A Fresh Look at Attestation Standards
By Paul Munter and Thomas A. Ratcliffe
In Brief
ASB Widens Attestation Engagements
In January 2001, the Auditing Standards Board (ASB) issued Statement on Standards for Attestation Engagements (SSAE) 10, Attestation Standards: Revision and Recodification. SSAE 10 supersedes SSAEs 1 through 9 and the related interpretations issued by the ASB. Although there are a variety of significant changes to the attestation literature in SSAE 10, the most significant revisions relate to the performance and reporting standards for examination and review engagements and the authoritative guidance associated with agreed-upon procedures engagements.
In issuing Statement on Standards for Attestation Engagements (SSAE) 10, Attestation Standards: Revision and Recodification, the Auditing Standards Board’s (ASB) objective was to improve the usefulness of the guidance in the attestation standards. CPAs should find that the revised standards are both easier to understand and easier to apply. The new standards also increase reporting flexibility and allow CPAs to tailor engagement reporting to meet the needs of users of attestation reports.
Identifying Attestation Engagements
According to SSAE 10, attestation standards are applicable to engagements in which a CPA in public practice is engaged to issue, or does issue, an examination, a review, an agreed-upon procedures report, or an assertion about subject matter that is the responsibility of another party. The ASB has always positioned attestation standards as a natural extension of generally accepted auditing standards (GAAS). However, unlike GAAS, which applies only to engagements on financial statements, the attest standards are intended to apply to a wide array of services.
These services can include reports on descriptions of systems of internal control; on compliance with statutory, regulatory, and contractual requirements; on investment performance statistics; and on information that is supplementary to the financial statements. As such, the attestation standards position CPAs to be responsive to a changing environment.
The subject matter of an attest engagement may take many forms, including the following:
An essential change in SSAE 10 permits reporting either on a written assertion or directly on the subject matter. Previous guidance mandated a written assertion by a responsible party to which the CPA would attest. Nonetheless, the CPA should obtain a written assertion in an examination or a review engagement. A written assertion may be presented as a narrative description, a schedule, or as part of a representation letter that clearly identifies the subject matter and the time covered. A CPA may still report on the subject matter even if a written assertion has not been obtained, but should exercise caution and ensure that interested parties clearly understand the subject matter.
Some CPA services remain outside the scope of the attestation standards:
The Attestation Standards
SSAE 10, while modifying the meaning of an attestation engagement, does retain the eleven attestation standards originally established in SSAE 1, Attestation Standards:
General standards
Fieldwork standards
Reporting standards
Responsible party. According to SSAE 10, the CPA attests to either the written assertion or the subject matter that is the representation of the responsible party. The responsible party is responsible for the subject matter, a concept existing in the attestation literature on prospective financial statements. The responsible party may e company management or management of an entity seeking to buy the company or property.
It is also possible that, due to the nature of the subject matter, there is no responsible party. If so, a party that has a reasonable basis for making a written assertion about the subject matter becomes the responsible party. CPAs may be engaged to gather information to enable the responsible party to evaluate the subject matter as part of creating a written assertion. Regardless, the responsible party must accept responsibility for the assertion and the subject matter, and it cannot base the assertion solely on procedures performed by the CPA.
The CPA should not take on the role of the responsible party in an attest engagement. Therefore, clearly identifying a responsible party is a prerequisite for the attest engagement. A CPA may accept an engagement to perform an examination, a review, or agreed-upon procedures on a subject matter or a written assertion if one of the following conditions is met:
The CPA should obtain written acknowledgment or other evidence of the party’s responsibility for the subject matter, or the written assertion, as it relates to the objective of the engagement. The responsible party can acknowledge this within an engagement letter, a representation letter, or the presentation of a written assertion about the subject matter. If the CPA cannot obtain written acknowledgment directly, the CPA should obtain other evidence of the party’s responsibility for the subject matter (e.g., by reference to legislation, a regulation, or a contract).
Modifications to Engagement Reporting Requirements
When CPAs are engaged to express an opinion (examination engagements), they should clearly state whether a) the subject matter is based on (or in conformity with) the criteria in all material respects, or b) the assertion is presented (or fairly stated) in conformity with the criteria in all material respects. Reports expressing an opinion may be qualified or modified for some aspect of the subject matter, the assertion, or the engagement. If, however, conditions result in material misstatements or deviations from the criteria, the CPA should modify the report and express the conclusion directly on the subject matter rather than the assertion. Additionally, these reports may emphasize certain matters relating to the attest engagement, the subject matter, or the assertion. The form of the report will depend on whether the opinion is on the subject matter or the assertion.
When issuing a review report, the conclusion should state whether, based on the work performed, any information indicates that a) the subject matter is not based on (or in conformity with) the criteria, or b) the assertion is not presented (or fairly stated) in conformity with the criteria in all material respects. If the subject matter (or the assertion) is not modified to correct any information that comes to the CPA’s attention, this information should be described in the report (see the Exhibits).
SSAE 10 provides specific guidance for certain types of attestation engagements (e.g., reports on internal controls; compliance with laws, regulations, or contracts; reports on management’s discussion and analysis).
Modifications to Agreed-Upon Procedures
SSAE 10 also establishes and modifies attestation standards for performance and reporting in all agreed-upon procedures engagements except the following:
In an agreed-upon procedures engagement, the CPA is engaged to issue a report of findings based on specific procedures performed on a subject matter (or an assertion) related to the needs of specified parties. Engagements usually arise because the parties require that such findings be derived independently. The specified parties and the CPA must agree upon the procedures to be performed; however, it is important that the specified parties accept responsibility for the adequacy of the procedures. The nature, timing, and extent of the agreed-upon procedures may vary widely. In an agreed-upon procedures engagement performed in accordance with SSAE 10, the CPA does not perform an examination or a review and does not provide an opinion or negative assurance. Instead, the CPA’s report on agreed-upon procedures should be in the form of procedures and findings. The report should clearly indicate that its use is restricted to the specified parties.
The following conditions must exist for the CPA to be able to perform an agreed-upon procedures attest engagement:
To satisfy the SSAE 10 requirements, the CPA should communicate directly, in person or perhaps through a draft report, with each of the specified parties. If the CPA is not able to communicate directly with all of the specified parties, these requirements may be satisfied through one or more of the following procedures:
The CPA should not report on an engagement when the specified parties do not agree upon the procedures and do not take responsibility for the sufficiency of the procedures.
Businesses are looking for greater and greater assurances before making important decisions, increasing the demand for CPAs that can attest to an ever-widening array of information and assertions. In order to aid CPAs in their efforts to properly serve these parties’ needs, the ASB has codified and simplified the attestation literature with the issuance of SSAE 10. This new guidance is especially meaningful in light of the pre-existing literature on attestation engagements.
The CPA Journal is broadly recognized as an outstanding, technical-refereed publication aimed at public practitioners, management, educators, and other accounting professionals. It is edited by CPAs for CPAs. Our goal is to provide CPAs and other accounting professionals with the information and news to enable them to be successful accountants, managers, and executives in today's practice environments.
Visit the new cpajournal.com.