Advanced Audit and Assurance (International) · Specific assignments

Assurance Engagements and ISAE 3000 for ACCA AAA

Updated 11 October 2026 · Fact-checked

An assurance engagement is where a practitioner gives a conclusion that increases the confidence of intended users about a subject matter measured against criteria. ISAE 3000 governs non-audit, non-review assurance. To answer questions, identify the five elements, the assurance level, and the right report form. Agreed-upon procedures and compilations give no assurance.

Understand Audit Related Services and Assurance Engagements

Start with the idea of assurance. A practitioner evaluates or measures a subject matter against criteria, and gives a conclusion that enhances the confidence of the intended users in the outcome of that evaluation or measurement. The intended users are the persons for whom the practitioner prepares the assurance report. The responsible party is responsible for the subject matter. It may also be one of the intended users, but it is not the only intended user. A statutory audit is one type. Many other assignments follow the same logic.

The IAASB Framework and ISAE 3000 (Revised) cover assurance engagements that are not audits or reviews of historical financial information. Examples are reports on sustainability data, internal controls, or a service organisation. Audits use the ISAs. Reviews of historical financial information use ISRE 2410 where the entity's independent auditor reviews interim financial information. They use ISRE 2400 (Revised) where a practitioner who is not the entity's auditor performs a review engagement on historical financial statements.

An engagement has five elements: a three-party relationship (practitioner, responsible party, intended users); an appropriate subject matter; suitable criteria; sufficient appropriate evidence; and a written assurance report. If any element is missing, it is probably not an assurance engagement. Criteria must be relevant, complete, reliable, neutral and understandable.

There are two assurance levels. Reasonable assurance is high but not absolute. The conclusion is positive, such as 'in our opinion, the subject matter is fairly stated'. Limited assurance is a lower level, mainly enquiry and analytical procedures. It must still be a meaningful level of assurance, supported by sufficient appropriate evidence. The conclusion is negative, such as 'nothing has come to our attention that causes us to believe...'. The risk of a wrong conclusion is higher in limited assurance, so the report must be clear about what was done.

Not every assignment is assurance. In an agreed-upon procedures engagement (ISRS 4400 (Revised)), you perform procedures agreed with the engaging party and report the factual findings. You give no opinion and no conclusion. Users draw their own conclusions. The standard does not require the report to be restricted. The report does describe the purpose of the procedures, and you may consider whether to limit its distribution or use. In a compilation engagement (ISRS 4410), you help management prepare financial information using your accounting expertise. You give no assurance either. In all cases, ethics, quality management and professional scepticism still apply.

Key rules to remember

Five elements of an assurance engagement: Three parties + subject matter + suitable criteria + sufficient appropriate evidence + written report; Use this as a checklist when a scenario asks whether an assignment is assurance.
Reasonable assurance conclusion: Positive form: 'In our opinion, the subject matter conforms, in all material respects, to the criteria'; High level of assurance, based on extensive evidence-gathering. Risk is reduced to an acceptably low level.
Limited assurance conclusion: Negative form: 'Nothing has come to our attention to cause us to believe the subject matter is materially misstated'; Fewer procedures, mainly enquiry and analytics. Risk is higher than reasonable assurance but the level must still be meaningful, with sufficient appropriate evidence.
Suitable criteria characteristics: Relevant, complete, reliable, neutral, understandable; Unsuitable criteria mean you should not accept the engagement.
Non-assurance assignments: Agreed-upon procedures = factual findings only; compilation = no assurance; No opinion or conclusion is expressed in either. In agreed-upon procedures you report the procedures performed and the factual findings. In a compilation you issue a compilation report that gives no assurance. Under ISRS 4400 (Revised) the standard does not require the AUP report to be restricted.

How to solve Audit Related Services and Assurance Engagements questions

Use this method for any question on assignments other than a statutory audit. It keeps your answer structured and earns professional skills marks.

1Read the requirement and note the verb: explain, discuss, evaluate, recommend, or draft.
2Identify the type of assignment from the scenario: audit, review, assurance under ISAE 3000, agreed-upon procedures, or compilation.
3Test it against the five elements. Name any missing element, especially the three-party relationship (practitioner, responsible party and intended users) or suitable criteria.
4Decide the assurance level and say why: reasonable needs extensive evidence; limited suits lower cost or narrower user needs, but still needs a meaningful level of assurance.
5Link to the scenario: what evidence and procedures apply here, and what are the risks, such as unsuitable criteria or limited access.
6Cover acceptance and ethics: competence, independence, scope limitations, use of experts and engagement terms.
7State the form of the report: positive or negative conclusion, or factual findings only. Where relevant, consider whether to limit the distribution or use of the report.
8Finish with a clear recommendation or conclusion, written for the reader in the scenario.

Quickest way: Four-question triage

When to use it: Use when time is short and you must classify an assignment quickly before writing.

Is there a conclusion or opinion? If no, it is agreed-upon procedures or a compilation.
Is there a three-party relationship (practitioner, responsible party, intended users) and are there suitable criteria? If either is missing, it is probably not an assurance engagement.
Is evidence extensive or mostly enquiry and analytics? Extensive means reasonable; enquiry means limited.
Write the matching report wording and the key limitation, in one line each.

Common mistakes in Audit Related Services and Assurance Engagements

Saying agreed-upon procedures give limited assurance.
Students see fewer procedures and assume a lower level of assurance.
Fix: State that no assurance is given. The practitioner reports factual findings only and users draw their own conclusions.
Describing limited assurance as 'no work' or a weak audit.
The negative wording sounds less rigorous.
Fix: Explain that it is a meaningful level of assurance, achieved mainly through enquiry and analytical procedures, supported by sufficient appropriate evidence, with higher risk of a wrong conclusion.
Ignoring the criteria.
Students focus on procedures and forget that assurance is measured against criteria.
Fix: Always comment on whether criteria are relevant, complete, reliable, neutral and understandable, and whether users can access them.
Using audit terminology and ISAs for every assurance assignment.
The audit is the most familiar engagement.
Fix: Refer to ISAE 3000 for other assurance, ISRE 2410 for interim reviews by the entity's auditor, ISRE 2400 (Revised) for reviews by a practitioner who is not the entity's auditor, and ISRS 4400 (Revised) and 4410 for agreed-upon procedures and compilations.
Giving generic answers that do not use the scenario.
Students recite theory under time pressure.
Fix: Tie every point to a fact in the scenario, such as the client, the subject matter or the user, to earn application and professional skills marks.

Worked examples

Example 1

A client's bank requires a report on whether the client's quarterly sales covenant calculation has been prepared correctly. The bank wants you to check specified figures to the ledger and report what you find. It will decide itself whether the covenant is met. Identify the type of engagement and explain the report you would issue.

Show the solution

The bank specifies the procedures and wants to form its own view. No conclusion is requested.
This is an agreed-upon procedures engagement under ISRS 4400 (Revised), not assurance.
The procedures must be agreed with the engaging party and described clearly, for example agreeing sales figures to the ledger and recalculating the covenant ratio.
The report lists the procedures performed and the factual findings, including any exceptions.
It states that the work is not an audit or review and that no assurance is expressed. The report describes the purpose of the procedures. The standard does not require the report to be restricted, but you may consider whether to limit its distribution or use, for example to the bank and the client.

Answer: It is an agreed-upon procedures engagement. You issue a report of factual findings with no opinion or assurance conclusion. The bank draws its own conclusion on the covenant.

Example 2

A listed client wants a report on its greenhouse gas emissions statement, prepared using a published reporting protocol. The board asks why you recommend limited assurance first rather than reasonable assurance. Explain the difference and how the conclusion would be worded.

Show the solution

The engagement has the five elements: three parties, subject matter (emissions data), criteria (the published protocol), evidence and a written report. It falls under ISAE 3000.
Reasonable assurance needs extensive evidence, such as testing controls over data collection and detailed testing. It gives a positive opinion.
Limited assurance relies mainly on enquiry, analytical procedures and some corroboration. It costs less and takes less time, but it still needs sufficient appropriate evidence for a meaningful level of assurance.
Limited assurance may suit a first engagement on cost and scope grounds. Immature data systems are a risk, though. They may limit even a limited assurance engagement, make the criteria hard to apply, or lead to a scope limitation. Reasonable assurance can follow once controls improve.
Limited assurance gives a negative-form conclusion: nothing has come to our attention that causes us to believe the statement is materially misstated against the protocol. Reasonable assurance gives a positive opinion.

Answer: Limited assurance is lower cost and may suit a first engagement, provided sufficient appropriate evidence can be obtained. Immature data systems may restrict the work or require a scope limitation. It gives a negative-form conclusion. Reasonable assurance gives a positive opinion based on more extensive evidence. The board can move to reasonable assurance later as controls improve.

Exam tips

Classify first. Examiners often test whether an assignment is assurance at all. Say so in your first line.
Always contrast reasonable and limited assurance by evidence, risk and the form of conclusion, and apply it to the scenario.
For agreed-upon procedures and compilations, write the word 'no assurance' explicitly and explain why.
Comment on criteria and intended users in every ISAE 3000 answer. These are easy marks that students skip.
Use professional skills: be sceptical, write for the named reader, and finish with a clear recommendation.

Practice questions from Specific assignments

Audit Related Services and Assurance Engagements in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Audit Related Services and Assurance Engagements: frequently asked questions

What is the difference between reasonable and limited assurance?

Reasonable assurance is a high level of assurance, based on extensive evidence, and gives a positive opinion. Limited assurance is lower, relies mainly on enquiry and analytical procedures, and gives a negative-form conclusion. The risk of a wrong conclusion is greater in limited assurance.

How does agreed-upon procedures differ from an audit?

An audit gives an opinion on financial statements after evidence gathering set by the auditor. An agreed-upon procedures engagement applies procedures agreed with the engaging party and reports factual findings only. It gives no opinion and no assurance.

When does ISAE 3000 apply?

ISAE 3000 applies to assurance engagements other than audits or reviews of historical financial information. Typical subject matters are sustainability information, internal controls and service organisation controls.

How should I answer assurance engagement questions in the AAA exam?

Identify the engagement type, test it against the five elements, state the assurance level and report form, then apply each point to the scenario. Finish with a clear recommendation to earn professional skills marks.