The International Auditing and Assurance Standards Board (IAASB) has issued a revised standard on assurance engagements other than audits or reviews of historical information, such as financial statements.
The revised standard would apply to engagements such as statements on the effectiveness of internal control, and assurance reports on sustainability reports and integrated reports. The revised standard provides guidance on the concepts of 'reasonable assurance' and 'limited assurance', and has guidance on the differences between the two levels of assurance.
The revised International Standard on Assurance Engagements (ISAE), ISAE 3000 Assurance Engagements other than Audits or Reviews of Historical Financial Information, contains requirements and application and other explanatory material specific to reasonable and limited assurance attestation engagements, but can also be applied to 'direct engagements' if the requirements are adapted and supplemented as necessary.
An assurance engagement is one in "which a practitioner aims to obtain sufficient appropriate evidence in order to express a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the subject matter information (that is, the outcome of the measurement or evaluation of an underlying subject matter against criteria)."
Accordingly, the ISAE requires the practitioner to obtain an understanding of the underlying subject matter and respond to risks of material misstatement in the subject matter information.
The selection of appropriate criteria is also a key part of applying the ISAE, and are determined in the context of the engagement circumstances using the exercise of professional judgement.
The ISAE provides the example of customer satisfaction being measured by reference to the number of resolved customer complaints, or alternatively by reference to the number of repeat purchases made in a period of time following an initial purchase (of course, many other measures may be available and relevant to an engagement).
The practitioner is required to assess the suitability of the criteria and the assurance report identifies the applicable criteria against which the underlying subject matter was measured or evaluated, including where relevant the source of the criteria, measurement or evaluation methods used, significant interpretations made and changes in methods used.
The ISAE outlines the various professional requirements a practitioner must following in undertaking their work, such as ethical requirements, engagement acceptance, quality control, and planning and performing the engagement, and the reporting obligations.
Practitioners are required to comply with the Code of Ethics for Professional Accountants issued by the International Ethics Standards Board for Accountants (IESBA) related to assurance engagements, and also requires the engagement partner to be a member of a firm that applies International Standard on Quality Control (ISQC) 1, Quality Control for Firms that Perform Audits and Reviews of Financial Statements, and Other Assurance and Related Services Engagements.
Some of the changes made in response to constituent comment include:
- Limiting the ISAE within the context of attestation engagements only, rather than both attestation engagements and direct engagements, but allowing its use in direct engagements. Consideration of direct engagements may be the subject of a future project
- Including additional application material highlighting how the nature and extent of procedures may vary between 'reasonable assurance' (expressed in a positive form) and 'limited assurance' engagements
- The adoption of a 'columns' approach to more clearly delineate the key requirements where the work effort differs between reasonable and limited assurance, and further clarify the work effort through terminology changes and other guidance
- Giving greater emphasis to the importance of a practitioner's consideration of whether the criteria are suitable
- Providing additional guidance on the form and content of the practitioner's report.