Chapter 21, Page 1
When we complete this chapter, you should:
1. Know the definition of assurance services.
2. Be familiar with the types of assurance services offered by CPAs.
3. Know the definition of an attestation engagement.
4. Know the types of attestation engagements.
5. Be familiar with the 11 attestation standards and how they compare to the 10
generally accepted auditing standards.
6. Understand the type of attestation engagement that involves reporting on an entity’s
internal control over financial reporting.
7. Understand the type of attestation engagement that involves reporting on an entity’s
financial forecasts and projections.
8. Be familiar with accounting and review services.
9. Understand the role of standards pertaining to and services provided by internal
auditors.
10.Be familiar with two specific type assurance services offered by CPAs.
Assurance Services
Assurance services are independent professional services that improve the quality of
information, or its context, for decision makers.
Types of Assurance Services
Risk assessment
Business performance measurement Outsourced internal audit
Information system reliability
Electronic commerce M&A Consulting
Health care performance measurement
Attest Engagements
Attest services occur when a practitioner is
engaged to issue an examination, review, or
agreed-upon procedures report on subject
matter, or an assertion about subject matter,
that is the responsibility of another party.
Chapter 21: Assurance, Attestation, and Internal Auditing Services
Chapter 21, Page 2
Types of Attest Engagements
Engagement Assurance
Level
Attestation
Risk
Type of
Report
Report
Distribution
Examination
Review
Agreed-Upon
Procedures
High
Moderate
Variable
Low
Moderate
Variable
Positive
Negative
Summary
Variable
Variable
Limited
Positive = getting enough evidence to agree (Opinion and Positive are the same thing)
Negative = getting a set of evidence and not having enough to agree with
Limited = just those you specify
Attestation Standards
In general, attestation professional standards are provided by Statements on Standards
for Attestation Engagements (SSAEs) which are released by the AICPA.
These standards are similar to Generally Accepted Auditing Standards (GAAS) which
are defined in the Statements on Auditing Standards (SAS)
Attestation standards (General, fieldwork, reporting) vs GAAS Table 21-2
Major differences:
2 New general standards
No Requirement for internal control understanding
Reporting changes (GAAP is removed in these attestation standards,
Parties are added)
Reporting on and Entity’s Internal Control over Financial Reporting
The Federal Deposit Insurance Corporation Improvement Act of 1991 requires that the
management of large financial institutions issue a report on the effectiveness of the
institution’s internal control and that they engage accountants to attest to management’s
report.
The Sarbanes-Oxley Act of 2002 imposes similar requirements on all publicly held
companies.
The engagement objective is to express an opinion on the effectiveness of the entity’s
internal control, based on the control criteria (generally COSO). CH. 6-7
Specifically, management (the responsible party) evaluates the effectiveness of the
internal controls based on these criteria, then the “auditor” finds evidence to support the
evaluation.
Chapter 21, Page 3
For non-mandated clients, this engagement may be either an examination or agreed-
upon procedures. For all public or mandatory reporters, it is an audit.
Financial Forecasts and Projections
A Prospective Financial Statements (PFS) is the financial information representing the
financial position, results of operations, and cash flows for some period of time in the
future.
Financial forecasts: present an entity’s financial information based on
Assumptions about actual expected conditions/courses of action.
(Can look at pg. 718 – 720. The bulleted lists are good to look at)
Financial projections: present an entity’s financial information based on
Hypothetical assumptions
Accounting and Review Services
No Limited Reasonable Absolute
Many nonpublic companies do not choose to contract for an audit of their financial
statements. However, these entities often employ a CPA to assist with preparing their
financial statements, tax returns, or other financial documents.
Statements on Standards for Accounting and Review Services (SSARS) (promulgated
by the Accounting and Review Services Committee) provide guidance for two common
services.
A compilation is defined as presenting, in the form of financial statements, information
that is the representation of management or owners without expressing any assurance
on the statements.
In conducting a compilation, the accountant must have the following knowledge about
the entity:
Accounting principles/practices of the industry
Accounting basis for the entity
General understanding of the entities actual business
The accountant is not required to conduct any inquiries of client personnel or
corroborate any information provided by the client. They should, however, read the
compiled financial statements to ensure they are in appropriate form and free from
obvious errors.
Chapter 21, Page 4
A review is defined as the performance of inquiries and analytical procedures to provide
the accountant with a reasonable basis for expressing limited assurance that no
material modifications should be made to the statements in order for them to conform to
GAAP (or another comprehensive basis of accounting).
Required Review Procedures:
1. Obtaining knowledge of the accounting principles and practices of the industry and
an understanding of the entity’s business and industry.
2. Obtaining a general understanding of the entity’s organization, its operating
characteristics, and the nature of its assets, liabilities, revenues, and expenses.
3. Obtaining an understanding of the accounting principles and practices used by the
entity in measuring, recognizing, recording, and disclosing all significant accounts
and disclosures in the financial statements.
4. Inquiries - Asking the entity’s personnel about important matters:
Have the financial statements been prepared according to
GAAP
Are there unusual or complex situations that could effect F/S
Did any significant transactions occur near the Year End
Is management aware of any allegations of fraud
5. Performing analytical procedures to identify relationships and individual items that
appear to be unusual.
6. Reading the financial statements to determine if they conform to GAAP.
7. Obtaining reports from other accountants, if any.
8. Obtaining a representation letter from management.
Internal Auditing
Internal auditing is an independent, objective, assurance and consulting activity
designed to add value and improve an organization’s operations. It helps an
organization accomplish its objectives by bringing a systematic, disciplined approach to
evaluate and improve effectiveness of risk management, control, and governance
processes.
Internal auditors maintain independence and objectivity through:
Organizational independence (they report to the audit committee)
The Internal Audit Charter (covers responsibilities, scope, and reporting)
Personal independence (in other words, attitude)
Auditors not completely independent but as independent as they can be.
Chapter 21, Page 5
The internal auditor plays many roles within the company:
Evaluating Risks and Controls
Identify sources of risk and recommend approaches to manage
Ensure compliance with requirements relating to internal control
Review Compliance
Internal policies and procedures
Professional standards
Laws, regulations, or contracts
Other regulatory bodies: OSHA, FDA, EPA, etc.
Financial Auditing
Issues identified in prior external audits
Areas of management concern
Financial information not subject to external audit
Operational Auditing
Identifies the causes of operational problems or enhances the efficiency or
effectiveness of operations (i.e., improve profitability)
Institute of Internal Auditors (IIA) Standards Sets the International Standards
Mandatory guidance: Def. of internal auditing, code of ethics, standards
Strongly recommended guidance: Position papers & practice
advisories/guides
Some of the work performed by internal auditors is directly relevant to the work of the
independent auditor.
However, before relying on the work of internal auditors, the external auditor must
evaluate internal auditors’
