ACCA Strategic Professional · Advanced Audit and Assurance (International)

Audit-related and assurance services: formula sheet

Full chapter guide

Key formulas

Five elements of an assurance engagement: Three parties + Subject matter + Suitable criteria + Sufficient appropriate evidence + Assurance report; Learn this as a checklist. Missing any one means it is not an assurance engagement.
Three parties: Practitioner + Responsible party + Intended users; The responsible party may also be a user. Practitioner must be independent in an assurance engagement.
Suitable criteria characteristics: Relevant, complete, reliable, neutral, understandable; Use these words when judging whether criteria are suitable.
Reasonable assurance: Engagement risk reduced to an acceptably low level; positive conclusion; Example: an audit. Not absolute assurance.
Limited assurance: Engagement risk reduced to an acceptable level, but higher than reasonable; negative-form conclusion; Example: a review. Work is mainly enquiry and analytical procedures.
Assurance levels: Audit = reasonable assurance (positive opinion); Review = limited assurance (negative conclusion); Both are assurance engagements. The difference is the level of risk accepted and the work done.
Negative assurance wording: "Based on our review, nothing has come to our attention that causes us to believe that the financial statements do not give a true and fair view / are not prepared, in all material respects, in accordance with [framework]."; Use the framework and fair presentation wording that matches the engagement. Do not say "in our opinion".
Main procedures: Enquiry + analytical procedures (+ further procedures if matters arise); No testing of controls and no detailed substantive procedures as a rule.
Choice of standard: Historical financial statements reviewed by a practitioner who is not the entity's auditor → ISRE 2400 (Revised); interim financial information reviewed by the entity's independent auditor → ISRE 2410; Check who the practitioner is and what is being reviewed in the scenario.
Modified conclusion: Material misstatement → qualified or adverse conclusion; inability to obtain evidence → qualified conclusion or disclaimer; management-imposed limitation → ask for removal, and if refused, disclaim a conclusion or withdraw where practicable; Pervasiveness decides between qualified and adverse or disclaimer. A limitation imposed by management is treated more strictly than evidence that is simply unavailable.
Nature of the engagement: AUP = agreed procedures + factual findings, with no assurance conclusion; The practitioner does not express an opinion or a conclusion. Users draw their own conclusions.
Independence: Independence not required, but the report must state whether the practitioner is independent; Objectivity and the ethical requirements still apply. The report must say that you are or are not independent. If you comply with independence requirements (for example the IESBA Code), the report should identify them.
Procedures must be: Procedures = clearly described, objective and capable of consistent results; Avoid vague terms such as 'review', 'satisfy yourself' or 'read'. Use terms such as 'agree', 'recalculate', 'inspect', 'confirm'.
Findings must be: Findings = factual and objectively verifiable, including exceptions; Report every exception found. Do not interpret or conclude.
Report content: Report = title, addressee, procedures, findings, statement of no assurance, independence statement, any restriction on use, date and signature; Include a statement that the engagement was performed under ISRS 4400 (Revised) and that it is not an audit or review. Consider whether to restrict use or distribution.
Level of assurance: Compilation = no assurance; review = limited assurance; audit = reasonable assurance; Only an audit and a review give assurance. A compilation is not an assurance engagement, so its report expresses no opinion or conclusion and must not use assurance wording such as 'true and fair' or 'nothing has come to our attention'.
Responsibility split: Management: the information, the records and the judgements and assumptions. Practitioner: compiling in line with ISRS 4410 and ethics.; Management's responsibility for the completeness and accuracy of the records and for the final information should be stated in the engagement letter and the report.
Core activities of the practitioner: Understand the entity and framework, then collect, classify and summarise, then read the result, then discuss with management, then report; The practitioner's expertise is accounting and financial reporting knowledge applied to management's data.
Content of the compilation report: Title, addressee, statement of what was compiled, management responsibility, practitioner responsibility, description of the engagement, statement of no assurance, date, practitioner details; Also include the applicable financial reporting framework and the basis of the information. The report says the engagement was performed in accordance with ISRS 4410 (Revised). Use a 'no opinion or conclusion' statement, not assurance wording.
Forecast: Forecast = PFI based on best-estimate assumptions; Assumptions reflect management's expected events and actions at the date of preparation.
Projection: Projection = PFI based on hypothetical assumptions (or a mix with best-estimate); Used for "what if" scenarios. Report must say it is a projection and warn on use.
Three matters to be satisfied about: Assumptions reasonable + PFI properly prepared on those assumptions + PFI properly presented; These are the core of the examination and the conclusion.
Form of assurance: Negative-assurance conclusion on assumptions; no assurance on achievability; Report states actual results are likely to differ from PFI.
Assumption test: Best-estimate assumptions: reasonable basis. Hypothetical assumptions: consistent with the purpose of the PFI; Different test for each type of assumption.
Elements of an assurance engagement (ISAE 3000): Three parties + appropriate subject matter + suitable criteria + sufficient appropriate evidence + written assurance report; If one element is missing, it is not an assurance engagement. Use this as a checklist in acceptance questions.
Characteristics of suitable criteria: Relevance, completeness, reliability, neutrality, understandability; Criteria must also be available to users. Say which characteristic fails in the scenario.
Reasonable assurance conclusion: Positive form: 'In our opinion, the subject matter information is, in all material respects, in accordance with the criteria'; Requires more extensive procedures, including risk assessment and testing of controls where relevant.
Limited assurance conclusion: Negative form: 'Nothing has come to our attention that causes us to believe...'; Mainly enquiry and analytical procedures. The report must make clear that the procedures were more limited.
ISAE 3402 report types: Type 1 = design and implementation at a date; Type 2 = design, implementation and operating effectiveness over a period; A Type 1 report gives no evidence that controls worked over time.
Main parties in a service organisation report: Service organisation (responsible party) → service auditor → user entity and user auditor; The report is for existing users and their auditors, not for prospective customers in general.

Quick revision

An assurance engagement has five elements: a three-party relationship, subject matter, suitable criteria, sufficient appropriate evidence and a written report.
Reasonable assurance gives a positive conclusion; limited assurance gives a negative-form conclusion and involves less work.
A review mainly uses enquiry and analytical procedures, not detailed testing.
A review gives limited assurance only; it is not an audit.
ISRE 2400 covers reviews of historical financial statements by a practitioner who is not the entity's auditor; ISRE 2410 covers reviews of interim financial information by the entity's auditor.
Agreed-upon procedures give no assurance; the report states factual findings and users draw their own conclusions.
In an AUP engagement, the procedures are agreed with the engaging party. The report describes the procedures and the factual findings. Use of the report may be restricted where appropriate, but the revised ISRS 4400 does not require this.
A compilation gives no assurance; the practitioner applies expertise in accounting and financial reporting to help prepare the information.
For compilations (ISRS 4410), the practitioner must comply with relevant ethical requirements, including professional competence and due care. Independence is not required, and the report states compliance with those requirements. For AUP (revised ISRS 4400), the practitioner must also comply with ethical requirements, and the report states whether the practitioner is independent or not required to be.
For prospective financial information, you examine the assumptions and how the information is prepared; you cannot confirm that the results will happen.
Forward-looking information carries inherent uncertainty, so the report should say that actual results may differ.
For integrated, ESG and internal control assurance, check that the criteria are suitable and the subject matter can be measured reliably.
In any scenario, name the engagement, state the assurance level, then apply the facts.

Common mistakes

Listing the five elements but not applying them to the scenario. Fix: For each element, name the specific party, subject matter or criterion from the scenario.
Saying reasonable assurance means absolute assurance or a guarantee. Fix: Say it is a high but not absolute level of assurance, because of inherent limitations.
Saying a review gives no assurance. Fix: A review is an assurance engagement with limited assurance. Compilation (ISRS 4410) and agreed-upon procedures (ISRS 4400) engagements provide no assurance.
Writing a positive opinion such as "in our opinion the statements give a true and fair view" in a review report. Fix: Use the negative form: nothing has come to our attention that causes us to believe the statements are materially misstated.
Giving an opinion or a negative assurance conclusion in the AUP report. Fix: Report only factual findings. State clearly that no assurance is provided.
Saying the practitioner must be independent. Fix: Say independence is not required for an AUP, but the report must state whether the practitioner is independent. Objectivity is still needed.
Saying a compilation gives limited assurance. Fix: Remember that only an audit and a review give assurance. A compilation is not an assurance engagement and gives none. The report states that the practitioner has only compiled the information and expresses no audit opinion or review conclusion.
Writing that independence is compulsory for a compilation. Fix: Say the fundamental ethical principles apply, but independence is not required. The report refers to independence only if the practitioner is required to be independent or chooses to be. Otherwise it states that ethical requirements were complied with.
Saying the practitioner gives assurance that the forecast will be achieved. Fix: State that assurance is only on the assumptions and preparation. Actual results will probably differ.
Confusing forecast and projection. Fix: Forecast = best-estimate assumptions. Projection = hypothetical assumptions. Say which applies.

Exam tips

Use the scenario. Marks go for applying each element to named parties, subject matter and criteria, not for defining terms.
When asked about suitability of criteria, use the five characteristics as headings and give a verdict on each.
Always link level of assurance to procedures, cost and the conclusion wording. Examiners reward that link.
Add a professional skills point: give a clear recommendation, such as accept, decline or change the engagement, and explain it to a non-expert reader.
Always state both the level of assurance and the form of conclusion when comparing a review with an audit.
Tie your procedures to the figures in the scenario. Generic lists of enquiries score poorly.
Learn the negative assurance wording until you can write it without help, and use the framework named in the scenario.
Show professional scepticism: management's explanation alone is not evidence, even in a review.