Advanced Audit and Assurance (International) · Audit-related and assurance services

Assurance Engagements: Framework and Elements for ACCA AAA

Updated 11 October 2026 · Fact-checked

An assurance engagement is one where a practitioner gives a conclusion that increases the confidence of intended users about a subject matter, measured against criteria. It has five elements: three-party relationship, subject matter, criteria, evidence and an assurance report. The conclusion is either reasonable or limited assurance.

Understand Assurance Engagements: Framework and Elements

Assurance is about trust. A party wants to rely on information but cannot check it. An independent practitioner checks it and gives a conclusion. The IAASB's Assurance Framework describes what makes an engagement an assurance engagement and sets the ground rules for standards such as ISAs, ISREs and ISAEs.

The framework identifies five elements. First, a three-party relationship: the practitioner, the responsible party and the intended users. Second, an appropriate subject matter, such as financial statements, a forecast, controls or sustainability data. Third, suitable criteria used to measure the subject matter. Fourth, sufficient appropriate evidence. Fifth, a written assurance report in the form suited to the engagement.

Criteria are suitable if they are relevant, complete, reliable, neutral and understandable. Without suitable criteria, users cannot judge the result, so you cannot accept an assurance engagement. The subject matter must also be identifiable and capable of consistent evaluation against the criteria.

The level of assurance is the second big idea. In a reasonable assurance engagement, the practitioner reduces engagement risk to an acceptably low level and gives a positive conclusion, such as 'in our opinion the financial statements give a true and fair view'. In a limited assurance engagement, risk is reduced to a level that is acceptable but greater than in reasonable assurance. The conclusion is negative in form, such as 'nothing has come to our attention that causes us to believe...'. Limited assurance needs less work, mainly enquiry and analytical procedures.

Engagements can also be attestation engagements, where the responsible party measures the subject matter and the practitioner concludes on it, or direct engagements, where the practitioner measures it against the criteria. An audit of financial statements is a reasonable assurance attestation engagement. A review under ISRE 2400 or 2410 is limited assurance. Agreed-upon procedures and compilations give no assurance, because no conclusion is expressed on the information.

Key rules to remember

Five elements of an assurance engagement: Three parties + Subject matter + Suitable criteria + Sufficient appropriate evidence + Assurance report; Learn this as a checklist. Missing any one means it is not an assurance engagement.
Three parties: Practitioner + Responsible party + Intended users; The responsible party may also be a user. Practitioner must be independent in an assurance engagement.
Suitable criteria characteristics: Relevant, complete, reliable, neutral, understandable; Use these words when judging whether criteria are suitable.
Reasonable assurance: Engagement risk reduced to an acceptably low level; positive conclusion; Example: an audit. Not absolute assurance.
Limited assurance: Engagement risk reduced to an acceptable level, but higher than reasonable; negative-form conclusion; Example: a review. Work is mainly enquiry and analytical procedures.

How to solve Assurance Engagements: Framework and Elements questions

Use this method for any question on whether an engagement is assurance, what its elements are, or what level of assurance applies.

1Read the requirement. Decide if it asks you to identify elements, assess suitability, compare levels, or draft a conclusion.
2Identify the three parties in the scenario. Name who the practitioner, responsible party and users are.
3Pin down the subject matter and the criteria. Say whether the criteria are suitable using relevant, complete, reliable, neutral and understandable.
4Decide the level of assurance. Link it to the user need, the cost and the nature of the procedures requested.
5State the evidence approach. Reasonable assurance needs extensive procedures; limited assurance mainly enquiry and analytical procedures.
6Describe the report: positive or negative-form conclusion, and any needed restrictions on use or distribution.
7Apply to the facts. Name specific points from the scenario and give a clear recommendation, such as accept, decline or change the engagement.

Quickest way: The 3-2-1 check

When to use it: When you have only a few minutes and the question asks if something is an assurance engagement or what level it is.

Check the three parties are all present.
Check the two things that measure: subject matter and suitable criteria.
Check the one outcome: evidence leading to a written conclusion.
If a conclusion is given, ask whether it is positive (reasonable) or negative (limited).
If no conclusion is expressed, say it is not assurance, such as agreed-upon procedures.

Common mistakes in Assurance Engagements: Framework and Elements

Listing the five elements but not applying them to the scenario.
Students memorise the list and write it out for marks.
Fix: For each element, name the specific party, subject matter or criterion from the scenario.
Saying reasonable assurance means absolute assurance or a guarantee.
The word 'reasonable' is mixed up with 'complete'.
Fix: Say it is a high but not absolute level of assurance, because of inherent limitations.
Writing a positive conclusion for a limited assurance engagement.
Students copy audit opinion wording.
Fix: Use negative form: 'nothing has come to our attention that causes us to believe...'.
Treating agreed-upon procedures as limited assurance.
Both involve less work than an audit.
Fix: Remember AUP gives findings only. No conclusion, so no assurance.
Accepting vague criteria such as 'good performance'.
Students focus on whether evidence exists, not on how it is measured.
Fix: Test the criteria against relevant, complete, reliable, neutral and understandable. If not suitable, advise declining or agreeing criteria first.
Forgetting that the practitioner must be independent and competent.
Ethics is treated as a separate topic.
Fix: Add a line on independence, ethical requirements and quality management when discussing acceptance.

Worked examples

Example 1

Greenfield Co asks your firm to report on its annual sustainability report. The report is measured against criteria the directors wrote themselves, stating 'we aim to be a leader in environmental care'. Evaluate whether this can be an assurance engagement. (8 marks)

Show the solution

Three parties: your firm is the practitioner, the directors are the responsible party, and users such as investors and lenders are the intended users. This element is met.
Subject matter: the sustainability report data is identifiable and could be evaluated, if it is specific and measurable.
Criteria: the stated aim is vague. It is not relevant or complete, and not objectively measurable, so it is not reliable, neutral or understandable.
Without suitable criteria, users cannot judge the result and the practitioner cannot reach a consistent conclusion.
Evidence and report: evidence could be gathered, but it cannot be tested against a clear benchmark.
Recommendation: do not accept until the directors adopt suitable criteria, such as a recognised reporting framework or clear, published definitions of each metric. Then decide the level of assurance.

Answer: As it stands, this is not an assurance engagement. The criteria are not suitable. The firm should decline, or accept only after suitable criteria are agreed and applied.

Example 2

Explain to the board of Delta Co the difference between a reasonable assurance and a limited assurance engagement on its half-year financial information, and recommend which suits a lender wanting low-cost comfort. (8 marks)

Show the solution

Reasonable assurance: the practitioner reduces engagement risk to an acceptably low level and gives a positive conclusion. An audit is the example.
Limited assurance: engagement risk is acceptable but higher. The conclusion is in negative form. A review is the example.
Procedures: reasonable assurance requires risk assessment, testing of controls where relevant, and substantive tests. Limited assurance relies mainly on enquiry and analytical procedures.
Cost and time: limited assurance is cheaper and quicker because there is less work.
Users' needs: a lender seeking low-cost comfort on interim figures may be satisfied with a moderate level of comfort.
Recommendation: a limited assurance review of the half-year information, with a note that the level of comfort is lower than an audit.

Answer: Reasonable assurance gives a high, positive-form conclusion through extensive procedures. Limited assurance gives a lower, negative-form conclusion through mainly enquiry and analytics. A limited assurance review is recommended for the lender's low-cost need.

Exam tips

Use the scenario. Marks go for applying each element to named parties, subject matter and criteria, not for defining terms.
When asked about suitability of criteria, use the five characteristics as headings and give a verdict on each.
Always link level of assurance to procedures, cost and the conclusion wording. Examiners reward that link.
Add a professional skills point: give a clear recommendation, such as accept, decline or change the engagement, and explain it to a non-expert reader.

Practice questions from Audit-related and assurance services

Assurance Engagements: Framework and Elements in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Assurance Engagements: Framework and Elements: frequently asked questions

What are the five elements of an assurance engagement?

They are a three-party relationship, an appropriate subject matter, suitable criteria, sufficient appropriate evidence and a written assurance report. In the exam, apply each to the scenario instead of only listing them.

What is the difference between reasonable and limited assurance?

Reasonable assurance reduces engagement risk to an acceptably low level and gives a positive conclusion. Limited assurance accepts a higher level of risk and gives a negative-form conclusion. Limited assurance needs less work, mainly enquiry and analytical procedures.

Is an audit an assurance engagement?

Yes. An audit of financial statements is a reasonable assurance engagement. The auditor gives a positive opinion on the financial statements against a financial reporting framework.

Are agreed-upon procedures assurance engagements?

No. The practitioner reports factual findings from procedures agreed with the engaging party, and no conclusion is expressed. Users draw their own conclusions, so there is no assurance.