Reporting on other assignments: formula sheet

Key formulas

Five elements of an assurance engagement

Three parties + subject matter + suitable criteria + sufficient appropriate evidence + assurance report

Learn this as a checklist. Test each element against the scenario. The three party roles must be identifiable, even if one entity fills more than one role.

Characteristics of suitable criteria

Relevant, complete, reliable, neutral, understandable

Use these five words when you assess whether criteria are suitable. Check separately that the criteria are available to the intended users.

Reasonable assurance conclusion

Positive form: in our opinion the subject matter conforms, in all material respects, with the criteria

Higher assurance, more extensive procedures, lower engagement risk.

Limited assurance conclusion

Negative form: nothing has come to our attention that causes us to believe the subject matter is materially misstated

Lower assurance, fewer procedures, mainly enquiry and analytical procedures.

Three parties

Practitioner, responsible party, intended users

The responsible party is responsible for the subject matter, even in a direct engagement where you measure it. The intended users are the people the report is for. The practitioner must be independent of the responsible party and the intended users. The responsible party may also be one of the intended users, but not the only one, and the engaging party may differ from the responsible party.

Level of assurance in a review

Review = limited assurance (negative form). Audit = reasonable assurance (positive form).

Limited assurance means risk is reduced to an acceptable level, but higher than in an audit.

Unmodified conclusion: fair presentation framework

Based on our review, nothing has come to our attention that causes us to believe that the financial statements do not give a true and fair view (or do not present fairly, in all material respects) in accordance with [the applicable financial reporting framework].

Use this wording when the framework is a fair presentation framework. Negative form is the key feature.

Unmodified conclusion: compliance framework

Based on our review, nothing has come to our attention that causes us to believe that the financial statements are not prepared, in all material respects, in accordance with [the applicable financial reporting framework].

Use this wording when the framework is a compliance framework. Do not mix it with the true and fair wording.

Main procedures

Enquiry + analytical procedures + other procedures if something looks misstated.

Additional procedures are triggered by matters that suggest possible material misstatement.

Modified conclusions

Qualified (except for) | Adverse | Disclaimer (unable to conclude).

Misstatement: material but not pervasive = qualified; material and pervasive = adverse. Limitation of scope: material but not pervasive = qualified; material and pervasive = disclaimer (or withdraw from the engagement where possible).

Key written representations

Management confirms it has fulfilled its responsibility for the statements and has given you all relevant information.

Without them, you cannot complete the review.

Forecast

Forecast = PFI based on best-estimate assumptions (expected events and actions)

Suitable for general and limited use.

Projection

Projection = PFI based on hypothetical assumptions, or a mix of hypothetical and best-estimate

Suitable only for limited use, for example negotiations with a specific party.

Scope of the practitioner's examination

Examine (1) support for assumptions, (2) proper preparation on those assumptions, (3) proper presentation and disclosure

These three areas drive both the procedures and the report.

Conclusion on assumptions

Negative assurance: nothing has come to attention that the assumptions are not a reasonable basis (forecast) or are not consistent with the purpose (projection)

Assurance is on the assumptions, never on achievement of the results.

Opinion on preparation

Opinion: PFI is properly prepared on the basis of the assumptions and presented in accordance with the relevant framework

Positive-form opinion on preparation and presentation.

AUP outcome

Procedures agreed → performed → factual findings reported (no opinion, no conclusion)

The user draws conclusions from the findings. The practitioner does not.

Compilation outcome

Management's data + practitioner's expertise → financial information; no assurance

The practitioner is not required to verify the data or obtain evidence on it. But you must consider information that looks incorrect, incomplete or inconsistent and raise it with management. The report states that no assurance is given.

Assurance spectrum

Audit = reasonable assurance; review = limited assurance; AUP and compilation = no assurance

Use this ladder to compare engagements in any written answer.

Independence in related services

Independence is not required, but the report includes a statement about the practitioner's independence or otherwise

Ethical requirements, including the fundamental principles, still apply.

Key AUP report content

Title, addressee, statement that the engagement was performed under ISRS 4400 (Revised), is not an assurance engagement and gives no opinion or conclusion, procedures performed, factual findings, independence statement, purpose and restriction on use, date, signature

Learn this as a checklist and apply it to the scenario.

Elements of an assurance engagement

Three-party relationship + appropriate subject matter + suitable criteria + sufficient appropriate evidence + written report

Use this as a checklist when asked whether an engagement is a valid assurance engagement.

Suitable criteria

Relevance, completeness, reliability, neutrality, understandability

Criteria that fail these tests make the engagement hard to accept or the conclusion hard to give.

Limited assurance conclusion

Negative form: nothing has come to our attention that causes us to believe the information is materially misstated

Less evidence work than reasonable assurance. The report must make the lower level of assurance clear.

Reasonable assurance conclusion

Positive form: in our opinion the information is prepared, in all material respects, in accordance with the criteria

Higher assurance, but still not absolute.

Core evidence approach

Understand the entity and its controls → assess risks of material misstatement → design and perform responses → evaluate evidence → conclude and report

The same risk-based logic as an audit applies, scaled to the assurance level.

Audit versus due diligence

Audit = opinion on financial statements for members; Due diligence = findings for a buyer on a target's value and risk

Due diligence is forward looking, client-defined in scope and usually restricted in use. An audit is historical and follows ISAs.

ISAE 3402 Type 1

Type 1 = description of system + suitability of control design, at a specified date

It says nothing about whether controls actually operated.

ISAE 3402 Type 2

Type 2 = Type 1 content + operating effectiveness of controls over a specified period

Includes the service auditor's tests of controls and results. It is more useful to users.

Parties in a service organisation report

Service organisation (management assertion) → service auditor (opinion) → user entities and their auditors

Users' auditors apply ISA 402 when deciding how far to rely on the report.

Forensic evidence rule

Obtain → preserve → document chain of custody → report factual findings

Improper handling can make evidence inadmissible.

Level of assurance

Audit under the ISAs = reasonable assurance on the financial statements. ISAE 3402 Type 2 report = reasonable assurance opinion on the description, design and operating effectiveness of controls. ISAE 3402 Type 1 report = reasonable assurance on the description and design only, with no assurance on operating effectiveness. Agreed-upon procedures = no assurance. Forensic investigations are normally not assurance engagements and give findings or factual reports. Due diligence depends on the engagement terms and is usually findings-based with no formal assurance conclusion.

State the level in every answer, because it drives report wording and liability. For due diligence and forensic work, check what the engagement letter actually promises.

Quick revision

• Assurance engagement elements: three-party relationship, subject matter, criteria, evidence and a report.
• Reasonable assurance gives a positive conclusion; limited assurance gives a negative-form conclusion.
• Limited assurance work relies mainly on enquiry and analytical procedures, with less evidence than reasonable assurance.
• A review engagement under ISRE 2400 gives limited assurance on historical financial statements.
• Prospective information work covers assumptions and preparation, and the report states that actual results may differ.
• An AUP report gives findings only; the users draw their own conclusions and no assurance is given.
• In AUPs, the procedures must be agreed with the parties, and the report is restricted to them.
• A compilation gives no assurance; the accountant helps prepare the information.
• Sustainability and integrated reports need clear criteria; lack of suitable criteria is a major risk.
• Due diligence and forensic work: define scope in the engagement letter and manage the risk of reliance by third parties.
• Always check competence, independence and ethics before accepting any non-audit engagement.
• Apply each point to the scenario facts and finish with a clear recommendation.

Common mistakes

• Saying limited assurance means no evidence is needed. Fix: State that limited assurance still needs sufficient appropriate evidence for a meaningful level. The procedures are fewer and mainly enquiry and analytical.
• Listing the five elements without applying them to the scenario. Fix: Add a scenario fact to every element. Marks go to application and professional skills, not recall.
• Saying a review gives no assurance or assurance that the statements are true and fair. Fix: A review gives limited assurance in negative form. An audit gives reasonable assurance in positive form. AUP gives no assurance.
• Writing a positive conclusion, such as 'the financial statements give a true and fair view'. Fix: Use 'nothing has come to our attention that causes us to believe...'. Practise this phrase until it is automatic.
• Saying the practitioner guarantees or gives assurance that the forecast will be achieved. Fix: State that assurance covers only assumptions, preparation and presentation. Actual results will probably differ.
• Mixing up forecast and projection. Fix: Forecast means best-estimate assumptions. Projection means hypothetical or mixed. Always label which one the scenario describes.
• Saying an AUP report gives a conclusion or a negative assurance statement. Fix: Write that an AUP report gives factual findings only. Users form their own conclusions.
• Using vague procedures such as "review the receivables" in an AUP. Fix: Describe each procedure in specific, objective terms that give the same result whoever performs them, for example "agree amounts to bank statements and report differences".
• Treating the engagement as a normal financial statement audit. Fix: Use assurance engagement language. Name the criteria, the level of assurance and the form of conclusion.
• Ignoring whether the criteria are suitable. Fix: Test criteria for relevance, completeness, reliability, neutrality and understandability before accepting the work.

Exam tips

• Always apply the five elements to the scenario facts. A bare list earns little.
• Use the word 'suitable' with the five criteria characteristics when a question mentions criteria.
• When asked about the level of assurance, cover procedures and wording of the conclusion, not only the definition.
• Show professional scepticism and commercial acumen. For example, comment on whether the client's real aim is to obtain comfort for lenders or just to market its report.
• Keep the structure tidy with short headed paragraphs. Clear communication earns professional skills marks.
• Always write 'limited assurance' and 'negative form' in your first lines. Examiners look for these exact ideas.
• Link procedures to the scenario. A generic list of enquiries earns fewer marks than enquiry about the specific red flag.
• Practise the conclusion wording until you can write it from memory, then adapt it for qualified, adverse and disclaimer cases.