitioner’s report depends on whether the practitioner’s opinion is on the subject matter or assertion.

According to AT 101.85, the practitioner’s examination report on subject matter should include the following:

  • A title that includes the word independent.
  • An identification of the subject matter and the responsible party.
  • The subject matter is the responsibility of the responsible party.
  • The practitioner’s responsibility is to express an opinion on the subject matter based on his or her examination.
  • The examination was conducted in accordance with attestation standards established by the AICPA, and accordingly, included procedures that the practitioner considered necessary in the circumstances.
  • The practitioner believes the examination provides a reasonable basis for his or her opinion.
  • The practitioner’s opinion on whether the subject matter is based on (or in conformity with) the criteria in all material respects.
  • A statement restricting the use of the report to specified parties when the criteria used to evaluate the subject matter are determined to be appropriate only for a limited number of parties who understand the criteria, or when such criteria are available only to the specified parties. The report should also be restricted when a written assertion has not been provided by the responsible party, and a statement to that effect should be included in the introductory paragraph.
  • The manual or printed signature of the practitioner’s firm.
  • The date of the examination report.

Under AT 101.86 the practitioner’s examination report on an assertion should include the following:

  • A title that includes the word independent.
  • An identification of the assertion and the responsible party. (When the assertion does not accompany the practitioner’s report, the first paragraph of the report should also contain a statement of the assertion.)
  • The assertion is the responsibility of the responsible party.
  • The practitioner’s responsibility is to express an opinion on the assertion based on his or her examination.
  • The examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants, and accordingly, included procedures that the practitioner considered necessary in the circumstances.
  • The practitioner believes the examination provides a reasonable basis for his or her opinion.
  • The practitioner’s opinion on whether the assertion is presented (or fairly stated), in all material respects, based on the criteria.
  • A statement restricting the use of the report to specified parties when the criteria used to evaluate the subject matter are appropriate only for a limited number of parties who understand the criteria, or when such criteria are available only to the specified parties.
  • The manual or printed signature of the practitioner’s firm.
  • The date of the examination report.

Note: The practitioner is not precluded from examining an assertion but opining directly on the subject matter.

 

Review Reports

In an attest engagement designed to achieve only a moderate level of assurance (a review), the practitioner’s conclusion should be expressed in the form of negative assurance. The practitioner should state whether any information came to his or her attention that indicated:

  • subject matter is not based on (or in conformity with) the criteria; or
  • the assertion is not presented in all material respects based on established or stated criteria.

According to AT 101.89 the practitioner’s review report on subject matter should include:

  • A title that includes the word independent.
  • An identification of the subject matter and the responsible party.
  • The subject matter is the responsibility of the responsible party.
  • The review was conducted in accordance with attestation standards established by the AICPA.
  • A review is substantially less in scope than an examination, the objective of which is an expression of opinion on the subject matter, and accordingly, no such opinion is expressed.
  • A statement about whether the practitioner is aware of any material modifications that should be made to the subject matter in order for it to be based on (or in conformity with), in all material respects, the criteria, other than those modifications, if any, indicated in his or her report.
  • A statement restricting the use of the report to specified parties when the criteria used to evaluate the subject matter are appropriate only for a limited number of parties who understand the criteria, or when such criteria are available only to the specified parties. The report should also be restricted when a written assertion has not been provided by the responsible party, and a statement to that effect should be included in the introductory paragraph.
  • The manual or printed signature of the practitioner’s firm.
  • The date of the examination report.

Under AT 101.90 the practitioner’s review report on an assertion should include the following:

  • A title that includes the word independent.
  • An identification of the assertion and the responsible party. (When the assertion does not accompany the practitioner’s report, the first paragraph of the report should also contain a statement of the assertion.)
  • The assertion is the responsibility of the responsible party.
  • The review was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants.
  • A review is substantially less in scope than an examination, the objective of which is an expression of opinion on the assertion, and accordingly, no such opinion is expressed.
  • A statement about whether the practitioner is aware of any material modifications that should be made to the assertion in order for it to be presented (or fairly stated), in all material respects, based on (or in conformity with) the criteria, other than those modifications, if any, indicated in his or her report.
  • A statement restricting the use of the report to specified parties when the criteria used to evaluate the subject matter are appropriate only for a limited number of parties who understand the criteria, or when such criteria are available only to the specified parties.
  • The manual or printed signature of the practitioner’s firm.
  • The date of the review report.

 

 
Relationship of Attestation To Quality Control Standards

Attestation and quality control standards are related, since attestation standards relate to the conduct of individual attest engagements and quality control standards relate to the firm’s whole attest practice.

The quality control policies and procedures that a firm adopts may affect both the conduct of individual attest engagements and the conduct of a firm’s attest practice as a whole. Therefore, SSAE 10 requires firms to adopt a system of quality control in the conduct of their attest practice. However, deficiencies in or noncompliance with the quality control system does not, by itself, indicate that an engagement was not performed according to the appropriate standards.

 

Attest Documentation

The practitioner should prepare and maintain documentation of the attest engagement. The form and content of the attest documentation will depend on the particular engagement’s circumstances. The practitioner should use professional judgment in determining the quantity, type, and content of attest documentation.

Attest documentation is the principal record of the procedures applied, information obtained, and conclusions or findings reached by the practitioner. It serves to provide the primary support for the practitioner’s report and assist in the conduct and supervision of the engagement.

It should be sufficient to:

  • Allow members of the engagement team with supervisory and review responsibilities to understand the nature, timing, extent, and results of attest procedures performed, and the information obtained; and
  • Indicate which engagement team members performed and reviewed the work.

 

Attest documentation, which may be in paper or electronic form, includes work programs, analyses, memoranda, letters of confirmation and representation, abstracts or copies of the entity’s documents, and schedules or commentaries prepared or obtained by the practitioner.

The practitioner owns the attest documentation, and some states recognize this right of ownership in their statutes. However, the practitioner has an ethical, and sometimes legal, obligation to maintain the confidentiality of the client or responsible party.

The practitioner should adopt reasonable procedures to maintain the confidentiality of information contained in the attest documentation, and to prevent unauthorized access to that documentation. The practitioner should also retain the attest documentation for a period sufficient to meet the needs of his or her practice, and to satisfy any pertinent legal or regulatory requirements for records retention (The practitioner should be able to access electronic documentation throughout the retention period).

Sometimes attest documentation may serve as a source of reference for the client, but such documentation should not be considered as part of, or a substitute for, the client’s accounting records.

When performing an examination of prospective financial statements, attest documentation ordinarily should indicate that the practitioner considered the process by which the entity develops its prospective financial statements in determining the scope of the engagement.

 

 
The Use of the Representation Letter in Attestation Engagement

In an examination or review engagement, a practitioner should consider obtaining a representation letter from the responsible party. According to AU 101.60, examples of representations that may by included are:

  • A statement acknowledging responsibility for the subject matter and the assertion (if applicable).
  • A statement acknowledging responsibility for selecting the criteria (if applicable).
  • A statement acknowledging responsibility for determining that such criteria are appropriate for its purposes, where the responsible party is the client.
  • The assertion about the subject matter based on the selected criteria.
  • A statement that all known matters contradicting the assertion and any communication from regulatory agencies affecting the subject matter or the assertion have been disclosed to the practitioner.
  • Availability of all records relevant to the subject matter.
  • A statement that any known events subsequent to the period (or point in time) of the subject matter being reported on that would have a material effect on the subject matter (or assertion, if applicable) have been disclosed to the practitioner.

 

If the client is not the responsible party, the practitioner should consider obtaining a representation letter from the client. According to AU 101.61, examples of representations included in the letter are:

  • A statement that any known material subsequent events have been disclosed.
  • A statement acknowledging the client’s responsibility for selecting the criteria, if applicable.
  • A statement acknowledging the client’s responsibility for determining that such criteria are appropriate.

 

If the responsible party or client refuses to furnish necessary written representations in an examination engagement, the practitioner should consider the impact on the ability to issue a conclusion about the subject matter. If the representation is necessary to obtain sufficient evidence to issue a report, the responsible party or client’s refusal may cause the practitioner to disclaim an opinion or withdraw. However, in other circumstances, a qualified opinion may be appropriate. The practitioner should also consider whether the refusal affects his or her ability to rely on other representations. If the engagement is a review and a scope limitation exists, the practitioner should withdraw from the engagement.