The CPA Journal

A Fresh Look at Attestation Standards

By Paul Munter and Thomas A. Ratcliffe

In Brief

ASB Widens Attestation Engagements

In January 2001, the Auditing Standards Board (ASB) issued Statement on Standards for Attestation Engagements (SSAE) 10, Attestation Standards: Revision and Recodification. SSAE 10 supersedes SSAEs 1 through 9 and the related interpretations issued by the ASB. Although there are a variety of significant changes to the attestation literature in SSAE 10, the most significant revisions relate to the performance and reporting standards for examination and review engagements and the authoritative guidance associated with agreed-upon procedures engagements.

In issuing Statement on Standards for Attestation Engagements (SSAE) 10, Attestation Standards: Revision and Recodification, the Auditing Standards Board’s (ASB) objective was to improve the usefulness of the guidance in the attestation standards. CPAs should find that the revised standards are both easier to understand and easier to apply. The new standards also increase reporting flexibility and allow CPAs to tailor engagement reporting to meet the needs of users of attestation reports.

Identifying Attestation Engagements

According to SSAE 10, attestation standards are applicable to engagements in which a CPA in public practice is engaged to issue, or does issue, an examination, a review, an agreed-upon procedures report, or an assertion about subject matter that is the responsibility of another party. The ASB has always positioned attestation standards as a natural extension of generally accepted auditing standards (GAAS). However, unlike GAAS, which applies only to engagements on financial statements, the attest standards are intended to apply to a wide array of services.

These services can include reports on descriptions of systems of internal control; on compliance with statutory, regulatory, and contractual requirements; on investment performance statistics; and on information that is supplementary to the financial statements. As such, the attestation standards position CPAs to be responsive to a changing environment.

The subject matter of an attest engagement may take many forms, including the following:

Historical or prospective performance (e.g., historical or prospective financial information, performance measurements, backlog data)
Physical characteristics (e.g., narrative descriptions, square footage of facilities)
Historical events (e.g., market price of products or services at a specific time)
Analyses (e.g., break-even analyses or target profit levels)
Systems and processes (e.g., internal control)
Behavior (e.g., corporate governance, compliance with laws and regulations, human resources practices).

An essential change in SSAE 10 permits reporting either on a written assertion or directly on the subject matter. Previous guidance mandated a written assertion by a responsible party to which the CPA would attest. Nonetheless, the CPA should obtain a written assertion in an examination or a review engagement. A written assertion may be presented as a narrative description, a schedule, or as part of a representation letter that clearly identifies the subject matter and the time covered. A CPA may still report on the subject matter even if a written assertion has not been obtained, but should exercise caution and ensure that interested parties clearly understand the subject matter.

Some CPA services remain outside the scope of the attestation standards:

Services performed in accordance with Statements on Auditing Standards (SAS), that is, audits of financial statements
Services performed in accordance with Statements on Standards for Accounting and Review Services (SSARS), that is, compilations or reviews of financial statements of nonpublic entities
Services performed in accordance with the Statement on Standards for Consulting Services (SSCS), such as engagements in which the CPA’s role is solely to assist the client (e.g., acting as the company accountant in preparing information other than financial statements) or engagements in which the CPA is engaged to testify as an expert witness on accounting, auditing, taxation, or other matters, given certain stipulated facts
Engagements in which the CPA advocates a client’s position (e.g., tax matters reviewed by the IRS)
Tax engagements in which a CPA prepares tax returns or provides tax advice.

The Attestation Standards

SSAE 10, while modifying the meaning of an attestation engagement, does retain the eleven attestation standards originally established in SSAE 1, Attestation Standards:

General standards

CPAs should have adequate technical training and proficiency in the attest function.
CPAs should have adequate knowledge of the subject matter.
CPAs should perform attestation engagements only when there is an assertion capable of evaluation against reasonable criteria that are suitable and available to users.
CPAs must be independent.
CPAs must exercise due professional care in the performance of attestation engagements.

Fieldwork standards

Attestation engagements should be adequately planned and assistants should be supervised.
Sufficient evidence should be obtained to support the conclusion expressed in the report.

Reporting standards

The report should identify the subject matter or the assertion being reported on and the character of the engagement.
The report should state the CPA’s conclusion about the subject matter or the assertion against the evaluation criteria.
The report should note all of the CPA’s significant reservations about the engagement, the subject matter, and the assertion.
The report should state that its use is restricted to specified parties under certain circumstances:

When the evaluation criteria are determined by the CPA to be appropriate only for a limited number of parties who either participated in their establishment or have an adequate understanding of them
When the evaluation criteria are available only to specified parties
When reporting on subject matter where a written assertion has not been provided by the responsible party
When the report is on an attest engagement to apply agreed-upon procedures to the subject matter.

Responsible party. According to SSAE 10, the CPA attests to either the written assertion or the subject matter that is the representation of the responsible party. The responsible party is responsible for the subject matter, a concept existing in the attestation literature on prospective financial statements. The responsible party may e company management or management of an entity seeking to buy the company or property.

It is also possible that, due to the nature of the subject matter, there is no responsible party. If so, a party that has a reasonable basis for making a written assertion about the subject matter becomes the responsible party. CPAs may be engaged to gather information to enable the responsible party to evaluate the subject matter as part of creating a written assertion. Regardless, the responsible party must accept responsibility for the assertion and the subject matter, and it cannot base the assertion solely on procedures performed by the CPA.

The CPA should not take on the role of the responsible party in an attest engagement. Therefore, clearly identifying a responsible party is a prerequisite for the attest engagement. A CPA may accept an engagement to perform an examination, a review, or agreed-upon procedures on a subject matter or a written assertion if one of the following conditions is met:

The party engaging the CPA is responsible for the subject matter, or has a reasonable basis for providing a written assertion about the subject matter if the nature of the subject matter is such that a responsible party does not otherwise exist.
The party engaging the CPA is not responsible for the subject matter but is able to provide, or have a third party responsible for the subject matter provide, the CPA with evidence of the third party’s responsibility for the subject matter.

The CPA should obtain written acknowledgment or other evidence of the party’s responsibility for the subject matter, or the written assertion, as it relates to the objective of the engagement. The responsible party can acknowledge this within an engagement letter, a representation letter, or the presentation of a written assertion about the subject matter. If the CPA cannot obtain written acknowledgment directly, the CPA should obtain other evidence of the party’s responsibility for the subject matter (e.g., by reference to legislation, a regulation, or a contract).

Modifications to Engagement Reporting Requirements

When CPAs are engaged to express an opinion (examination engagements), they should clearly state whether a) the subject matter is based on (or in conformity with) the criteria in all material respects, or b) the assertion is presented (or fairly stated) in conformity with the criteria in all material respects. Reports expressing an opinion may be qualified or modified for some aspect of the subject matter, the assertion, or the engagement. If, however, conditions result in material misstatements or deviations from the criteria, the CPA should modify the report and express the conclusion directly on the subject matter rather than the assertion. Additionally, these reports may emphasize certain matters relating to the attest engagement, the subject matter, or the assertion. The form of the report will depend on whether the opinion is on the subject matter or the assertion.

When issuing a review report, the conclusion should state whether, based on the work performed, any information indicates that a) the subject matter is not based on (or in conformity with) the criteria, or b) the assertion is not presented (or fairly stated) in conformity with the criteria in all material respects. If the subject matter (or the assertion) is not modified to correct any information that comes to the CPA’s attention, this information should be described in the report (see the Exhibits).

SSAE 10 provides specific guidance for certain types of attestation engagements (e.g., reports on internal controls; compliance with laws, regulations, or contracts; reports on management’s discussion and analysis).

Modifications to Agreed-Upon Procedures

SSAE 10 also establishes and modifies attestation standards for performance and reporting in all agreed-upon procedures engagements except the following:

Situations where an auditor is reporting on specified compliance requirements based solely on an audit of financial statements as addressed by SAS 62, Special Reports
Engagements where the objective is to report in accordance with SAS 74, Compliance With Auditing Considerations in Audits of Governmental Entities and Recipients of Governmental Financial Assistance, unless the terms of the engagement specify performance in accordance with guidance in the attestation standards
Circumstances covered by SAS 70, Service Organizations, where the auditor is requested to apply substantive procedures to user transactions or assets of the service organization and the CPA reports that the designated procedures have been carried out
Engagements covered by SAS 72, Letters for Underwriters and Certain Other Requesting Parties, as amended.

In an agreed-upon procedures engagement, the CPA is engaged to issue a report of findings based on specific procedures performed on a subject matter (or an assertion) related to the needs of specified parties. Engagements usually arise because the parties require that such findings be derived independently. The specified parties and the CPA must agree upon the procedures to be performed; however, it is important that the specified parties accept responsibility for the adequacy of the procedures. The nature, timing, and extent of the agreed-upon procedures may vary widely. In an agreed-upon procedures engagement performed in accordance with SSAE 10, the CPA does not perform an examination or a review and does not provide an opinion or negative assurance. Instead, the CPA’s report on agreed-upon procedures should be in the form of procedures and findings. The report should clearly indicate that its use is restricted to the specified parties.

The following conditions must exist for the CPA to be able to perform an agreed-upon procedures attest engagement:

The CPA is independent.
One of the following conditions is met:
The party engaging the CPA is responsible for the subject matter, or has a reasonable basis for providing a written assertion about the subject matter when the nature of the subject matter is such that a responsible party does not otherwise exist; or
The party engaging the CPA is not responsible for the subject matter but is able to provide the CPA with evidence of the third party’s responsibility for the subject matter.
The CPA and the specified parties agree upon the procedures.
The specified parties take responsibility for the sufficiency of the agreed-upon procedures.
The subject matter to which the procedures are to be applied is subject to reasonably consistent measurement.
Criteria to determine findings are agreed upon.
The procedures to be applied to the subject matter are expected to result in reasonably consistent findings using the criteria.
Evidential matter related to the subject matter expected to provide a reasonable basis for expressing the findings in the CPA’s report.
Where applicable, the CPA and the specified parties agree on any materiality limits.
Use of the report is restricted to the specified parties.
For agreed-upon procedures engagements on prospective financial information, the prospective financial statements include a summary of significant assumptions.

To satisfy the SSAE 10 requirements, the CPA should communicate directly, in person or perhaps through a draft report, with each of the specified parties. If the CPA is not able to communicate directly with all of the specified parties, these requirements may be satisfied through one or more of the following procedures:

Compare the procedures to the parties’ written requirements
Discuss the procedures with appropriate representatives of the parties
Review relevant contracts with (or correspondence from) the specified parties.

The CPA should not report on an engagement when the specified parties do not agree upon the procedures and do not take responsibility for the sufficiency of the procedures.

Businesses are looking for greater and greater assurances before making important decisions, increasing the demand for CPAs that can attest to an ever-widening array of information and assertions. In order to aid CPAs in their efforts to properly serve these parties’ needs, the ASB has codified and simplified the attestation literature with the issuance of SSAE 10. This new guidance is especially meaningful in light of the pre-existing literature on attestation engagements.

Paul Munter, PhD, CPA, is chair and KPMG Professor of Accounting at the University of Miami, Fla,, and
Thomas A. Ratcliffe, PhD, CPA, is dean and eminent scholar in accounting and finance, Sorrell College of Business Administration, Troy State University, Ala.

This Month | About Us | Archives | Advertise| NYSSCPA

The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.

Visit the new cpajournal.com.