Comparing SSAE Examinations, Reviews, and Agreed-Upon Procedures

Attestation engagements let practitioners report on subject matter other than a traditional audit of historical financial statements. The subject matter may involve compliance, controls, greenhouse gas data, prospective financial information, system security, or another measurable assertion.

The AUD exam usually tests whether you can match the engagement type to the assurance level and report wording. Examinations provide reasonable assurance. Reviews provide limited assurance. Agreed-upon procedures engagements provide no assurance and report only factual findings.

    flowchart TD
	    A["Attestation subject matter"] --> B{"What do users need?"}
	    B -- "Opinion with reasonable assurance" --> C["Examination"]
	    B -- "Limited assurance conclusion" --> D["Review"]
	    B -- "Specific factual findings only" --> E["Agreed-upon procedures"]
	    C --> F["Opinion against suitable criteria"]
	    D --> G["Negative assurance conclusion"]
	    E --> H["Procedures and findings; no opinion or conclusion"]

Attestation Foundation

An attestation engagement requires subject matter and suitable criteria. The practitioner evaluates or reports on the subject matter against those criteria.

If the criteria are vague or unavailable to users, the engagement may not be appropriate because users cannot understand what the practitioner’s report means.

Engagement Comparison

These categories are not ranked by importance. They serve different user needs. A lender may want only specific covenant recalculations through an AUP report, while a regulator may require an examination opinion.

Examination Engagements

An examination is the highest-assurance attestation engagement. The practitioner obtains sufficient appropriate evidence to express an opinion on whether the subject matter is in accordance with the criteria, in all material respects.

Examination examples include:

• Examining compliance with specified requirements.
• Examining controls at a service organization.
• Examining prospective financial information.
• Examining a cybersecurity risk management program against defined criteria.

The report uses opinion-style language. That is the clue that the practitioner is giving reasonable assurance.

Review Engagements

A review provides limited assurance. The practitioner performs procedures that are substantially less in scope than an examination, commonly inquiry and analytical procedures, and expresses a conclusion in negative assurance form.

Review wording often follows this logic: nothing came to the practitioner’s attention that caused the practitioner to believe the subject matter is not in accordance with the criteria.

Reviews are useful when users want more than factual findings but do not need the cost or depth of an examination. A review is not the same as a SSARS review of financial statements, but the assurance concept is similar.

Agreed-Upon Procedures Engagements

An agreed-upon procedures engagement reports procedures performed and findings obtained. The practitioner does not decide whether the subject matter is fairly stated, effective, or compliant overall. Users draw their own conclusions from the reported findings.

For example, an AUP report might state that the practitioner recalculated a covenant ratio for 25 agreements and found 2 exceptions. It should not say the entity is in compliance overall unless that is part of an examination conclusion.

Choosing the Engagement Type

The practitioner should be alert for scope confusion. If users ask for an “opinion,” an AUP engagement is usually not enough. If users only need a specific recalculation, an examination may be more than necessary.

Exam Traps

• Examinations provide reasonable assurance; reviews provide limited assurance; AUP provides no assurance.
• AUP reports factual findings and no opinion or conclusion.
• Attestation engagements require suitable criteria.
• A review is not a low-cost examination opinion.
• Consulting recommendations are different from attestation conclusions.
• Independence applies to attestation engagements; do not treat an SSAE engagement as ordinary advisory work.

Quick Review

Use this sequence for SSAE engagement-type questions:

1. Identify the subject matter.
2. Identify the criteria.
3. Determine what users need: opinion, limited assurance, or factual findings.
4. Match the need to examination, review, or AUP.
5. Match the report wording to the engagement type.
6. Reject answer choices that imply the wrong assurance level.

Review Questions