Advanced Audit and Assurance (International) · Reporting on other assignments

Assurance Engagements and ISAE 3000 for ACCA AAA

Updated 11 October 2026 · Fact-checked

An assurance engagement is where a practitioner gives a conclusion that increases the confidence of intended users in the outcome of measuring a subject matter against criteria. ISAE 3000 (Revised) covers assurance other than audits and reviews of historical financial information; ISSA 5000 is the sustainability standard. Reasonable assurance gives a positive opinion; limited assurance gives a negative-form conclusion.

Understand Assurance Engagements and ISAE 3000

An assurance engagement is an engagement where a practitioner aims to obtain sufficient appropriate evidence to express a conclusion. The conclusion is designed to increase the confidence of the intended users, other than the responsible party, about the outcome of measuring or evaluating a subject matter against criteria.

The IAASB Assurance Framework and ISAE 3000 (Revised) describe the elements. You must be able to list them and apply each to a scenario:
- A three-party relationship: the practitioner, the responsible party and the intended users. The three roles must be identifiable. The practitioner must be independent of the responsible party and the intended users. The roles of the other two parties can overlap in some cases. For example, the responsible party may also be one of the intended users (but not the only one), and the party who engages you may be different from the responsible party.
- An appropriate subject matter.
- Suitable criteria.
- Sufficient appropriate evidence.
- A written assurance report in a form appropriate to a reasonable assurance engagement or a limited assurance engagement.

ISAE 3000 (Revised) is the umbrella standard for assurance engagements that are neither audits nor reviews of historical financial information. Audits of historical financial information fall under the ISAs. Reviews fall under the ISREs.

Reviews under ISRE 2400 (Revised) and ISRE 2410 are limited assurance engagements. Agreed-upon procedures (ISRS 4400 (Revised)) and compilations (ISRS 4410 (Revised)) are related services, not assurance engagements.

ISSA 5000 (General Requirements for Sustainability Assurance Engagements) is the dedicated standard for sustainability assurance. It is effective for periods beginning on or after 15 December 2026 and can be used earlier. ISAE 3000 (Revised) continues to cover other non-historical-financial assurance, such as reports on controls and other non-financial information.

There are two levels of assurance. Reasonable assurance is a high, but not absolute, level. The conclusion is expressed positively, for example that the subject matter conforms, in all material respects, with the criteria. Limited assurance is a level that is meaningful but lower. The risk of an incorrect conclusion is higher, so fewer procedures are done, mainly enquiry and analytical procedures. The conclusion is expressed negatively, for example that nothing has come to your attention to suggest the subject matter is materially misstated.

Engagements can also be attestation engagements, where the responsible party measures the subject matter and you assess their statement, or direct engagements, where you measure the subject matter yourself against the criteria. In a direct engagement the responsible party is still responsible for the subject matter, and you remain independent of it. Both need suitable criteria. Criteria are suitable if they are relevant, complete, reliable, neutral and understandable. Without suitable criteria, you should not accept the engagement as an assurance engagement.

Availability is a separate requirement from suitability. The criteria must be made available to the intended users. This can be done in several ways, for example by publishing them, by disclosing them in the subject matter information or in the assurance report, or because they are generally understood. Criteria that are not published can still be used if they are disclosed to users in this way.

Key rules to remember

Five elements of an assurance engagement: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + assurance report; Learn this as a checklist. Test each element against the scenario. The three party roles must be identifiable, even if one entity fills more than one role.
Characteristics of suitable criteria: Relevant, complete, reliable, neutral, understandable; Use these five words when you assess whether criteria are suitable. Check separately that the criteria are available to the intended users.
Reasonable assurance conclusion: Positive form: in our opinion the subject matter conforms, in all material respects, with the criteria; Higher assurance, more extensive procedures, lower engagement risk.
Limited assurance conclusion: Negative form: nothing has come to our attention that causes us to believe the subject matter is materially misstated; Lower assurance, fewer procedures, mainly enquiry and analytical procedures.
Three parties: Practitioner, responsible party, intended users; The responsible party is responsible for the subject matter, even in a direct engagement where you measure it. The intended users are the people the report is for. The practitioner must be independent of the responsible party and the intended users. The responsible party may also be one of the intended users, but not the only one, and the engaging party may differ from the responsible party.

How to solve Assurance Engagements and ISAE 3000 questions

Use this method for any question on assurance engagements. It works for requirements that ask you to define, evaluate or advise.

1Read the requirement and mark the verb: explain, evaluate, advise or recommend. This tells you how much application is needed.
2Identify the subject matter and decide if it is an assurance engagement or a non-assurance service. Reviews under ISRE 2400 and 2410 are limited assurance engagements. Agreed-upon procedures (ISRS 4400) and compilation (ISRS 4410) are not assurance.
3Test the five elements one by one against the scenario. Note which are present and which are weak or missing.
4Assess the criteria for suitability using relevant, complete, reliable, neutral and understandable. Link each weak point to the scenario facts.
5Decide the level of assurance, reasonable or limited. Explain what that means for procedures, evidence and the wording of the conclusion.
6Consider acceptance matters: practitioner competence, ethics and independence, and whether the engagement has a rational purpose.
7State a clear recommendation or conclusion, and add a point on the report form and any modification needed.

Quickest way: Five-element checklist

When to use it: Use this when time is short or the requirement is a short written part, such as 5 or 6 marks.

Write the five elements as a vertical list in your answer plan.
Next to each, write one fact from the scenario that shows it is met or not met.
Add the assurance level and the conclusion wording in one line.
Turn each line into a sentence that starts with the point and ends with the scenario fact.

Common mistakes in Assurance Engagements and ISAE 3000

Saying limited assurance means no evidence is needed.
Students focus on the lower level and forget it must still be meaningful.
Fix: State that limited assurance still needs sufficient appropriate evidence for a meaningful level. The procedures are fewer and mainly enquiry and analytical.
Listing the five elements without applying them to the scenario.
It feels safe to recite learned content.
Fix: Add a scenario fact to every element. Marks go to application and professional skills, not recall.
Using a positive opinion for a limited assurance engagement.
Students copy audit report wording by habit.
Fix: Use negative-form wording for limited assurance and positive-form wording for reasonable assurance.
Accepting criteria set by the client without testing them.
Management-developed criteria look convenient.
Fix: Test the criteria against relevant, complete, reliable, neutral and understandable. Then check they are available to users, for example by disclosure in the subject matter information or the assurance report.
Treating agreed-upon procedures or compilations as assurance, or treating reviews as non-assurance.
All of these involve a practitioner performing procedures and reporting, so the lines blur.
Fix: Remember that agreed-upon procedures (ISRS 4400) give findings, not a conclusion, and compilations (ISRS 4410) give no conclusion either, so neither provides assurance. Reviews under ISRE 2400 and 2410 are limited assurance engagements.
Ignoring the three-party relationship.
Students think of the audit, where the user and responsible party overlap in practice.
Fix: Name the practitioner, the responsible party and the intended users. The three roles must be identifiable. The practitioner must be independent of the responsible party and the intended users. The other roles can overlap, for example the responsible party may also be an intended user, or the engaging party may be someone other than the responsible party. There must be intended users other than the responsible party. In a direct engagement you measure the subject matter, but the responsible party is still responsible for it. If the roles cannot be identified, it is not an assurance engagement.

Worked examples

Example 1

A client asks you to report on its sustainability report. Management has chosen its own measurement methods and has not published them. The board wants a conclusion for lenders. Evaluate whether this can be an assurance engagement and advise on the level of assurance. (8 marks)

Show the solution

Standard: sustainability assurance is performed under ISSA 5000, which is effective for periods beginning on or after 15 December 2026 and can be used earlier. Before ISSA 5000 applies or is adopted, ISAE 3000 (Revised) is used. The five elements and the two levels of assurance are the same either way.
Three parties: you are the practitioner, management is the responsible party and the lenders are the intended users. This element is met.
Subject matter: the sustainability report is identifiable and can be evaluated, so it is appropriate if the information is capable of consistent measurement.
Criteria, suitability: management has chosen its own methods. They may lack neutrality and completeness, so you must test them against relevant, complete, reliable, neutral and understandable. Until that is done, you cannot say they are suitable.
Criteria, availability: the methods are not published. That is not fatal by itself, because criteria can be made available by disclosing them in the sustainability report or in your assurance report. Until they are disclosed, the lenders cannot understand the basis of the conclusion.
Evidence: you can obtain evidence only if the methods are documented and data sources are accessible. This must be confirmed before acceptance.
Report: a written report is needed. Without suitable criteria it would be misleading to give an assurance conclusion.
Level of assurance: reasonable assurance needs more extensive procedures and may be hard to achieve at first. Limited assurance is more realistic for a first-time report, with a negative-form conclusion.
Recommendation: make acceptance conditional on management documenting its criteria, on you confirming they are suitable, and on the criteria being disclosed to the lenders, ideally using a recognised framework. Otherwise decline the assurance engagement.

Answer: Under ISSA 5000 (or ISAE 3000 (Revised) where ISSA 5000 does not yet apply), you cannot accept this as an assurance engagement as it stands, because the suitability of the criteria is unproven and they are not yet available to the lenders. If management adopts criteria you find suitable and discloses them to users, you can accept a limited assurance engagement with a negative-form conclusion.

Example 2

Explain the difference between reasonable and limited assurance under ISAE 3000 (Revised), and say how the conclusion would be worded in each. (6 marks)

Show the solution

Define reasonable assurance: a high, but not absolute, level where engagement risk is reduced to an acceptably low level.
Define limited assurance: a level that is meaningful, but where engagement risk is greater than for reasonable assurance.
Procedures: reasonable assurance needs more extensive procedures, including testing and corroboration. Limited assurance relies mainly on enquiry and analytical procedures.
Conclusion in reasonable assurance: positive form, for example that the subject matter conforms, in all material respects, with the criteria.
Conclusion in limited assurance: negative form, for example that nothing has come to your attention to suggest the subject matter is materially misstated.
Practical point: limited assurance is usually cheaper and quicker, but gives users less comfort. Users must be told clearly which level they are getting.

Answer: Reasonable assurance gives high assurance through extensive procedures and a positive-form conclusion. Limited assurance gives a meaningful but lower level through fewer procedures, mainly enquiry and analytical, and a negative-form conclusion.

Exam tips

Always apply the five elements to the scenario facts. A bare list earns little.
Use the word 'suitable' with the five criteria characteristics when a question mentions criteria.
When asked about the level of assurance, cover procedures and wording of the conclusion, not only the definition.
Show professional scepticism and commercial acumen. For example, comment on whether the client's real aim is to obtain comfort for lenders or just to market its report.
Keep the structure tidy with short headed paragraphs. Clear communication earns professional skills marks.

Practice questions from Reporting on other assignments

Assurance Engagements and ISAE 3000 in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Assurance Engagements and ISAE 3000: frequently asked questions

What are the five elements of an assurance engagement?

They are a three-party relationship, an appropriate subject matter, suitable criteria, sufficient appropriate evidence and a written assurance report. In the exam, test each one against the scenario.

What is the difference between reasonable and limited assurance?

Reasonable assurance is a high level, gained from extensive procedures, and gives a positive-form conclusion. Limited assurance is a lower but meaningful level, gained mainly from enquiry and analytical procedures, and gives a negative-form conclusion.

When is ISAE 3000 (Revised) used?

It is used for assurance engagements other than audits or reviews of historical financial information. Typical examples are controls reports and other non-financial information. Sustainability assurance is covered by ISSA 5000, which is effective for periods beginning on or after 15 December 2026 and can be used earlier.

What is the difference between attestation and direct engagements?

In an attestation engagement, the responsible party measures the subject matter and you report on their statement. In a direct engagement, you measure the subject matter yourself against the criteria and report the outcome.