Choosing the Right Level of Assurance
An audit, review, or agreed-upon procedures engagement should be matched to its purpose, users, and required level of confidence.
The engagement should follow the reporting need, not the label most familiar to management.
Organizations sometimes request an audit when their actual reporting need is narrower. In other cases, they select a limited engagement even though lenders, shareholders, regulators, or other users expect a higher level of assurance.
Selecting the right engagement is therefore not simply a question of cost or timing. It requires a disciplined assessment of the information involved, the decisions it will support, the intended users, and the level and form of professional reporting they require.
Different Engagements Provide Different Outcomes
A financial statement audit is designed to provide reasonable assurance that the financial statements as a whole are free from material misstatement, whether due to fraud or error. The auditor performs risk assessment, tests relevant information, evaluates evidence, and expresses an audit opinion.
A review engagement provides limited assurance. Its procedures are substantially less extensive than those performed in an audit and ordinarily place greater emphasis on inquiry and analytical procedures. ISRE 2400 (Revised) addresses reviews of historical financial statements performed by a practitioner who is not the entity’s auditor.
An agreed-upon procedures engagement is different from both. The practitioner performs specific procedures agreed with the engaging party and, where appropriate, other intended users. The report sets out the procedures performed and the related factual findings. It does not provide an audit opinion or an assurance conclusion.
Begin with the Decision to Be Supported
The first question should be: what will users do with the information?
A statutory requirement, significant financing arrangement, shareholder accountability obligation, or broad external reliance may call for a financial statement audit.
A review may be appropriate for interim or periodic financial statements, selected reporting requirements, group reporting, or circumstances in which users require limited rather than reasonable assurance.
Agreed-upon procedures may be more suitable where a donor, lender, partner, regulator, or management team needs specified checks over particular transactions, expenditures, balances, documents, or contractual conditions.
The nature of the decision should drive the engagement - not familiarity with the word “audit.”
Preventing an Expectation Gap
An expectation gap arises when users assume that all professional reports provide the same level of confidence or cover the same subject matter.
A review should not be described as a smaller audit. An agreed-upon procedures report should not be presented as an assurance opinion. Similarly, a report restricted to selected balances should not be interpreted as addressing the financial statements as a whole.
The engagement terms should clearly identify the subject matter, applicable criteria, responsibilities of management, intended users, level of assurance - where applicable - and form of reporting.
Proportionate Does Not Mean Weaker
The most appropriate engagement is not necessarily the one involving the greatest volume of procedures. It is the engagement that responds correctly to the reporting purpose and stakeholder need.
Choosing a proportionate scope can avoid unnecessary work while still providing the required professional value. Conversely, selecting too narrow an engagement may leave users without the level of assurance needed for significant decisions.
Clarity at the outset protects management, the practitioner, and intended users. It ensures that the work performed, the report issued, and the confidence placed in that report remain properly aligned.