What are the purposes of the aicpa statements on standards for attestation engagements?
Show By Ken Tysiac The AICPA Auditing Standards Board (ASB) issued a new standard Wednesday that is designed to make it clear that the objective of a review engagement is to obtain limited assurance about whether any material modifications should be made to the subject matter in order for it to be in accordance with (or based on) the criteria. Statement on Standards for Attestation Engagements (SSAE) No. 22, Review Engagements, describes the types of procedures a practitioner may perform in a review engagement. In addition, SSAE No. 22:
SSAE No. 22 supersedes SSAE No. 18, Attestation Standards: Clarification and Recodification, as amended, Section 210 of the same title. “We believe it is in the public interest to enable the practitioner to express an adverse conclusion when appropriate, to alert the user that the subject matter information is materially misstated, and the effects of the misstatements are pervasive,” ASB Chair Tracy Harding, CPA, said in a news release. “As the profession anticipates and responds to reporting by organizations to their stakeholders and the needs for assurance, we also believe the enhancements to our standard provide helpful information by explaining the nature of the work done in review.” The new standard includes revisions to conform certain concepts in AT-C Section 210, Review Engagements, with those same concepts in revised AT-C Section 205, Assertion-Based Examination Engagements, as a result of the recent issuance of SSAE No. 21, Direct Examination Engagements. SSAE No. 22 takes effect for practitioners’ review reports dated on or after June 15, 2022. Early implementation is permitted only if the practitioner also early implements the amendments to AT-C Section 105, Concepts Common to All Attestation Engagements, included in SSAE No. 21. — Ken Tysiac () is the JofA’s editorial director. AICPA Statements on Standards for Attestation Engagements (SSAEs, or attestation standards) establish requirements for performing and reporting on examination, review, and agreed-upon procedures (AUP) engagements. In an examination, the practitioner performs procedures to obtain reasonable assurance in order to be able to draw reasonable conclusions on which to base the practitioner's opinion on the subject matter or on an assertion; in a review, the practitioner performs procedures to obtain limited assurance in order to express a conclusion on the subject matter or an assertion; and in an AUP engagement, the practitioner performs specified procedures and reports findings on the performance of those procedures without providing an opinion or a conclusion. These engagements are intended to enhance users' confidence in financial and nonfinancial information other than historical financial statements. If engaged to issue an opinion or a conclusion on historical financial statements, the practitioner would perform the engagement in accordance with Statements on Auditing Standards or Statements on Standards for Accounting and Review Services, respectively. To clarify the standards and to appropriately provide increased flexibility for practitioners to provide value to clients, the AICPA Auditing Standards Board (ASB) recently issued the following attestation standards:
EXAMPLES Examples of underlying subject matter and criteria that a practitioner may report on in accordance with the attestation standards are whether:
CASE STUDY The following case study relates to a day care center and:
Attestation services share common attributes, which include performing client acceptance procedures, obtaining an understanding of the subject matter, reaching a written understanding of engagement terms with the engaging party, properly planning and performing the work, supervising team members, obtaining a management representation letter, and providing a practitioner's report. Our hypothetical case study involves Key Day Care Center (Key), which Jane Key opened in 2020. Key is subject to many federal, state, and local rules and regulations, including those that require Key to:
Given strong competition, Key's experienced management has designed and implemented policies that usually exceed these requirements. YEAR 1 Jane Key meets with her business's CPA, Sara Jones of Jones and Company, to discuss the possible services Jones may provide. Key explains that, based on their prior experience, Key has developed and successfully implemented policies and procedures that meet the legal requirements. Key's management requests an attestation service that provides findings on whether these policies and procedures are being implemented during the current period. Jones suggests that her firm perform an agreed-upon procedures engagement under AT-C Section 215, Agreed-Upon Procedures Engagements. Jones explains the following:
Key's management agrees that an AUP engagement will meet its needs. Although not required, because of the nature of the engagement, Jones advises Key's management that Jones's report will include an alert advising readers that it is intended solely for the information and use of Key's management and is not intended to be and should not be used by anyone other than Key's management. The expected restriction on the use of Jones's report is noted in the engagement letter. As the engagement progresses, Jones frequently meets with Key's management to discuss the nature, timing, and extent of the procedures that Jones has performed or is planning to perform. Near the completion of the engagement, and before the issuance of Jones's AUP report, Jones asks Key to sign the representation letter that includes Key's agreement and acknowledgment that the procedures performed are appropriate for the purpose of assisting Key in determining whether Key's systems and controls are being followed. Jones's report includes the policies and procedures established by Key's management, the procedures performed by Jones, and Jones's findings. See the chart, "Jones's Report," (below) for an excerpt. Jones also may separately suggest improvements to Key's procedures, especially where the legal requirements were not always met. YEAR 2 In 2021, Key's business grew; it advertised that its policies and procedures exceed those required by laws and regulations and that those policies and procedures were implemented. For example, although the regulations called for two child care providers for every 10 children up to age 3, Key requires three providers for every eight children in this age group. Key concurrently began receiving requests from current and prospective customers and from regulators to provide a report on the accuracy of its advertising. Key's management and Jones discussed alternative services to address these issues, which included:
Jones explains each service to help Key decide which service to use. Jones notes that a direct examination cannot be used for compliance with regulations. AGREED-UPON PROCEDURES ENGAGEMENT Jones informs Jane Key that the use of the AUP report need not be restricted; Key could provide an unrestricted report to regulators and to current and potential customers. Jones inquires whether Key believes that the intended users of the report should agree to and acknowledge that the procedures performed are appropriate for their purposes. If Key believes that agreement and acknowledgment will help users find value in the report, Jones advises that Key's management, as part of its agreement to and acknowledgment of the appropriateness of the procedures performed, should communicate with each of the required intended users to confirm that they agree to and acknowledge that the procedures performed are appropriate for their purposes. The representation letter will include a statement that Key's management has so confirmed with the intended users of Jones's AUP report. If Key's management believes that the intended users will find value in the report without agreeing to the procedures performed, there is no need for Key to communicate with the intended users. If Jones's report does not contain an alert restricting its use, it is intended for general use, and users need not have agreed to the procedures. Concerned that, while regulators might agree to the agreed-upon procedures, customers will want additional comfort about Key's compliance, Key wants to consider services that provide an opinion or a conclusion by Jones. ASSERTION-BASED ENGAGEMENT (AT-C SECTION 205) In an assertion-based examination engagement, Key should provide an assertion and would have a reasonable basis for making its assertion. Jones would obtain reasonable assurance about whether the subject matter is in accordance with (or based on) the criteria, in all material respects, or whether an assertion about the subject matter is fairly stated, in all material respects. In this engagement, besides the steps that apply to all attestation engagements, Jones should:
REVIEW (AT-C SECTION 210) In a review, Key should provide an assertion and would have a reasonable basis for making its assertion. Jones would perform procedures to obtain limited rather than reasonable assurance. Jones would conclude whether she was aware of any material modifications that should be made to:
In a review, the nature and extent of procedures are less than in an examination. DECISION TIME Since Key's management does not have a reasonable basis to provide an assertion, it cannot receive an assertion-based examination or review. Ultimately, Key's management asked Jones to provide an AUP engagement and to issue a general-use report. As Key grows, it plans to enhance its procedures to be able to provide an assertion with a reasonable basis and thus engage Jones to perform an assertion-based examination of compliance with regulations. CHOOSING THE APPROPRIATE SERVICE We have summarized the decision-making process for attestation services. The first decision is whether the engaging party primarily wants advice or assurance. If a client believes that it needs help to design or improve its procedures, the CPA can offer a consulting service. Although the practitioner may provide advice as a byproduct of an attestation engagement, it is not the engagement's primary purpose. In deciding which attestation service should be performed, the engaging party (which is usually the responsible party) should determine whether it has a reasonable basis for, and will provide, an assertion. What constitutes a reasonable basis for the responsible party's assertion depends on the nature of the subject matter and other engagement circumstances. In some cases, a formal process with extensive internal control may be needed to provide the responsible party with a reasonable basis for making its assertion. The fact that the practitioner will report on the subject matter is not a substitute for the responsible party's own processes to have a reasonable basis for its assertion. The practitioner and engaging party should next consider (1) whether, because of the subject matter, the standards prohibit the practitioner from performing a review or direct examination; (2) what services best meet the report users' needs; and (3) the costs. About the authors Abraham Akresh, CPA, is owner of the firm Abraham D. Akresh CPA in Potomac, Md. Alan Reinstein, CPA, CGMA, DBA, is the George R. Husband Professor of Accounting at the School of Business Administration at Wayne State University in Detroit. Thomas Weirich, CPA, Ph.D., is a professor of accounting at Central Michigan University in Mount Pleasant, Mich. To comment on this article or to suggest an idea for another article, contact Courtney Vien at or 919-402-4125. AICPA RESOURCES Articles "New Attestation Standard Clarifies Work Effort of Review Engagements," JofA, Dec. 9, 2020 "Direct Examination' Engagement Created by SSAE No. 21," JofA, Sept. 30, 2020 "New Standard Adds Flexibility for Agreed-Upon Procedures," JofA, Dec. 5, 2019 Online resources SAS No. 138 and SSAE No. 20 at a Glance SSAE No. 22 at a Glance SSAE No. 21 at a Glance SSAE No. 19 at a Glance LEARNING RESOURCES Codification of Statements on Standards for Attestation Engagements Your complete guide to the authoritative standards and interpretations applicable to attestation engagements. PUBLICATION Prospective Financial Information Guide Get up to speed with current regulations, plus real-world examples, practice exercises, and case studies. This guide will help ensure your firm's long-term success in engagements related to prospective financial information. PUBLICATION For more information or to make a purchase, go to aicpa.org/cpe-learning or call the Institute at 888-777-7077. What is the purpose of an attestation engagement?An attestation engagement is an arrangement with a client where an independent third party investigates and reports on subject matter created by a client. Examples of attestation engagements are: Reporting on financial projections made by a client.
What is Statement on Standards for Attestation Engagements?Statement on Standards for Attestation Engagements no. 18 (SSAE No. 18 or SSAE 18) is a Generally Accepted Auditing Standard produced and published by the American Institute of Certified Public Accountants (AICPA) Auditing Standards Board.
What is Statement on Standards for Attestation Engagements No 16?The Statement on Standards for Attestation Engagements No. 16 (SSAE 16) is a set of standards developed specifically for certified public accountants (CPAs) to evaluate an organization's internal controls and how service companies report on these controls.
What are the general Standards of the AICPA?Additionally, all AICPA members are required to follow a rigorous Code of Professional Conduct which requires that they act with integrity, objectivity, due care, competence, fully disclose any conflicts of interest (and obtain client consent if a conflict exists), maintain client confidentiality, disclose to the ...
|
