The AICPA’s Auditing Standards Board (ASB), has completed clarifying Statements on Standards for Attestation Engagements (SSAEs or attestation standards) and is issuing its clarified attestation standards as SSAE No. 18, Attestation Standards: Clarification and Recodification
. The ASB expects SSAE No. 18 to be available in April 2016 and to be effective for practitioners’ reports dated on or after May 1, 2017.
The attestation standards establish requirements for performing and reporting on examination, review, and agreed-upon procedures engagements that enable practitioners to report on subject matter ordinarily other than financial statements, for example, an entity’s compliance with laws or regulations, the effectiveness of an entity’s controls over the security of a system, and the fairness of the presentation of a statement of greenhouse gas emissions.
The attestation standards are developed and issued in the form of SSAEs and are codified into sections. The identifier “AT-C” is used to differentiate the sections of the clarified attestation standards (“AT-C sections”) from the sections of the attestation standards that are superseded by SSAE No. 18 (“AT” sections”).
In clarifying the attestation standards, the ASB used the following special drafting conventions to make the standards easier to read, understand, and apply:
- Establishing objectives for each AT-C section
- Including a definitions section, when relevant, in each AT-C section
- Separating requirements from application and other explanatory material
- Numbering application and other explanatory material paragraphs using an A- prefix and presenting them in a separate section that follows the requirements section
- Using formatting techniques, such as bulleted lists, to enhance readability
Restructuring the Attestation Standards
The attestation standards provide for three types of services—examination, review, and agreed-upon procedures. SSAE No 18 restructures the attestation standards so that the applicability of any AT-C section of the attestation standards to a particular engagement depends on the type of service provided and the subject matter of the engagement.
T-C section 105, Concepts Common to All Attestation Engagements, contains requirements and application guidance applicable to any attestation engagement. AT-C sections 205, Examination Engagements; 210, Review Engagements; and 215, Agreed-Upon Procedures Engagements, each contain additional requirements and application guidance specific to the type of service performed. The applicable requirements and application guidance for any attestation engagement is contained in at least two AT-C sections: AT-C section 105 and either AT-C section 205, 210, or 215, depending on the type of service provided.
Incremental performance and reporting requirements and application guidance unique to four subject matters are included in the subject-matter specific AT-C sections. Those sections address prospective financial information, pro forma financial information, compliance attestation, and controls at a service organization relevant to user entities’ internal control over financial reporting. The applicable requirements and application guidance for a subject-matter specific engagement is contained in three AT-C sections: AT-C section 105; AT-C section 205, 210, or 215, depending on the type of service provided; and the applicable subject-matter section.
Creating Engagements to Meet Client Needs
Although SSAE No. 18 addresses four specific subject matters, what makes the attestation standards so unique is that they enable a practitioner to report on almost any subject matter, as long as
- the party responsible for the subject matter is someone other than the practitioner and takes responsibility for the subject matter,
- the subject matter is appropriate,
- the criteria to be used in evaluating the subject matter are suitable and available,
- the practitioner expects to be able to obtain the evidence needed to arrive at the practitioner’s opinion, conclusion, or findings, through access to information and unrestricted access to people who can provide such evidence, and
- the practitioner’s opinion, conclusion, or findings is to be contained in a written practitioner’s report.
Paragraph .25 of AT-C section 105 and the related application guidance provide greater detail about these preconditions.
The attestation standards provide a framework (a set of rules) for creating an attestation engagement that meets client needs. Types of engagements that may be performed are only limited by the preconditions in paragraph .25 of AT-C section 105 and the practitioner’s and client’s creativity.
In addition to the restructuring of the attestation standards, the following are some of the more significant changes to the attestation standards introduced by SSAE No. 18:
- Separate discussion of review engagements. SSAE No 18 separates the detailed procedural and reporting requirements for review engagements from their counterparts for examination engagements. The resulting guidance more clearly differentiates the services, highlighting the similarity of a review under the SSAEs to a review under the Statements on Standards for Accounting and Review Services.
- Required representation letters. AT section 101 of the existing attestation standards discusses representation letters but does not require them. (However, certain existing subject-matter specific AT sections require the practitioner to obtain a representation letter.) SSAE No. 18 requires the practitioner to request a written representation letter in all attestation engagements. However, if a responsible party who is not the engaging party refuses to provide the practitioner with a representation letter, the practitioner would not necessarily be required to conclude that a scope limitation exists if the practitioner is able to obtain satisfactory oral responses from the responsible party to the matters ordinarily included in the representation letter. In these circumstances, use of the examination or review report would be restricted to the engaging party.
- Risk assessment for examination engagements. SSAE No. 18 requires practitioners to obtain a more in-depth understanding of the development of the subject matter than currently required in order to better identify the risks of material misstatement in an examination engagement. This, in turn, should lead to an improved linkage between assessed risks and the nature, timing, and extent of attestation procedures performed in response to those risks.
- Incorporation of detailed requirements. SSAE No. 18 incorporates a number of detailed requirements (such as the need for an engagement letter or equivalent and for written representations in examinations and reviews) that are similar to those contained in Statements on Auditing Standards (SASs). SSAE No. 18 adopts these requirements based on the ASB’s belief that a service that results in a level of assurance similar to that obtained in an audit or review of historical financial statements should generally consist of similar requirements.
- Scope limitation imposed by the engaging party or the responsible party. Paragraph .74 of AT section 101 of the existing attestation standards indicates that when restrictions that significantly limit the scope of the engagement are imposed by the engaging party or the responsible party, the practitioner generally should disclaim an opinion or withdraw from the engagement. SSAE No. 18 does not contain the same requirement; instead, it indicates that based on the practitioner’s assessment of the effect of the scope limitation, the practitioner should express a qualified opinion, disclaim an opinion, or withdraw from the engagement (when withdrawal is possible under applicable laws or regulations).
Because one of the objectives of the ASB’s clarity project is convergence with standards of the International Auditing and Assurance Standards Board (IAASB), the foundation for the common concepts, examination, and review AT-C sections of SSAE No. 18 is International Standard on Assurance Engagements (ISAE) 3000 (Revised), Assurance Engagements Other than Audits and Review of Historical Financial Information. However, one major difference exists between the SSAEs and the ISAEs. Under the SSAEs, a practitioner is not permitted to issue an examination or review report when an assertion has not been obtained from the responsible party, except when the responsible party is not the engaging party. Under the ISAEs, an assertion (or representation about the subject matter against the criteria) is not required in order for the practitioner to report.
What is Superseded?
SSAE No. 18 supersedes all of the existing attestation standards with the following exceptions:
- AT 501, An Examination of an Entity’s Internal Control Over Financial Reporting That is Integrated With An Audit of Financial Statements. AT 501 has been clarified and issued as SAS No. 130, An Audit of Internal Control Over Financial Reporting That is Integrated With An Audit of Financial Statements, because it addresses an examination of internal control that is integrated with an audit of financial statements. (The ASB intends to develop a generic internal control attestation standard in the future.)
- AT 701, Management’s Discussion and Analysis. AT 701 will not be clarified because practitioners rarely perform these engagements; it will be retained in the attestation standards in its current form.
SSAE No. 18 contains the following AT-C sections:
- AT-C section 0, Preface
- AT-C section 105, Concepts Common to All Attestation Engagements
- AT-C section 205, Examination Engagements
- AT-C section 210, Review Engagements
- AT-C section 215, Agreed-Upon Procedures Engagements
- AT-C section 305, Prospective Financial Information
- AT-C section 310, Reporting on Pro Forma Financial Information
- AT-C section 315, Compliance Attestation
- AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ internal Control Over Financial Reporting
- AT section 395, Management’s Discussion and Analysis