Reporting on Compliance Attestation Engagements and Special Reports

Compliance attestation engagements report on whether an entity complied with specified requirements. The requirements may come from a law, regulation, contract, debt covenant, grant agreement, or similar source.

The exam usually turns on two questions: are the compliance criteria suitable and measurable, and is the practitioner issuing an examination opinion or only agreed-upon procedures findings?

    flowchart TD
	    A["Compliance requirement identified"] --> B["Locate suitable criteria"]
	    B --> C{"User need"}
	    C -- "Reasonable assurance on compliance" --> D["Compliance examination"]
	    C -- "Specific procedures and findings" --> E["Agreed-upon procedures"]
	    D --> F["Test compliance and express opinion"]
	    E --> G["Perform specified procedures and report findings only"]
	    F --> H["Report exceptions, material noncompliance, or modified opinion as needed"]
	    G --> I["Users evaluate findings themselves"]

Compliance Criteria

The criteria are the benchmark for deciding whether the entity complied. They must be specific enough for the practitioner to test and for users to understand the report.

Weak criteria include broad mission statements, vague management preferences, and unwritten expectations. A practitioner cannot meaningfully attest to “good compliance culture” unless the engagement defines measurable criteria.

Examination vs. AUP

Compliance work may be structured as an examination or as agreed-upon procedures. The report wording must match the engagement type.

If the answer choice says the practitioner reports only procedures and findings, it is AUP. If it says the practitioner expresses an opinion on compliance, it is an examination.

Evidence and Testing

The practitioner designs procedures around the criteria. In a compliance examination, the practitioner obtains sufficient appropriate evidence to support reasonable assurance. In AUP, the practitioner performs only the specified procedures.

Common procedures include:

• Inspect contracts, grant agreements, regulations, or filing instructions.
• Recalculate covenant ratios or reimbursement formulas.
• Inspect invoices, payroll records, or supporting documentation for allowable costs.
• Compare activity to permitted or prohibited uses.
• Inspect approvals, certifications, or regulatory submissions.
• Test controls over compliance when relevant to the engagement objective.
• Evaluate exceptions against materiality or specified thresholds.

Materiality in compliance is not purely financial. A small-dollar violation may matter if it affects a license, default clause, grant eligibility, or regulator decision.

Reporting Effects

The report must identify the specified requirements, the responsible party, the practitioner’s responsibilities, the standards followed, and the results of the engagement.

The practitioner should avoid legal conclusions beyond the engagement. The report evaluates compliance with specified criteria; it does not provide a legal guarantee.

Debt Covenant Example

A lender requires a borrower to maintain a debt-to-equity ratio below 2.50 to 1. The covenant definition says debt excludes operating lease liabilities and equity excludes accumulated other comprehensive income.

The exam trap is using normal GAAP ratios when the contract defines the covenant differently.

Exam Traps

• Compliance criteria must be objective and measurable.
• A compliance examination provides reasonable assurance; AUP provides no assurance.
• AUP reports factual findings, not “the entity complied.”
• Materiality can be qualitative when a violation affects user decisions.
• The practitioner should use the requirements in the contract, regulation, or grant, not a generic compliance idea.
• A compliance attestation report is not a legal opinion.

Quick Review

Use this sequence for compliance attestation questions:

1. Identify the compliance requirement.
2. Locate the criteria in a law, regulation, contract, or grant.
3. Decide whether users need an opinion or factual findings.
4. Match the engagement to examination or AUP.
5. Test or report only within the engagement scope.
6. Evaluate exceptions against materiality and reporting requirements.

Review Questions