Application and Other Explanatory Material

Introduction

(Ref: Para. 6(c))

Objectives

Engagements with Subject Matter Information Comprising a Number of Aspects (Ref: Para. 10(b), 65, 69(l))

Definitions

The Nature, Timing and Extent of Procedures in Limited and Reasonable Assurance Engagements (Ref: Para. 12(a)(i))

A3

Because the level of assurance obtained in a limited assurance engagement is lower than in a reasonable assurance engagement, the procedures the assurance practitioner performs in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement.  The primary differences between the procedures for a reasonable assurance engagement and a limited assurance engagement include:

  1. The emphasis placed on the nature of various procedures as a source of evidence will likely differ, depending on the engagement circumstances.  For example, the assurance practitioner may judge it to be appropriate in the circumstances of a particular limited assurance engagement to place relatively greater emphasis on enquiries of the entity’s personnel and analytical procedures, and relatively less emphasis, if any, on testing of controls and obtaining evidence from external sources than may be the case for a reasonable assurance engagement. 
  2. In a limited assurance engagement the assurance practitioner may:
    1. Select less items for examination; or
    2. Perform fewer procedures (for example, performing only analytical procedures in circumstances when, in a reasonable assurance engagement, both analytical procedures and other procedures would be performed).
  3. In a reasonable assurance engagement, analytical procedures performed in response to the engagement risk involve developing expectations that are sufficiently precise to identify material misstatements.  In a limited assurance engagement, analytical procedures may be designed to support expectations regarding the direction of trends, relationships and ratios rather than to identify misstatements with the level of precision expected in a reasonable assurance engagement.
  4. Further, when significant fluctuations, relationships or differences are identified, appropriate evidence in a limited assurance engagement may be obtained by making enquiries and considering responses received in the light of known engagement circumstances.
  5. In addition, when undertaking analytical procedures in a limited assurance engagement the assurance practitioner may, for example use data that is more highly aggregated, such as quarterly data rather than monthly data, or use data that has not been subjected to separate procedures to test its reliability to the same extent as it would be for a reasonable assurance engagement.

A Level of Assurance that is Meaningful (Ref: Para. 12(a)(i)b)

A4

The level of assurance the assurance practitioner plans to obtain is not ordinarily susceptible to quantification, and whether it is meaningful is a matter of professional judgement for the assurance practitioner to determine in the circumstances of the engagement.  In a limited assurance engagement, the assurance practitioner performs procedures that are limited compared with those necessary in a reasonable assurance engagement but are, nonetheless, planned to obtain a level of assurance that is meaningful.  To be meaningful the level of assurance obtained by the assurance practitioner is likely to enhance the intended users’ confidence about the subject matter information to a degree that is clearly more than inconsequential (see also paragraphs A16–A18).

A5

Across the range of all limited assurance engagements, what is meaningful assurance can vary from just above assurance that is likely to enhance the intended users’ confidence about the subject matter information to a degree that is clearly more than inconsequential to just below reasonable assurance.  What is meaningful in a particular engagement represents a judgement within that range that depends on the engagement circumstances, including the information needs of intended users as a group, the criteria, and the underlying subject matter of the engagement.

A7

Some of the factors that may be relevant in determining what constitutes meaningful assurance in a specific engagement include, for example:

  • The characteristics of the underlying subject matter and the criteria, and whether there are any relevant subject matter‑specific ASAEs.
  • Instructions or other indications from the engaging party about the nature of the assurance the engaging party is seeking the assurance practitioner to obtain.  For example, the terms of the engagement may stipulate particular procedures that the engaging party considers necessary or particular aspects of the subject matter information on which the engaging party would like the assurance practitioner to focus procedures.  However, the assurance practitioner may consider that other procedures are required to obtain sufficient appropriate evidence to obtain meaningful assurance.
  • Generally accepted practice, if it exists, with respect to assurance engagements for the particular subject matter information, or similar or related subject matter information.
  • The information needs of intended users as a group.  Generally, the greater the consequence to intended users of receiving an inappropriate conclusion when the subject matter information is materially misstated, the greater the assurance that would be needed in order to be meaningful to them.  For example, in some cases, the consequence to intended users of receiving an inappropriate conclusion may be so great that a reasonable assurance engagement is needed for the assurance practitioner to obtain assurance that is meaningful in the circumstances.
  • The expectation by intended users that the assurance practitioner will form the limited assurance conclusion on the subject matter information within a short timeframe and at a low cost.

Examples of Attestation Engagements (Ref: Para. 12(a)(ii)a)

A8

Examples of engagements that may be conducted under this ASAE include:

  1. Sustainability – An engagement on sustainability involves obtaining assurance on a report prepared by management or management’s expert (the measurer or evaluator) on the sustainability performance of the entity.
  2. Compliance with law or regulation – An engagement on compliance with law or regulation involves obtaining assurance on a statement by another party (the measurer or evaluator) of compliance with the relevant law or regulation.
  3. Value for money – An engagement on value for money involves obtaining assurance on a measurement or evaluation of value for money by another party (the measurer or evaluator).

Assurance Skills and Techniques (Ref: Para. 12(b))

A9

Assurance skills and techniques include:

  • Application of professional scepticism and professional judgement;
  • Planning and performing an assurance engagement, including obtaining and evaluating evidence;
  • Understanding information systems and the role and limitations of internal control;
  • Linking the consideration of materiality and engagement risks to the nature, timing and extent of procedures;
  • Applying procedures as appropriate to the engagement (which may include enquiry, inspection, re‑calculation, re‑performance, observation, confirmation, and analytical procedures); and
  • Systematic documentation practices and assurance report‑writing skills.

Criteria (Ref: Para. 12(c), Appendix 1)

Engagement Risk (Ref: Para. 12(f), Appendix 1)

A11

Engagement risk does not refer to, or include, the assurance practitioner’s business risks, such as loss from litigation, adverse publicity, or other events arising in connection with particular subject matter information.

A12

In general, engagement risk can be represented by the following components, although not all of these components will necessarily be present or significant for all assurance engagements:

  1. Risks that the assurance practitioner does not directly influence, which in turn consist of:
    1. The susceptibility of the subject matter information to a material misstatement before consideration of any related controls applied by the appropriate party(ies) (inherent risk); and
    2. The risk that a material misstatement that occurs in the subject matter information will not be prevented, or detected and corrected, on a timely basis by the appropriate party(ies)’s internal control (control risk); and
  2. The risk that the assurance practitioner does directly influence, which is the risk that the procedures performed by the assurance practitioner will not detect a material misstatement (detection risk).

A13

The degree to which each of these components is relevant to the engagement is affected by the engagement circumstances, in particular:

  • The nature of the underlying subject matter and the subject matter information.  For example, the concept of control risk may be more useful when the underlying subject matter relates to the preparation of information about an entity’s performance than when it relates to information about the effectiveness of a control or the existence of a physical condition.
  • Whether a reasonable assurance or a limited assurance engagement is being performed.  For example, in limited assurance engagements the assurance practitioner may often decide to obtain evidence by means other than testing of controls, in which case consideration of control risk may be less relevant than in a reasonable assurance engagement on the same subject matter information.

The consideration of risks is a matter of professional judgement, rather than a matter capable of precise measurement.

A14

Reducing engagement risk to zero is very rarely attainable or cost beneficial and, therefore, “reasonable assurance” is less than absolute assurance, as a result of factors such as the following:

  • The use of selective testing.
  • The inherent limitations of internal control.
  • The fact that much of the evidence available to the assurance practitioner is persuasive rather than conclusive.
  • The use of professional judgement in gathering and evaluating evidence and forming conclusions based on that evidence.
  • In some cases, the characteristics of the underlying subject matter when evaluated or measured against the criteria.

The Engaging Party (Ref: Para. 12(g), Appendix 1)

Intended Users (Ref: Para. 12(m), Appendix 1)

A17

Intended users or their representatives may be directly involved with the assurance practitioner and the responsible party (and the engaging party if different) in determining the requirements of the engagement.  Regardless of the involvement of others however, and unlike an agreed‑upon procedures engagement (which involves reporting factual findings based upon procedures agreed with the engaging party and any appropriate third parties, rather than a conclusion):

  1. The assurance practitioner is responsible for determining the nature, timing and extent of procedures; and
  2. The assurance practitioner may need to perform additional procedures if information comes to the assurance practitioner’s attention that differs significantly from that on which the determination of planned procedures was based (see paragraphs A116–A118).

A18

In some cases, intended users (for example, bankers and regulators) impose a requirement on, or request the appropriate party(ies) to arrange for an assurance engagement to be performed for a specific purpose.  When engagements use criteria that are designed for a specific purpose, paragraph 69(f) requires a statement alerting readers to this fact.  In addition, the assurance practitioner may consider it appropriate to indicate that the assurance report is intended solely for specific users.  Depending on the engagement circumstances, this may be achieved by restricting the distribution or use of the assurance report (see paragraphs A167–A168).

Subject Matter Information (Ref: Para. 12(x), Appendix 1)

The Appropriate Party(ies) (Ref: Para. 13, Appendix 1)

A20

The roles played by the responsible party, the measurer or evaluator, and the engaging party can vary (see paragraph A36).  Also, management and governance structures vary by jurisdiction and by entity, reflecting influences such as different cultural and legal backgrounds, and size and ownership characteristics.  Such diversity means that it is not possible for ASAEs to specify for all engagements the person(s) with whom the assurance practitioner is to enquire of, request representations from, or otherwise communicate with in all circumstances.  In some cases, for example, when the appropriate party(ies) is only part of a complete legal entity, identifying the appropriate management personnel or those charged with governance with whom to communicate will require the exercise of professional judgement to determine which person(s) have the appropriate responsibilities for, and knowledge of, the matters concerned.

Conduct of an Assurance Engagement in Accordance with ASAEs

Complying with Standards that are Relevant to the Engagement (Ref: Para. 1, 515)

A21

This ASAE includes requirements that apply to assurance engagements[4] (other than audits or reviews of historical financial information), including engagements in accordance with a subject matter‑specific ASAE.  In some cases, a subject matter‑specific ASAE is also relevant to the engagement.  A subject matter‑specific ASAE is relevant to the engagement when the ASAE is in effect, the subject matter of the ASAE is relevant to the engagement, and the circumstances addressed by the ASAE exist.

Text of an ASAE (Ref: Para. 1216)

A24

The objectives in an ASAE provide the context in which the requirements of the ASAE are set, and are intended to assist in:

  1. Understanding what is to be accomplished; and
  2. Deciding whether more needs to be done to achieve the objectives.

The proper application of the requirements of an ASAE by the assurance practitioner is expected to provide a sufficient basis for the assurance practitioner’s achievement of the objectives.  However, because the circumstances of assurance engagements vary widely and all such circumstances cannot be anticipated in the ASAEs, the assurance practitioner is responsible for determining the procedures necessary to fulfil the requirements of relevant ASAEs and to achieve the objectives stated therein.  In the circumstances of an engagement, there may be particular matters that require the assurance practitioner to perform procedures in addition to those required by relevant ASAEs to meet the objectives specified in those ASAEs.

A25

The requirements of ASAEs are expressed using “shall.”

A26

Where necessary, the application and other explanatory material provides further explanation of the requirements and guidance for carrying them out.  In particular, it may:

  1. Explain more precisely what a requirement means or is intended to cover; and
  2. Include examples that may be appropriate in the circumstances.

While such guidance does not in itself impose a requirement, it is relevant to the proper application of the requirements.  The application and other explanatory material may also provide background information on matters addressed in an ASAE.  Where appropriate, additional considerations specific to public sector audit organisations or smaller firms are included within the application and other explanatory material.  These additional considerations assist in the application of the requirements in the ASAEs.  They do not, however, limit or reduce the responsibility of the assurance practitioner to apply and comply with the requirements in an ASAE.

Complying with Relevant Requirements (Ref: Para. 17)

Ethical Requirements

(Ref: Para. 3(a), Aus 20.1, 22(a))

A30

Relevant ethical requirements[*] include the following fundamental principles of ethics:

  1. Integrity;
  2. Objectivity;
  3. Professional competence and due care;
  4. Confidentiality; and
  5. Professional behaviour.

The fundamental principles of ethics establish the standard of behaviour expected of an assurance practitioner.

A31

Relevant ethical requirements[#] provide a conceptual framework which the assurance practitioners is required to apply when addressing threats to compliance with the fundamental principles, including:

  1. Identifying threats to compliance with the fundamental principles.  Threats fall into one or more of the following categories:
    1. Self‑interest;
    2. Self‑review;
    3. Advocacy;
    4. Familiarity; and
    5. Intimidation;
  2. Evaluating whether the threats identified are at an acceptable level; and
  3. If the identified threats to compliance with the fundamental principles are not at an acceptable level, addressing them by eliminating the circumstances that create the threats, applying safeguards to reduce threats to an acceptable level, or withdrawing from the engagement, where withdrawal is possible under applicable law or regulation.

A32

Relevant ethical requirements[*] set out requirements and application material on various topics, including:

  • Conflicts of interest;
  • Professional appointments;
  • Second opinions;
  • Fees and other types of remuneration;
  • Inducements, including gifts and hospitality;
  • Custody of client assets; and
  • Responding to non-compliance with laws and regulations. 

A33

Relevant ethical requirements# also include Independence Standards. Independence is defined as comprising both independence of mind and independence in appearance.  Independence safeguards the ability to form an assurance conclusion without being affected by influences that might compromise that conclusion.  Independence enhances the ability to act with integrity, to be objective and to maintain an attitude of professional scepticism. Matters addressed in the Independence Standards in the relevant ethical requirements include, for example:

  • Fees;
  • Gifts and hospitality;
  • Actual of threatened litigation; 
  • Financial interests;
  • Loans and guarantees;
  • Business relationships;
  • Family and personal relationships;
  • Recent service with an assurance client;
  • Serving as a director or officer of an assurance client;
  • Employment with an assurance client; 
  • Long association of personnel with an assurance client;
  • Provision of non‑assurance services to an assurance client; and
  • Reports that include a restriction on use and distribution. 

A34

Professional requirements, or requirements imposed by law or regulation, are at least as demanding as ASA 102 related to assurance engagements when they address all the matters referred to in paragraphs A30–A33 and impose obligations that achieve the aims of the requirements set out in ASA 102 related to such engagements.

Acceptance and Continuance

Preconditions for the Engagement (Ref: Para. 24)

A35

In a public sector environment, some of the preconditions for an assurance engagement may be assumed to be present, for example:

  1. The roles and responsibilities of public sector audit organisations and the public sector entities scoped into assurance engagements are assumed to be appropriate because they are generally set out in legislation;
  2. Public sector audit organisations’ right of access to the information necessary to perform the engagement is often set out in legislation;
  3. The assurance practitioner’s conclusion, in the form appropriate to either a reasonable assurance engagement or a limited assurance engagement, is generally required by legislation to be contained in a written report; and
  4. A rational purpose is generally present because the engagement is set out in legislation.

Roles and Responsibilities (Ref: Para. Aus 12.1, 12(m), 12(n), 12(v), 1324(a), Appendix 1)

A38

Evidence that the appropriate relationship exists with respect to responsibility for the underlying subject matter may be obtained through an acknowledgement provided by the responsible party.  Such an acknowledgement also establishes a basis for a common understanding of the responsibilities of the responsible party and the assurance practitioner.  A written acknowledgement is the most appropriate form of documenting the responsible party’s understanding.  In the absence of a written acknowledgement of responsibility, it may still be appropriate for the assurance practitioner to accept the engagement if, for example, other sources, such as legislation or a contract, indicate responsibility.  In other cases, it may be appropriate to decline the engagement depending on the circumstances, or to disclose the circumstances in the assurance report.

Appropriateness of the Underlying Subject Matter (Ref: Para. 24(b)(i))

A41

The appropriateness of an underlying subject matter is not affected by the level of assurance, that is, if an underlying subject matter is not appropriate for a reasonable assurance engagement, it is also not appropriate for a limited assurance engagement, and vice versa.

A42

Different underlying subject matters have different characteristics, including the degree to which information about them is qualitative versus quantitative, objective versus subjective, historical versus prospective, and relates to a point in time or covers a period.  Such characteristics affect the:

  1. Precision with which the underlying subject matter can be measured or evaluated against criteria; and
  2. The persuasiveness of available evidence.

A43

Identifying such characteristics and considering their effects assist the assurance practitioner when assessing the appropriateness of the underlying subject matter and also in determining the content of the assurance report (see paragraph A164).

Suitability and Availability of the Criteria

Suitability of the criteria (Ref: Para. 24(b)(ii))

A45

Suitable criteria exhibit the following characteristics:

  1. Relevance: Relevant criteria result in subject matter information that assists decision‑making by the intended users.
  2. Completeness: Criteria are complete when subject matter information prepared in accordance with them does not omit relevant factors that could reasonably be expected to affect decisions of the intended users made on the basis of that subject matter information.  Complete criteria include, where relevant, benchmarks for presentation and disclosure.
  3. Reliability: Reliable criteria allow reasonably consistent measurement or evaluation of the underlying subject matter including, where relevant, presentation and disclosure, when used in similar circumstances by different assurance practitioners.
  4. Neutrality: Neutral criteria result in subject matter information that is free from bias as appropriate in the engagement circumstances.
  5. Understandability: Understandable criteria result in subject matter information that can be understood by the intended users.

A46

Vague descriptions of expectations or judgements of an individual’s experiences do not constitute suitable criteria.

A47

The suitability of criteria for a particular engagement depends on whether they reflect the above characteristics.  The relative importance of each characteristic to a particular engagement is a matter of professional judgement.  Further, criteria may be suitable for a particular set of engagement circumstances, but may not be suitable for a different set of engagement circumstances.  For example, reporting to governments or regulators may require the use of a particular set of criteria, but these criteria may not be suitable for a broader group of users.

A48

Criteria can be selected or developed in a variety of ways, for example, they may be:

  • Embodied in law or regulation.
  • Issued by authorised or recognised bodies of experts that follow a transparent due process.
  • Developed collectively by a group that does not follow a transparent due process.
  • Published in scholarly journals or books.
  • Developed for sale on a proprietary basis.
  • Specifically designed for the purpose of preparing the subject matter information in the particular circumstances of the engagement.

How criteria are developed may affect the work that the assurance practitioner carries out to assess their suitability.

A49

In some cases, law or regulation prescribe the criteria to be used for the engagement.  In the absence of indications to the contrary, such criteria are presumed to be suitable, as are criteria issued by authorised or recognised bodies of experts that follow a transparent due process if they are relevant to the intended users’ information needs.  Such criteria are known as established criteria.  Even when established criteria exist for an underlying subject matter, specific users may agree to other criteria for their specific purposes.  For example, various frameworks can be used as established criteria for evaluating the effectiveness of internal control.  Specific users may, however, develop a more detailed set of criteria that meet their specific information needs in relation to, for example, prudential supervision.  In such cases, the assurance report:

  1. Alerts readers that the subject matter information is prepared in accordance with special purpose criteria and that, as a result, the subject matter information may not be suitable for another purpose (see paragraph 69(f)); and
  2. May note, when it is relevant to the circumstances of the engagement, that the criteria are not embodied in law or regulation, or issued by authorised or recognised bodies of experts that follow a transparent due process.

Availability of the criteria (Ref: Para. 24(b)(iii))

A51

Criteria need to be available to the intended users to allow them to understand how the underlying subject matter has been measured or evaluated.  Criteria are made available to the intended users in one or more of the following ways:

  1. Publicly.
  2. Through inclusion in a clear manner in the presentation of the subject matter information.
  3. Through inclusion in a clear manner in the assurance report (see paragraph A165).
  4. By general understanding, for example the criterion for measuring time in hours and minutes.

A52

Criteria may also be available only to intended users, for example the terms of a contract, or criteria issued by an industry association that are available only to those in the industry because they are relevant only to a specific purpose.  When this is the case, paragraph 69(f) requires a statement alerting readers to this fact.  In addition, the assurance practitioner may consider it appropriate to indicate that the assurance report is intended solely for specific users (see paragraph A167–A168).

Access to Evidence (Ref: Para. 24(b)(iv))

Quantity and quality of available evidence

A53

The quantity or quality of available evidence is affected by:

  1. The characteristics of the underlying subject matter or the subject matter information.  For example, less objective evidence might be expected when the subject matter information is future oriented rather than historical; and
  2. Other circumstances, such as when evidence that could reasonably be expected to exist is not available because of, for example, the timing of the assurance practitioner’s appointment, an entity’s document retention policy, inadequate information systems, or a restriction imposed by the responsible party.

Ordinarily, evidence will be persuasive rather than conclusive.

Access to records (Ref: Para. 56)

A54

Seeking the agreement of the appropriate party(ies) that it acknowledges and understands its responsibility to provide the assurance practitioner with the following may assist the assurance practitioner in determining whether the engagement exhibits the characteristic of access to evidence:

  1. Access to all information of which the appropriate party(ies) is aware that is relevant to the preparation of the subject matter information such as records, documentation and other matters;
  2. Additional information that the assurance practitioner may request from the appropriate party(ies) for the purpose of the engagement; and
  3. Unrestricted access to persons from the appropriate party(ies) from whom the assurance practitioner determines it necessary to obtain evidence.

A Rational Purpose (Ref: Para. 24(b)(vi))

A56

In determining whether the engagement has a rational purpose, relevant considerations may include the following:

  • The intended users of the subject matter information and the assurance report (particularly, when the criteria are designed for a special purpose).  A further consideration is the likelihood that the subject matter information and the assurance report will be used or distributed more broadly than to intended users.
  • Whether aspects of the subject matter information are expected to be excluded from the assurance engagement, and the reason for their exclusion.
  • The characteristics of the relationships between the responsible party, the measurer or evaluator, and the engaging party, for example, when the measurer or evaluator is not the responsible party, whether the responsible party consents to the use to be made of the subject matter information and will have the opportunity to review the subject matter information before it is made available to intended users or to distribute comments with the subject matter information.
  • Who selected the criteria to be applied to measure or evaluate the underlying subject matter, and what the degree of judgement and scope for bias is in applying them.  The engagement is more likely to have a rational purpose if the intended users selected or were involved in selecting the criteria.
  • Any significant limitations on the scope of the assurance practitioner’s work.
  • Whether the assurance practitioner believes the engaging party intends to associate the assurance practitioner’s name with the underlying subject matter or the subject matter information in an inappropriate manner.

Agreeing on the Terms of the Engagement (Ref: Para. 27)

Acceptance of a Change in the Terms of the Engagement (Ref: Para. 29)

A59

A change in circumstances that affects the intended users’ requirements, or a misunderstanding concerning the nature of the engagement, may justify a request for a change in the engagement, for example, from an assurance engagement to a non-assurance engagement, or from a reasonable assurance engagement to a limited assurance engagement. An inability to obtain sufficient appropriate evidence to form a reasonable assurance conclusion is not an acceptable reason to change from a reasonable assurance engagement to a limited assurance engagement.

Quality Management

Assurance Practitioners in Public Practice (Ref: Para. Aus 20.131(a)–(b))

A60

This ASAE has been written in the context of a range of measures taken to ensure the quality of assurance engagements undertaken by assurance practitioners in public practice.  Such measures may include:

  • Competency requirements, such as education and experience benchmarks for entry to membership, and ongoing continuing professional development as well as life‑long learning requirements.
  • A system of quality management implemented across the firm.  ASQM 1 applies to all firms in respect of assurance and related services engagements.
  • A comprehensive Code of Ethics, including detailed independence requirements, founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.

Firm Level Quality Management (Ref: Para. 3(b), 31(a))

A61

ASQM 1 deals with the firm’s responsibilities to design, implement and operate a system of quality management for assurance engagements.[5] It sets out the responsibilities of the firm for establishing quality objectives that address the fulfillment of responsibilities in accordance with relevant ethical requirements, including those related to independence. ASQM 1 also deals with the firm’s responsibility to establish policies or procedures addressing engagements that are required to be subject to engagement quality reviews.[6] ASQM 2 deals with the appointment and eligibility of the engagement quality reviewer, and the performance and documentation of the engagement quality review.[7] A system of quality management addresses the following eight components:[8]

  1. The firm's risk assessment process;
  2. Governance and leadership;
  3. Relevant ethical requirements;
  4. Acceptance and continuance of client relationships and specific engagements;
  5. Engagement performance;
  6. Resources;
  7. Information and communication; and
  8. The monitoring and remediation process.

Firms or national requirements may use different terminology or frameworks to describe the components of the system of quality management.

A62

Other professional requirements, or requirements in law or regulation that deal with the firm’s responsibilities to design, implement, and operate a system of quality management, are at least as demanding as ASQM 1 when they address the requirements of ASQM 1 and impose obligations on the firm to achieve the objective of ASQM 1.

A63

The actions of the lead assurance practitioner, and appropriate messages to the other members of the engagement team, in the context of the lead assurance practitioner taking overall responsibility for managing and achieving quality on each engagement and being sufficiently and appropriately involved throughout the engagement, emphasise the fact that quality is essential in performing an assurance engagement, and the importance to the quality of the assurance engagement of:

  1. Performing work that complies with professional standards and regulatory and legal requirements. 
  2. Complying with the firm’s policies or procedures as applicable.
  3. Issuing a report for the engagement that is appropriate in the circumstances.
  4. The engagement team’s ability to raise concerns without fear of reprisals.

A64

A firm’s system of quality management includes establishing a monitoring and remediation process designed to:

  1. Provide the firm with relevant, reliable and timely information about the design, implementation and operation of the system of quality management.
  2. Take appropriate actions to respond to identified deficiencies such that deficiencies are remediated by the firm on a timely basis.

A65

Ordinarily, the engagement team may depend on the firm’s system of quality management unless:

  • The engagement team’s understanding or practical experience indicates that the firm’s policies or procedures will not effectively address the nature and circumstances of the engagement; or
  • Information provided by the firm or other parties, about the effectiveness of such policies or procedures suggests otherwise.

For example, the engagement team may depend on the firm’s system of quality management in relation to:

  1. Competence and capabilities of personnel through their recruitment and formal training.
  2. Independence through the accumulation and communication of relevant independence information.
  3. Maintenance of client relationships through the firm’s policies or procedures for acceptance and continuance of client relationships and assurance engagements.
  4. Adherence to regulatory and legal requirements through the firm’s monitoring and remediation process. .

In considering deficiencies[9] identified in the firm’s system of quality management that may affect the assurance engagement, the lead assurance practitioner may consider the remedial actions undertaken by the firm to address those deficiencies.

Skills, Knowledge and Experience with Respect to the Underlying Subject Matter and Its Measurement or Evaluation (Ref: Para. 31(c))

A68

The relevant ethical requirements related to assurance engagements provide requirements and guidance on the self-interest threat to compliance with the principle of professional competence and due care that is created if the engagement team does not possess, or cannot acquire, the competencies to perform the professional services.[*] [10] The assurance practitioner has sole responsibility for the assurance conclusion expressed, and that responsibility is not reduced by the assurance practitioner’s use of the work of an assurance practitioner’s expert.  Nonetheless, if the assurance practitioner using the work of an assurance practitioner’s expert, having followed this ASAE, concludes that the work of that expert is adequate for the assurance practitioner’s purposes, the assurance practitioner may accept that expert’s findings or conclusions in the expert’s field as appropriate evidence.

Engagement Resources

Collective Competence and Capabilities (Ref: Para. 32)

A69

ASQM 1 requires the firm to establish quality objectives that address the acceptance and continuance of client relationships and assurance engagements. The quality objectives deal with the appropriateness of judgments by the firm about whether to accept or continue relationships and engagements that are based on the firm’s ability to perform the engagement in accordance with professional standards and applicable legal and regulatory requirements.[11]

Assurance Practitioner’s Expert (Ref: Para. 32(a), 32(b)(i))

A70

Some of the assurance work may be performed by a multi‑disciplinary team that includes one or more assurance practitioner’s expert.  For example, an assurance practitioner’s expert may be needed to assist the assurance practitioner in obtaining an understanding of the underlying subject matter and other engagement circumstances or in one or more of the matters mentioned in paragraph 46R (in the case of a reasonable assurance engagement) or 46L (in the case of a limited assurance engagement).

A71

When the work of an assurance practitioner’s expert is to be used, it may be appropriate to perform some of the procedures required by paragraph 52 at the engagement acceptance or continuance stage.

Other Assurance Practitioners (Ref: Para. 32(b)(ii))

A73

The work of another assurance practitioner may be used in relation to, for example, an underlying subject matter at a remote location or in a foreign jurisdiction.  Such other assurance practitioners are not part of the engagement team.  Relevant considerations when the engagement team plans to use the work of another assurance practitioner may include:

  • Whether the other assurance practitioner understands and complies with the ethical requirements that are relevant to the engagement and, in particular, is independent.
  • The other assurance practitioner’s professional competence.
  • The extent of the engagement team’s involvement in the work of the other assurance practitioner.
  • Whether the other assurance practitioner operates in a regulatory environment that actively oversees that assurance practitioner.

Review Responsibilities (Ref: Para. 33(c))

A74

Under ASQM 1, the firm is required to establish a quality objective that addresses the nature, timing, and extent of the direction and supervision of engagement teams and review of their work. ASQM 1 also requires that such direction, supervision and review is planned and performed on the basis that the work performed by less experienced engagement team members is directed, supervised and reviewed by more experienced engagement team members.[12]

Engagement Quality Review (Ref: Para. 36(b))

A75

Other matters that may be considered in an engagement quality review include:

  1. The engagement team’s evaluation of the firm’s independence in relation to the engagement;
  2. Whether appropriate consultation has taken place on matters involving differences of opinion or other difficult or contentious matters, and the conclusions arising from those consultations; and
  3. Whether engagement documentation selected for review reflects the work performed in relation to the significant judgements and supports the conclusions reached.

Professional Scepticism and Professional Judgement

Professional Scepticism (Ref: Para. 37)

A76

Professional scepticism is an attitude that includes being alert to, for example:

  • Evidence that is inconsistent with other evidence obtained.
  • Information that calls into question the reliability of documents and responses to enquiries to be used as evidence.
  • Circumstances that suggest the need for procedures in addition to those required by relevant ASAEs.
  • Conditions that may indicate likely misstatement.

A77

Maintaining professional scepticism throughout the engagement is necessary if the assurance practitioner is, for example, to reduce the risks of:

  • Overlooking unusual circumstances.
  • Overgeneralising when drawing conclusions from observations.
  • Using inappropriate assumptions in determining the nature, timing, and extent of the procedures, and evaluating the results thereof.

A78

Professional scepticism is necessary to the critical assessment of evidence.  This includes questioning inconsistent evidence and the reliability of documents and responses to enquiries.  It also includes consideration of the sufficiency and appropriateness of evidence obtained in the light of the circumstances.

A79

Unless the engagement involves assurance about whether documents are genuine, the assurance practitioner may accept records and documents as genuine unless the assurance practitioner has reason to believe the contrary.  Nevertheless, the assurance practitioner is required by paragraph 50 to consider the reliability of information to be used as evidence.

Professional Judgement (Ref: Para. 38)

A81

Professional judgement is essential to the proper conduct of an assurance engagement.  This is because interpretation of relevant ethical requirements and relevant ASAEs and the informed decisions required throughout the engagement cannot be made without the application of relevant training, knowledge, and experience to the facts and circumstances.  Professional judgement is necessary in particular regarding decisions about:

  • Materiality and engagement risk.
  • The nature, timing, and extent of procedures used to meet the requirements of relevant ASAEs and obtain evidence.
  • Evaluating whether sufficient appropriate evidence has been obtained, and whether more needs to be done to achieve the objectives of this ASAE and any relevant subject matter specific ASAE.  In particular, in the case of a limited assurance engagement, professional judgement is required in evaluating whether a meaningful level of assurance has been obtained.
  • The appropriate conclusions to draw based on the evidence obtained.

A82

The distinguishing feature of the professional judgement expected of an assurance practitioner is that it is exercised by an assurance practitioner whose training, knowledge and experience have assisted in developing the necessary competencies to achieve reasonable judgements.

A83

The exercise of professional judgement in any particular case is based on the facts and circumstances that are known by the assurance practitioner.  Consultation on difficult or contentious matters during the course of the engagement, both within the engagement team and between the engagement team and others at the appropriate level within or outside the firm assist the assurance practitioner in making informed and reasonable judgements, including the extent to which particular items in the subject matter information are affected by judgement of the appropriate party.

A84

Professional judgement can be evaluated based on whether the judgement reached reflects a competent application of assurance and measurement or evaluation principles and is appropriate in the light of, and consistent with, the facts and circumstances that were known to the assurance practitioner up to the date of the assurance practitioner’s assurance report.

A85

Professional judgement needs to be exercised throughout the engagement. It also needs to be appropriately documented. In this regard, paragraph 79 requires the assurance practitioner to prepare documentation sufficient to enable an experienced assurance practitioner, having no previous connection with the engagement, to understand the significant professional judgements made in reaching conclusions on significant matters arising during the engagement. Professional judgement is not to be used as the justification for decisions that are not otherwise supported by the facts and circumstances of the engagement or sufficient appropriate evidence.

Planning and Performing the Engagement

Planning (Ref: Para. 40)

A86

Planning involves the lead assurance practitioner, other key members of the engagement team, and any key assurance practitioner’s external experts developing an overall strategy for the scope, emphasis, timing and conduct of the engagement, and an engagement plan, consisting of a detailed approach for the nature, timing and extent of procedures to be performed, and the reasons for selecting them.  Adequate planning helps to devote appropriate attention to important areas of the engagement, identify potential problems on a timely basis and properly organise and manage the engagement in order for it to be performed in an effective and efficient manner.  Adequate planning also assists the assurance practitioner to properly assign work to engagement team members, and facilitates the direction, and supervision of engagement team members and the review of their work.  Further, it assists, where applicable, the co‑ordination of work done by other assurance practitioners and experts.  The nature and extent of planning activities will vary with the engagement circumstances, for example the complexity of the underlying subject matter and criteria.  Examples of the main matters that may be considered include:

  • The characteristics of the engagement that define its scope, including the terms of the engagement and the characteristics of the underlying subject matter and the criteria.
  • The expected timing and the nature of the communications required.
  • The results of engagement acceptance activities and, where applicable, whether knowledge gained on other engagements performed by the lead assurance practitioner for the appropriate party(ies) is relevant.
  • The engagement process.
  • The assurance practitioner’s understanding of the appropriate party(ies) and their environment, including the risks that the subject matter information may be materially misstated.
  • Identification of intended users and their information needs, and consideration of materiality and the components of engagement risk. 
  • The extent to which the risk of fraud is relevant to the engagement.
  • The nature, timing and extent of resources necessary to perform the engagement, such as personnel and expertise requirements, including the nature and extent of experts’ involvement.
  • The impact of the internal audit function on the engagement.

A87

The assurance practitioner may decide to discuss elements of planning with the appropriate party(ies) to facilitate the conduct and management of the engagement (for example, to co‑ordinate some of the planned procedures with the work of the appropriate party(ies)’s personnel).  Although these discussions often occur, the overall engagement strategy and the engagement plan remain the assurance practitioner’s responsibility.  When discussing matters included in the overall engagement strategy or engagement plan, care is required in order not to compromise the effectiveness of the engagement.  For example, discussing the nature and timing of detailed procedures with the appropriate party(ies) may compromise the effectiveness of the engagement by making the procedures too predictable.

A88

Planning is not a discrete phase, but rather a continual and iterative process throughout the engagement.  As a result of unexpected events, changes in conditions, or evidence obtained, the assurance practitioner may need to revise the overall strategy and engagement plan, and thereby the resulting planned nature, timing and extent of procedures.

A90

If in the circumstances described in paragraph 43, the assurance continues with the engagement:

  1. When, in the assurance practitioner’s professional judgement, the unsuitable applicable criteria or inappropriate underlying subject matter is likely to mislead the intended users, a qualified conclusion or adverse conclusion would be appropriate in the circumstances depending on how material and pervasive the matter is.
  2. In other cases, a qualified conclusion or a disclaimer of conclusion would be appropriate depending on, in the assurance practitioner’s professional judgement, how material and pervasive the matter is.

Materiality (Ref: Para. 44)

A93

The applicable criteria may discuss the concept of materiality in the context of the preparation and presentation of the subject matter information and thereby provide a frame of reference for the assurance practitioner in considering materiality for the engagement.  Although applicable criteria may discuss materiality in different terms, the concept of materiality generally includes the matters discussed in paragraphs A92–A100.  If the applicable criteria do not include a discussion of the concept of materiality, these paragraphs provide the assurance practitioner with a frame of reference.

A94

Misstatements, including omissions, are considered to be material if they, individually or in the aggregate, could reasonably be expected to influence relevant decisions of intended users taken on the basis of the subject matter information.  The assurance practitioner’s consideration of materiality is a matter of professional judgement, and is affected by the assurance practitioner’s perception of the common information needs of intended users as a group.  In this context, it is reasonable for the assurance practitioner to assume that intended users:

  1. Have a reasonable knowledge of the underlying subject matter, and a willingness to study the subject matter information with reasonable diligence;
  2. Understand that the subject matter information is prepared and assured to appropriate levels of materiality, and have an understanding of any materiality concepts included in the applicable criteria;
  3. Understand any inherent uncertainties involved in the measuring or evaluating the underlying subject matter; and
  4. Make reasonable decisions on the basis of the subject matter information taken as a whole.

Unless the engagement has been designed to meet the particular information needs of specific users, the possible effect of misstatements on specific users, whose information needs may vary widely, is not ordinarily considered (see also paragraphs A16–A18).

A95

Materiality is considered in the context of qualitative factors and, when applicable, quantitative factors.  The relative importance of qualitative factors and quantitative factors when considering materiality in a particular engagement is a matter for the assurance practitioner’s professional judgement.

 

A96

Qualitative factors may include such things as:

  • The number of persons or entities affected by the subject matter.
  • The interaction between, and relative importance of, various components of the subject matter information when it is made up of multiple components, such as a report that includes numerous performance indicators.
  • The wording chosen with respect to subject matter information that is expressed in narrative form.
  • The characteristics of the presentation adopted for the subject matter information when the applicable criteria allow for variations in that presentation.
  • The nature of a misstatement, for example, the nature of observed deviations from a control when the subject matter information is a statement that the control is effective.
  • Whether a misstatement affects compliance with law or regulation.
  • In the case of periodic reporting on an underlying subject matter, the effect of an adjustment that affects past or current subject matter information or is likely to affect future subject matter information.
  • Whether a misstatement is the result of an intentional act or is unintentional.
  • Whether a misstatement is significant having regard to the assurance practitioner’s understanding of known previous communications to users, for example, in relation to the expected outcome of the measurement or evaluation of the underlying subject matter.
  • Whether a misstatement relates to the relationship between the responsible party, the measurer or evaluator, or the engaging party or their relationship with other parties.
  • When a threshold or benchmark value has been identified, whether the result of the procedure deviates from that value.
  • When the underlying subject matter is a governmental program or public sector entity, whether a particular aspect of the program or entity is significant with regard to the nature, visibility and sensitivity of the program or entity.
  • When the subject matter information relates to a conclusion on compliance with law or regulation, the seriousness of the consequences of non‑compliance.

A97

Quantitative factors relate to the magnitude of misstatements relative to reported amounts for those aspects of the subject matter information, if any, that are:

  • Expressed numerically; or
  • Otherwise related to numerical values (for example, the number of observed deviations from a control may be a relevant quantitative factor when the subject matter information is a statement that the control is effective).

A98

When quantitative factors are applicable, planning the engagement solely to detect individually material misstatements overlooks the fact that the aggregate of uncorrected and undetected individually immaterial misstatements may cause the subject matter information to be materially misstated.  It may therefore be appropriate when planning the nature, timing and extent of procedures for the assurance practitioner to determine a quantity less than materiality as a basis for determining the nature, timing and extent of procedures.

A99

Materiality relates to the information covered by the assurance report.  Therefore, when the engagement covers some, but not all, aspects of the information communicated about an underlying subject matter, materiality is considered in relation to only that portion that is covered by the engagement.

A100

Concluding on the materiality of the misstatements identified as a result of the procedures performed requires professional judgement.  For example:

  • The applicable criteria for a value for money engagement for a hospital’s emergency department may include the speed of the services provided, the quality of the services, the number of patients treated during a shift, and benchmarking the cost of the services against other similar hospitals.  If three of these applicable criteria are satisfied but one applicable criterion is not satisfied by a small margin, then professional judgement is needed to conclude whether the hospital’s emergency department represents value for money as a whole.
  • In a compliance engagement, the entity may have complied with nine provisions of the relevant law or regulation, but did not comply with one provision.  Professional judgement is needed to conclude whether the entity complied with the relevant law or regulation as a whole.  For example, the assurance practitioner may consider the significance of the provision with which the entity did not comply, as well as the relationship of that provision to the remaining provisions of the relevant law or regulation.

Understanding the Engagement Circumstances (Ref: Para. 45–47R)

A102

The assurance practitioner may have additional responsibilities under law, regulation or relevant ethical requirements regarding an entity’s non‑compliance with laws and regulations, which may differ from or go beyond the assurance practitioner’s responsibilities under this ASAE, such as:

  1. Responding to identified or suspected non‑compliance with laws and regulations, including requirements in relation to specific communications with management and those charged with governance and considering whether further action is needed;
  2. Communicating identified or suspected non‑compliance with laws and regulations to an auditor;[13] and
  3. Documentation requirements regarding identified or suspected non‑compliance with laws and regulations.

Complying with any additional responsibilities may provide further information that is relevant to the assurance practitioner’s work in accordance with this and any other ASAE (e.g., regarding the integrity of the responsible party or those charged with governance). Paragraphs A195–A199 further address the assurance practitioner’s responsibilities under law, regulation or relevant ethical requirements regarding communicating and reporting identified or suspected non‑compliance with laws and regulations.

A103

Obtaining an understanding of the underlying subject matter and other engagement circumstances provides the assurance practitioner with a frame of reference for exercising professional judgement throughout the engagement, for example when:

  • Considering the characteristics of the underlying subject matter;
  • Assessing the suitability of criteria;
  • Considering the factors that, in the assurance practitioner’s professional judgement, are significant in directing the engagement team’s efforts, including where special consideration may be necessary; for example, the need for specialised skills or the work of an expert;
  • Establishing and evaluating the continued appropriateness of quantitative materiality levels (where appropriate), and considering qualitative materiality factors;
  • Developing expectations for use when performing analytical procedures;
  • Designing and performing procedures; and
  • Evaluating evidence, including the reasonableness of the oral and written representations received by the assurance practitioner.

Obtaining Evidence

The Nature, Timing and Extent of Procedures (Ref: Para.48(L)–49(R))

A109

The assurance practitioner chooses a combination of procedures to obtain reasonable assurance or limited assurance, as appropriate.  The procedures listed below may be used, for example, for planning or performing the engagement, depending on the context in which they are applied by the assurance practitioner:

  • Inspection;
  • Observation;
  • Confirmation;
  • Re‑calculation;
  • Re‑performance;
  • Analytical procedures; and
  • Enquiry.

A110

Factors that may affect the assurance practitioner’s selection of procedures include the nature of the underlying subject matter; the level of assurance to be obtained; and the information needs of the intended users and the engaging party, including relevant time and cost constraints.

A111

In some cases, a subject matter‑specific ASAE may include requirements that affect the nature, timing and extent of procedures.  For example, a subject matter‑specific ASAE may describe the nature or extent of particular procedures to be performed or the level of assurance expected to be obtained in a particular type of engagement.  Even in such cases, determining the exact nature, timing and extent of procedures is a matter of professional judgement and will vary from one engagement to the next.

A112

In some engagements, the assurance practitioner may not identify any areas where a material misstatement of the subject matter information is likely to arise.  Irrespective of whether any such areas have been identified, the assurance practitioner designs and performs procedures to obtain a meaningful level of assurance.

Determining Whether Additional Procedures Are Necessary in a Limited Assurance Engagement (Ref: Para. 49L)

A114

The assurance practitioner may become aware of misstatements that are, after applying professional judgement, clearly not indicative of the existence of material misstatements.  The following examples illustrate when additional procedures may not be needed because, in the assurance practitioner’s professional judgement, the identified misstatements are clearly not indicative of the existence of material misstatements:

  • If materiality is 10,000 units, and the assurance practitioner judges that a potential error of 100 units may exist, then additional procedures would not generally be required, unless there are other qualitative factors that need to be considered, because the risk of a material misstatement is likely to be acceptable in the engagement circumstances. 
  • If, in performing a set of procedures over an area where material misstatements are likely, a response to one enquiry among many was not as expected, additional procedures may not be needed if the risk of a material misstatement is, nevertheless, at a level that is acceptable in the circumstances of the engagement in light of the results of other procedures.

A115

The assurance practitioner may become aware of a matter(s) that causes the assurance practitioner to believe that the subject matter information may be materially misstated.  The following examples illustrate when additional procedures may be needed as the identified misstatements indicate that the subject matter information may be materially misstated:

  • When performing analytical procedures, the assurance practitioner may identify a fluctuation or relationship that is inconsistent with other relevant information or that differs significantly from expected amounts or ratios.
  • The assurance practitioner may become aware of a potential material misstatement from reviewing external sources.
  • If the applicable criteria permit a 10% error rate and, based on a particular test, the assurance practitioner discovered a 9% error rate, then additional procedures may be needed because the risk of a material misstatement may not be acceptable in the engagement circumstances.
  • If the results of analytical procedures are within expectations but are, nevertheless, close to exceeding the expected value, then additional procedures may be needed because the risk of a material misstatement may not be acceptable in the engagement circumstances.

A116

If, in the case of a limited assurance engagement, a matter(s) comes to the assurance practitioner’s attention that causes the assurance practitioner to believe the subject matter information may be materially misstated, the assurance practitioner is required by paragraph 49L to design and perform additional procedures.  Additional procedures may include, for example, enquiring of the appropriate party(ies) or performing other procedures as appropriate in the circumstances. 

A117

If, having performed the additional procedures required by paragraph 49L, the assurance practitioner is not able to obtain sufficient appropriate evidence to either conclude that the matter(s) is not likely to cause the subject matter information to be materially misstated or determine that it does cause the subject matter information to be materially misstated, a scope limitation exists and paragraph 66 applies.

A118

The assurance practitioner’s judgement about the nature, timing and extent of additional procedures that are needed to obtain evidence to either conclude that a material misstatement is not likely, or determine that a material misstatement exists, is, for example, guided by:

  • Information obtained from the assurance practitioner’s evaluation of the results of the procedures already performed;
  • The assurance practitioner’s updated understanding of the underlying subject matter and other engagement circumstances obtained throughout the course of the engagement; and
  • The assurance practitioner’s view on the persuasiveness of evidence needed to address the matter that causes the assurance practitioner to believe that the subject matter information may be materially misstated.

Accumulating Uncorrected Misstatements (Ref: Para. 5165)

A119

Uncorrected misstatements are accumulated during the engagement (see paragraph 51) for the purpose of evaluating whether, individually or in aggregate, they are material when forming the assurance practitioner’s conclusion.

Considerations When an Assurance Practitioner’s Expert Is Involved on the Engagement

Nature, Timing and Extent of Procedures (Ref: Para. 52)

A121

The following matters are often relevant when determining the nature, timing and extent of procedures with respect to the work of an assurance practitioner’s expert when some of the assurance work is performed by one or more assurance practitioner’s expert (see paragraph A70):

  1. The significance of that expert’s work in the context of the engagement (see also paragraphs A122–A123);
  2. The nature of the matter to which that expert’s work relates;
  3. The risks of material misstatement in the matter to which that expert’s work relates;
  4. The assurance practitioner’s knowledge of and experience with previous work performed by that expert; and
  5. Whether that expert is subject to the assurance practitioner’s firm’s quality management policies or procedures (see also paragraphs A124–A125).

Integrating the work of an assurance practitioner’s expert

A123

As noted in paragraph A71, when the work of an assurance practitioner’s expert is to be used, it may be appropriate to perform some of the procedures required by paragraph 52 at the engagement acceptance or continuance stage.  This is particularly so when the work of the assurance practitioner’s expert will be fully integrated with the work of other assurance personnel and when the work of the assurance practitioner’s expert is to be used in the early stages of the engagement, for example during initial planning and risk assessment.

The assurance practitioner’s firm’s quality management policies or procedures

A124

An assurance practitioner’s internal expert may be a partner or staff, including temporary staff, of the assurance practitioner’s firm, and therefore subject to the firm’s system of quality management, including its policies or procedures, in accordance with ASQM 1 or other professional requirements, or requirements in law or regulation, that are at least as demanding as ASQM 1. Alternatively, an assurance practitioner’s internal expert may be a partner or staff, including temporary staff, of a network firm, which may share common quality management policies or procedures with the assurance practitioner’s firm. An assurance practitioner’s external expert is not a member of the engagement team.

A125

Ordinarily, the engagement team may depend on the firm’s system of quality management (see paragraph A65). The extent of dependence will vary with the circumstances, and may affect the nature, timing and extent of the assurance practitioner’s procedures with respect to such matters as:

  • Competence and capabilities, through recruitment and training programs.
  • The assurance practitioner’s evaluation of the objectivity of the assurance practitioner’s expert.  Assurance practitioner’s internal experts are subject to relevant ethical requirements, including those pertaining to independence.
  • The assurance practitioner’s evaluation of the adequacy of the assurance practitioner’s expert’s work.  For example, the firm’s training programs may provide the assurance practitioner’s internal experts with an appropriate understanding of the interrelationship of their expertise with the evidence gathering process.  Depending on such training and other firm processes, such as protocols for scoping the work of the assurance practitioner’s internal experts, may affect the nature, timing and extent of the assurance practitioner’s procedures to evaluate the adequacy of the assurance practitioner’s expert’s work.
  • Adherence to regulatory and legal requirements, through the firm's monitoring and remediation process.
  • Agreement with the assurance practitioner’s expert.

Such dependance does not reduce the assurance practitioner’s responsibility to meet the requirements of this ASAE.

The Competence, Capabilities and Objectivity of the Assurance Practitioner’s Expert (Ref: Para. 52(a))

A126

Information regarding the competence, capabilities and objectivity of an assurance practitioner’s expert may come from a variety of sources, such as:

  • Personal experience with previous work of that expert.
  • Discussions with that expert.
  • Discussions with other assurance practitioners or others who are familiar with that expert’s work.
  • Knowledge of that expert’s qualifications, membership of a professional body or industry association, license to practice, or other forms of external recognition.
  • Published papers or books written by that expert.
  • The firm’s quality management policies or procedures (see also paragraphs A124–A125).

A127

While assurance practitioner’s experts do not require the same proficiency as the assurance practitioner in performing all aspects of an assurance engagement, an assurance practitioner’s expert whose work is used may need a sufficient understanding of relevant ASAEs to enable that expert to relate the work assigned to them to the engagement objective.

A128

The evaluation of whether the threats to objectivity are at an acceptable level may depend upon the role of the assurance practitioner’s expert and the significance of the expert’s work in the context of the engagement. In some cases, it may not be possible to eliminate circumstances that create threats or apply safeguards to reduce threats to an acceptable level, for example, if a proposed assurance practitioner’s expert is an individual who has played a significant role in preparing the subject matter information.

A129

When evaluating the objectivity of an assurance practitioner’s external expert, it may be relevant to:

  • Enquire of the appropriate party(ies) about any known interests or relationships that the appropriate party(ies) has with the assurance practitioner’s external expert that may affect that expert’s objectivity.
  • Discuss with that expert any applicable safeguards, including any professional requirements that apply to that expert, and evaluate whether the safeguards are adequate to reduce threats to an acceptable level.  Interests and relationships that it may be relevant to discuss with the assurance practitioner’s expert include:
    • Financial interests.
    • Business and personal relationships.
    • Provision of other services by the expert, including by the organisation in the case of an external expert that is an organisation.

In some cases, it may also be appropriate for the assurance practitioner to obtain a written representation from the assurance practitioner’s external expert about any interests or relationships with the appropriate party(ies) of which that expert is aware.

Obtaining an Understanding of the Field of Expertise of the Assurance Practitioner’s Expert (Ref: Para. 52(b))

A130

Having a sufficient understanding of the field of expertise of the assurance practitioner’s expert enables the assurance practitioner to:

  1. Agree with the assurance practitioner’s expert the nature, scope and objectives of that expert’s work for the assurance practitioner’s purposes; and
  2. Evaluate the adequacy of that work for the assurance practitioner’s purposes.

A131

Aspects of the assurance practitioner’s expert’s field relevant to the assurance practitioner’s understanding may include:

  • Whether that expert’s field has areas of specialty within it that are relevant to the engagement.
  • Whether any professional or other standards and regulatory or legal requirements apply.
  • What assumptions and methods, including models where applicable, are used by the assurance practitioner’s expert, and whether they are generally accepted within that expert’s field and appropriate in the circumstances of the engagement.
  • The nature of internal and external data or information the assurance practitioner’s expert uses.

Agreement with the Assurance Practitioner’s Expert (Ref: Para. 52(c))

A132

It may be appropriate for the assurance practitioner’s agreement with the assurance practitioner’s expert to also include matters such as the following:

  1. The respective roles and responsibilities of the assurance practitioner and that expert;
  2. The nature, timing and extent of communication between the assurance practitioner and that expert, including the form of any report to be provided by that expert; and
  3. The need for the assurance practitioner’s expert to observe confidentiality requirements.

A133

The matters noted in paragraph A125 may affect the level of detail and formality of the agreement between the assurance practitioner and the assurance practitioner’s expert, including whether it is appropriate that the agreement be in writing.  The agreement between the assurance practitioner and an assurance practitioner’s external expert is often in the form of an engagement letter.

Evaluating the Adequacy of the Assurance Practitioner’s Expert’s Work (Ref: Para. 52(d))

A134

The following matters may be relevant when evaluating the adequacy of the assurance practitioner’s expert’s work for the assurance practitioner’s purposes:

  1. The relevance and reasonableness of that expert’s findings or conclusions, and their consistency with other evidence;
  2. If that expert’s work involves use of significant assumptions and methods, the relevance and reasonableness of those assumptions and methods in the circumstances; and
  3. If that expert’s work involves the use of source data that is significant to that expert’s work, the relevance, completeness, and accuracy of that source data.

A135

If the assurance practitioner determines that the work of the assurance practitioner’s expert is not adequate for the assurance practitioner’s purposes, options available to the assurance practitioner include:

  1. Agreeing with that expert on the nature and extent of further work to be performed by that expert; or
  2. Performing additional procedures appropriate to the circumstances.

Work Performed by Another Assurance Practitioner, a Responsible Party’s or Measurer’s or Evaluator’s Expert or an Internal Auditor (Ref: Para. 53–55)

A136

While paragraphs A121–A135 have been written in the context of using work performed by an assurance practitioner’s expert, they may also provide helpful guidance with respect to using work performed by another assurance practitioner, a responsible party’s or measurer’s or evaluator’s expert, or an internal auditor.

Written Representations (Ref: Para. 56)

A138

Other written representations requested may include the following:

  • Whether the appropriate party(ies) believes the effects of uncorrected misstatements are immaterial, individually and in aggregate, to the subject matter information.  A summary of such items is ordinarily included in or attached to the written representation;
  • That significant assumptions used in making any material estimates are reasonable;
  • That the appropriate party(ies) has communicated to the assurance practitioner all deficiencies in internal control relevant to the engagement that are not clearly trivial and inconsequential of which the appropriate party(ies) is aware; and
  • When the responsible party is different from the measurer or evaluator, that the responsible party acknowledges responsibility for the underlying subject matter.

Requested Written Representations Not Provided or Not Reliable (Ref: Para. 60)

A140

Circumstances in which the assurance practitioner may not be able to obtain requested written representations include, for example, when:

  • The responsible party contracts a third party to perform the relevant measurement or evaluation and later engages the assurance practitioner to undertake an assurance engagement on the resultant subject matter information.  In some such cases, for example where the responsible party has an ongoing relationship with the measurer or evaluator, the responsible party may be able to arrange for the measurer or evaluator to provide requested written representations, or the responsible party may be in a position to provide such representations if the responsible party has a reasonable basis for doing so, but in other cases this may not be so.
  • An intended user engages the assurance practitioner to undertake an assurance engagement on publicly available information but does not have a relationship with the responsible party of the kind necessary to ensure that party responds to the assurance practitioner’s request for a written representation.
  • The assurance engagement is undertaken against the wishes of the measurer or evaluator.  This may be the case when, for example, the engagement is undertaken pursuant to a court order, or a public sector assurance practitioner is required by the legislature or other competent authority to undertake a particular engagement.

In these or similar circumstances, the assurance practitioner may not have access to the evidence needed to support the assurance practitioner’s conclusion.  If this is the case, paragraph 66 of this ASAE applies.

Subsequent Events

(Ref: Para. 61)

A142

As noted in paragraph 61, the assurance practitioner has no responsibility to perform any procedures regarding the subject matter information after the date of the assurance practitioner’s report.  However, if, after the date of the assurance practitioner’s report, a fact becomes known to the assurance practitioner that, had it been known to the assurance practitioner at the date of the assurance practitioner’s report, may have caused the assurance practitioner to amend the report, the assurance practitioner may need to discuss the matter with the appropriate party(ies) or take other action as appropriate in the circumstances.

Other Information

(Ref: Para. 62)

A143

Further actions that may be appropriate if the assurance practitioner identifies a material inconsistency or becomes aware of a material misstatement of fact include, for example:

  • Requesting the appropriate party(ies) to consult with a qualified third party, such as the appropriate party(ies)’s legal counsel.
  • Obtaining legal advice about the consequences of different courses of action.
  • Communicating with third parties (for example, a regulator).
  • Withholding the assurance report.
  • Withdrawing from the engagement, where withdrawal is possible under applicable law or regulation.
  • Describing the material inconsistency in the assurance report.

Description of Applicable Criteria

(Ref: Para. 63)

A145

A description that the subject matter information is prepared in accordance with particular applicable criteria is appropriate only if the subject matter information complies with all relevant requirements of those applicable criteria that are effective.

Forming the Assurance Conclusion

Sufficiency and Appropriateness of Evidence (Ref: Para. 12(i), 64)

A148

The sufficiency and appropriateness of evidence are interrelated.  Sufficiency is the measure of the quantity of evidence.  The quantity of evidence needed is affected by the risks of the subject matter information being materially misstated (the higher the risks, the more evidence is likely to be required) and also by the quality of such evidence (the higher the quality, the less may be required).  Obtaining more evidence, however, may not compensate for its poor quality.

A149

Appropriateness is the measure of the quality of evidence; that is, its relevance and its reliability in providing support for the assurance practitioner’s conclusion.  The reliability of evidence is influenced by its source and by its nature, and is dependent on the individual circumstances under which it is obtained.  Generalizations about the reliability of various kinds of evidence can be made; however, such generalizations are subject to important exceptions.  Even when evidence is obtained from sources external to the appropriate party(ies), circumstances may exist that could affect its reliability.  For example, evidence obtained from an external source may not be reliable if the source is not knowledgeable or objective.  While recognising that exceptions may exist, the following generalizations about the reliability of evidence may be useful:

  • Evidence is more reliable when it is obtained from sources outside the appropriate party(ies).
  • Evidence that is generated internally is more reliable when the related controls are effective.
  • Evidence obtained directly by the assurance practitioner (for example, observation of the application of a control) is more reliable than evidence obtained indirectly or by inference (for example, enquiry about the application of a control).
  • Evidence is more reliable when it exists in documentary form, whether paper, electronic, or other media (for example, a contemporaneously written record of a meeting is ordinarily more reliable than a subsequent oral representation of what was discussed).

A150

The assurance practitioner ordinarily obtains more assurance from consistent evidence obtained from different sources or of a different nature than from items of evidence considered individually.  In addition, obtaining evidence from different sources or of a different nature may indicate that an individual item of evidence is not reliable.  For example, corroborating information obtained from a source independent of the appropriate party(ies) may increase the assurance the assurance practitioner obtains from a representation from the appropriate party(ies).  Conversely, when evidence obtained from one source is inconsistent with that obtained from another, the assurance practitioner determines what additional procedures are necessary to resolve the inconsistency.

A151

In terms of obtaining sufficient appropriate evidence, it is generally more difficult to obtain assurance about subject matter information covering a period than about subject matter information at a point in time.  In addition, conclusions provided on processes ordinarily are limited to the period covered by the engagement; the assurance practitioner provides no conclusion about whether the process will continue to function in the specified manner in the future.

A152

Whether sufficient appropriate evidence has been obtained on which to base the assurance practitioner’s conclusion is a matter of professional judgement.

A153

In some circumstances, the assurance practitioner may not have obtained the sufficiency or appropriateness of evidence that the assurance practitioner had expected to obtain through the planned procedures.  In these circumstances, the assurance practitioner considers that the evidence obtained from the procedures performed is not sufficient and appropriate to be able to form a conclusion on the subject matter information.  The assurance practitioner may:

  • Extend the work performed; or
  • Perform other procedures judged by the assurance practitioner to be necessary in the circumstances.

Where neither of these is practicable in the circumstances, the assurance practitioner will not be able to obtain sufficient appropriate evidence to be able to form a conclusion.  This situation may arise even though the assurance practitioner has not become aware of a matter(s) that causes the assurance practitioner to believe the subject matter information may be materially misstated, as addressed in paragraph 49L.

Evaluating the Sufficiency and Appropriateness of Evidence (Ref: Para. 65)

A154

An assurance engagement is a cumulative and iterative process.  As the assurance practitioner performs planned procedures, the evidence obtained may cause the assurance practitioner to change the nature, timing or extent of other planned procedures.  Information may come to the assurance practitioner’s attention that differs significantly from that expected and upon which planned procedures were based.  For example:

  • The extent of misstatements that the assurance practitioner identifies may alter the assurance practitioner’s professional judgement about the reliability of particular sources of information.
  • The assurance practitioner may become aware of discrepancies in relevant information, or inconsistent or missing evidence.
  • If analytical procedures were performed towards the end of the engagement, the results of those procedures may indicate a previously unrecognised risk of material misstatement.

In such circumstances, the assurance practitioner may need to re‑evaluate the planned procedures.

A155

The assurance practitioner’s professional judgement as to what constitutes sufficient appropriate evidence is influenced by such factors as the following:

  • Significance of a potential misstatement and the likelihood of its having a material effect, individually or when aggregated with other potential misstatements, on the subject matter information.
  • Effectiveness of the appropriate party(ies)’s responses to address the known risk of material misstatement.
  • Experience gained during previous assurance engagements with respect to similar potential misstatements.
  • Results of procedures performed, including whether such procedures identified specific misstatements.
  • Source and reliability of the available information.
  • Persuasiveness of the evidence.
  • Understanding of the appropriate party(ies) and its environment.

Scope Limitations (Ref: Para. 26, 66)

A156

A scope limitation may arise from:

  1. Circumstances beyond the control of the appropriate party(ies).  For example, documentation the assurance practitioner considers it necessary to inspect may have been accidentally destroyed;
  2. Circumstances relating to the nature or timing of the assurance practitioner’s work.  For example, a physical process the assurance practitioner considers it necessary to observe may have occurred before the assurance practitioner’s engagement; or
  3. Limitations imposed by the responsible party, the measurer or evaluator, or the engaging party on the assurance practitioner that, for example, may prevent the assurance practitioner from performing a procedure the assurance practitioner considers to be necessary in the circumstances.  Limitations of this kind may have other implications for the engagement, such as for the assurance practitioner’s consideration of engagement risk and the acceptance and continuance of the client relationship and the assurance engagement.

A157

An inability to perform a specific procedure does not constitute a scope limitation if the assurance practitioner is able to obtain sufficient appropriate evidence by performing alternative procedures.

 

Preparing the Assurance Report

Form of Assurance Report (Ref: Para. 67–68)

A160

This ASAE does not require a standardised format for reporting on all assurance engagements.  Instead it identifies the basic elements the assurance report is to include.  Assurance reports are tailored to the specific engagement circumstances.  The assurance practitioner may use headings, paragraph numbers, typographical devices, for example the bolding of text, and other mechanisms to enhance the clarity and readability of the assurance report.

A161

The assurance practitioner may choose a “short form” or “long form” style of reporting to facilitate effective communication to the intended users.  “Short‑form” reports ordinarily include only the basic elements.  “Long‑form” reports include other information and explanations that are not intended to affect the assurance practitioner’s conclusion.  In addition to the basic elements, long‑form reports may describe in detail the terms of the engagement, the applicable criteria being used, findings relating to particular aspects of the engagement, details of the qualifications and experience of the assurance practitioner and others involved with the engagement, disclosure of materiality levels, and, in some cases, recommendations.  The assurance practitioner may find it helpful to consider the significance of providing such information to the information needs of the intended users.  As required by paragraph 68, additional information is clearly separated from the assurance practitioner’s conclusion and phrased in such a manner so as to make it clear that it is not intended to detract from that conclusion.

Assurance Report Content

Title (Ref: Para. 69(a))

Addressee (Ref: Para. 69(b))

Subject Matter Information and Underlying Subject Matter (Ref: Para. 69(c))

A164

Identification and description of the subject matter information and, when appropriate, the underlying subject matter may include, for example:

  • The point in time or period of time to which the measurement or evaluation of the underlying subject matter relates.
  • Where applicable, the name of the responsible party or component of the responsible party to which the underlying subject matter relates.
  • An explanation of those characteristics of the underlying subject matter or the subject matter information of which the intended users should be aware, and how such characteristics may influence the precision of the measurement or evaluation of the underlying subject matter against the applicable criteria, or the persuasiveness of available evidence.  For example:
    • The degree to which the subject matter information is qualitative versus quantitative, objective versus subjective, or historical versus prospective.
    • Changes in the underlying subject matter or other engagement circumstances that affect the comparability of the subject matter information from one period to the next.

Applicable Criteria (Ref: Para. 69(d))

A165

The assurance report identifies the applicable criteria against which the underlying subject matter was measured or evaluated so the intended users can understand the basis for the assurance practitioner’s conclusion.  The assurance report may include the applicable criteria, or refer to them if they are included in the subject matter information or if they are otherwise available from a readily accessible source.  It may be relevant in the circumstances, to disclose:

  • The source of the applicable criteria, and whether or not the applicable criteria are embodied in law or regulation, or issued by authorised or recognised bodies of experts that follow a transparent due process, that is, whether they are established criteria in the context of the underlying subject matter (and if they are not, a description of why they are considered suitable).
  • Measurement or evaluation methods used when the applicable criteria allow for choice between a number of methods.
  • Any significant interpretations made in applying the applicable criteria in the engagement circumstances.
  • Whether there have been any changes in the measurement or evaluation methods used.

Inherent Limitations (Ref: Para. 69(e))

Specific Purpose (Ref: Para. 69(f))

A168

In addition to the alert required by paragraph 69(f), the assurance practitioner may consider it appropriate to indicate that the assurance report is intended solely for specific users.  Depending on the engagement circumstances, for example, the law or regulation of the particular jurisdiction, this may be achieved by restricting the distribution or use of the assurance report.  While an assurance report may be restricted in this way, the absence of a restriction regarding a particular user or purpose does not itself indicate that a legal responsibility is owed by the assurance practitioner in relation to that user or for that purpose.  Whether a legal responsibility is owed will depend on the legal circumstances of each case and the relevant jurisdiction.

Relative Responsibilities (Ref: Para. 69(g))

Performance of the Engagement in Accordance with ASAE 3000 and a Subject Matter Specific ASAE (Ref: Para. 69(h))

Applicable Quality Management Requirements (Ref: Para. 69(i))

A172

The following is an illustration of a statement in the assurance report regarding applicable quality management requirements:

The firm applies Australian Standard on Quality Management 1, which requires the firm to design, implement and operate a system of quality management including policies or procedures regarding compliance with ethical requirements, professional standards and applicable legal and regulatory requirements. 

Compliance with Independence and Other Ethical Requirements (Ref: Para. 69(j))

A173

The following is an illustration of a statement in the assurance report regarding compliance with ethical requirements:

We have complied with the independence and other relevant ethical requirements relating to assurance engagements, which is founded on fundamental principles of integrity, objectivity, professional competence and due care, confidentiality and professional behaviour.

Summary of the Work Performed (Ref: Para. A6, 69(k))

A175

Where no specific ASAE provides guidance on procedures for a particular underlying subject matter, the summary might include a more detailed description of the work performed.  It may be appropriate to include in the summary a statement that the work performed included evaluating the suitability of the applicable criteria.

A176

In a limited assurance engagement the summary of the work performed is ordinarily more detailed than for a reasonable assurance engagement and identifies the limitations on the nature, timing, and extent of procedures.  This is because an appreciation of the nature, timing, and extent of procedures performed is essential to understanding a conclusion expressed in a form that conveys whether, based on the procedures performed, a material matter(s) has come to the assurance practitioner’s attention to cause the assurance practitioner to believe the subject matter information is materially misstated.  It also may be appropriate to indicate in the summary of the work performed certain procedures that were not performed that would ordinarily be expected to be performed in a reasonable assurance engagement.  However, a complete identification of all such procedures may not be possible because the assurance practitioner’s required understanding and consideration of engagement risk is less than in a reasonable assurance engagement.

A177

Factors to consider in determining the level of detail to be provided in the summary of the work performed may include:

  • Circumstances specific to the entity (e.g., the differing nature of the entity’s activities compared to those typical in the sector).
  • Specific engagement circumstances affecting the nature and extent of the procedures performed.
  • The intended users’ expectations of the level of detail to be provided in the report, based on market practice, or applicable law or regulation.

The Assurance Practitioner’s Conclusion (Ref: Para. 12(a)(i)a, 69(l))

A179

Examples of conclusions expressed in a form appropriate for a reasonable assurance engagement include:

  • When expressed in terms of the underlying subject matter and the applicable criteria,  “In our opinion, the entity has complied, in all material respects, with XYZ law”;
  • When expressed in terms of the subject matter information and the applicable criteria, “In our opinion, the forecast of the entity’s financial performance is properly prepared, in all material respects, based on XYZ criteria”; or
  • When expressed in terms of a statement made by the appropriate party, “In our opinion, the [appropriate party’s] statement that the entity has complied with XYZ law is, in all material respects, fairly stated,” or “In our opinion, the [appropriate party’s] statement that the key performance indicators are presented in accordance with XYZ criteria is, in all material respects, fairly stated”.

A181

Examples of conclusions expressed in a form appropriate for a limited assurance engagement include:

  • When expressed in terms of the underlying subject matter and the applicable criteria, “Based on the procedures performed and evidence obtained, nothing has come to our attention that causes us to believe that [the entity] has not complied, in all material respects, with XYZ law.”
  • When expressed in terms of the subject matter information and the applicable criteria, “Based on the procedures performed and evidence obtained, we are not aware of any material amendments that need to be made to the assessment of key performance indicators for them to be in accordance with XYZ criteria.”
  • When expressed in terms of a statement made by the appropriate party, “Based on the procedures performed and evidence obtained, nothing has come to our attention that causes us to believe that the [appropriate party’s] statement that [the entity] has complied with XYZ law, is not, in all material respects, fairly stated.”

A182

Forms of expression which may be useful for underlying subject matters include, for example, one, or a combination of, the following:

  • For compliance engagements—“in compliance with” or “in accordance with.”
  • For engagements when the applicable criteria describe a process or methodology for the preparation or presentation of the subject matter information—“properly prepared.”
  • For engagement when the principles of fair presentation are embodied in the applicable criteria—“fairly stated.”

The Assurance Practitioner’s Signature (Ref: Para. 69(m))

Date (Ref: Para. 69(n))

Reference to the Assurance Practitioner’s Expert in the Assurance Report (Ref: Para. 70)

A187

Nonetheless, the assurance practitioner has sole responsibility for the conclusion expressed, and that responsibility is not reduced by the assurance practitioner’s use of the work of an assurance practitioner’s expert.  It is important therefore that if the assurance report refers to an assurance practitioner’s expert, that the wording of that report does not imply that the assurance practitioner’s responsibility for the conclusion expressed is reduced because of the involvement of that expert.

Unmodified and Modified Conclusions

(Ref: Para. 74–77, Appendix 1)

A189

The term ‘pervasive’ describes the effects on the subject matter information of misstatements or the possible effects on the subject matter information of misstatements, if any, that are undetected due to an inability to obtain sufficient appropriate evidence.  Pervasive effects on the subject matter information are those that, in the assurance practitioner’s professional judgement:

  1. Are not confined to specific aspects of the subject matter information;
  2. If so confined, represent or could represent a substantial proportion of the subject matter information; or
  3. In relation to disclosures, are fundamental to the intended users’ understanding of the subject matter information.

A191

Examples of qualified and adverse conclusions and a disclaimer of conclusion are:

  • Qualified conclusion (an example for limited assurance engagements with a material misstatement) – “Based on the procedures performed and the evidence obtained, except for the effect of the matter described in the Basis for Qualified Conclusion section of our report, nothing has come to our attention that causes us to believe that the [appropriate party’s] statement does not present fairly, in all material respects, the entity’s compliance with XYZ law.”
  • Adverse conclusion (an example for a material and pervasive misstatement for both reasonable assurance and limited assurance engagements) – “Because of the significance of the matter described in the Basis for Adverse Conclusion section of our report, the [appropriate party’s] statement does not present fairly the entity’s compliance with XYZ law.”
  • Disclaimer of conclusion (an example for a material and pervasive limitation of scope for both reasonable assurance and limited assurance engagements) – “Because of the significance of the matter described in the Basis for Disclaimer of Conclusion section of our report, we have not been able to obtain sufficient appropriate evidence to form a conclusion on the [appropriate party’s] statement.  Accordingly, we do not express a conclusion on that statement.”

A192

In some cases, the measurer or evaluator may identify and properly describe that the subject matter information is materially misstated.  For example, in a compliance engagement the measurer or evaluator may correctly describe the instances of non‑compliance.  In such circumstances, paragraph 76 requires the assurance practitioner to draw the intended users’ attention to the description of the material misstatement, by either expressing a qualified or adverse conclusion or by expressing an unqualified conclusion but emphasizing the matter by specifically referring to it in the assurance report.

Other Communication Responsibilities

(Ref: Para. 78)

Communication with Management and Those Charged with Governance

A194

Relevant ethical requirements may include a requirement to report identified or suspected non‑compliance with laws and regulations to an appropriate level of management or those charged with governance. In some jurisdictions, law or regulation may restrict the assurance practitioner’s communication of certain matters with the responsible party, management or those charged with governance.  Law or regulation may specifically prohibit a communication, or other action, that might prejudice an investigation by an appropriate authority into an actual, or suspected, illegal act, including alerting the entity, for example, when the assurance practitioner is required to report the identified or suspected non‑compliance to an appropriate authority pursuant to anti‑money laundering legislation. In these circumstances, the issues considered by the assurance practitioner may be complex and the assurance practitioner may consider it appropriate to obtain legal advice.

Reporting of Identified or Suspected Non‑Compliance with Laws and Regulations to an Appropriate Authority outside the Entity

A195

Law, regulation or relevant ethical requirements may:

  1. Require the assurance practitioner to report identified or suspected non‑compliance with laws and regulations to an appropriate authority outside the entity. 
  2. Establish responsibilities under which reporting to an appropriate authority outside the entity may be appropriate in the circumstances.[14]

A196

Reporting identified or suspected non‑compliance with laws and regulations to an appropriate authority outside the entity may be required or appropriate in the circumstances because:

  1. Law, regulation or relevant ethical requirements require the assurance practitioner to report;
  2. The assurance practitioner has determined reporting is an appropriate action to respond to identified or suspected non‑compliance in accordance with relevant ethical requirements; or
  3. Law, regulation or relevant ethical requirements provide the assurance practitioner with the right to do so.

A197

The reporting of identified or suspected non‑compliance with laws and regulations in accordance with law, regulation or relevant ethical requirements may include non‑compliance with laws and regulations that the assurance practitioner comes across or is made aware of when performing the engagement but which may not affect the subject matter information.  Under this ASAE, the assurance practitioner is not expected to have a level of understanding of laws and regulations beyond those affecting the subject matter information.  However, law, regulation or relevant ethical requirements may expect the assurance practitioner to apply knowledge, professional judgement and expertise in responding to such non‑compliance.  Whether an act constitutes actual non‑compliance is ultimately a matter to be determined by a court or other appropriate adjudicative body.

A198

In some circumstances, the reporting of identified or suspected non‑compliance with laws and regulations to an appropriate authority outside the entity may be precluded by the assurance practitioner’s duty of confidentiality under law, regulation, or relevant ethical requirements.  In other cases, reporting identified or suspected non‑compliance to an appropriate authority outside the entity would not be considered a breach of the duty of confidentiality under the relevant ethical requirements.[15]

Documentation

(Ref: Para. 79–83)

A201

It is neither necessary nor practical to document every matter considered, or professional judgement made, during an engagement.  Further, it is unnecessary for the assurance practitioner to document separately (as in a checklist, for example) compliance with matters for which compliance is demonstrated by documents included within the engagement file.  Similarly, the assurance practitioner need not include in engagement file superseded drafts of working papers, notes that reflect incomplete or preliminary thinking, previous copies of documents corrected for typographical or other errors, and duplicates of documents.

A202

In applying professional judgement to assessing the extent of documentation to be prepared and retained, the assurance practitioner may consider what is necessary to provide an understanding of the work performed and the basis of the principal decisions taken (but not the detailed aspects of the engagement) to another assurance practitioner who has no previous experience with the engagement.  That other assurance practitioner may only be able to obtain an understanding of detailed aspects of the engagement by discussing them with the assurance practitioner who prepared the documentation.

A203

Documentation may include a record of, for example:

  • The identifying characteristics of the specific items or matters tested;
  • Who performed the engagement work and the date such work was completed; and
  • Who reviewed the engagement work performed and the date and extent of such review.
  • Discussions of significant matters with the appropriate party(ies) and others, including the nature of the significant matters discussed and when and with whom the discussions took place.

A204

Documentation may include a record of, for example:

  • Issues identified with respect to compliance with relevant ethical requirements and how they were resolved.
  • Conclusions on compliance with independence requirements that apply to the engagement, and any relevant discussions with the firm that support these conclusions.
  • Conclusions reached regarding the acceptance and continuance of client relationships and assurance engagements.
  • The nature and scope of, and conclusions resulting from, consultations undertaken during the course of the engagement.

Assembly of the Final Engagement File

A205

ASQM 1 (or other professional requirements, or requirements in law or regulation that are at least as demanding as ASQM 1) requires firms to establish a quality objective that addresses the assembly of engagement documentation on a timely basis after the date of the engagement report.[17] An appropriate time limit within which to complete the assembly of the final engagement file is ordinarily not more than 60 days after the date of the assurance report.[18]

A206

The completion of the assembly of the final engagement file after the date of the assurance report is an administrative process that does not involve the performance of new procedures or the drawing of new conclusions.  Changes may, however, be made to the documentation during the final assembly process if they are administrative in nature.  Examples of such changes include:

  • Deleting or discarding superseded documentation.
  • Sorting, collating and cross‑referencing working papers.
  • Signing off on completion checklists relating to the file assembly process.
  • Documenting evidence that the assurance practitioner has obtained, discussed and agreed with the relevant members of the engagement team before the date of the assurance report.

A207

ASQM 1 (or national requirements that are at least as demanding as ASQM 1) requires firms to establish a quality objective that addresses the maintenance and retention of engagement documentation to meet the needs of the firm and comply with law, regulation, relevant ethical requirements, or professional standards.[19] The retention period for assurance engagements ordinarily is no shorter than five years from the date of the assurance report.[20]

4

This ASAE contains requirements and application and other explanatory material specific to reasonable and limited assurance attestation engagements.  This ASAE may also be applied to reasonable and limited assurance direct engagements, adapted and supplemented as necessary in the engagement circumstances.

*_4

See ASA 102.

#_2

See ASA 102.

*_5

See ASA 102.

#_3

See ASA 102.

*_6

See ASA 102.

5

See ASQM 1, paragraph 1.

6

See ASQM 1, paragraph 2(a).

7

See ASQM 1, paragraph 2(b).

8

See ASQM 1, paragraph 6.

9

See ASQM 1, paragraph 16(a).

10

[Deleted by the AUASB.  Refer footnote *.]

11

See ASQM 1, paragraphs 30(a)(ii) and A72.

12

See ASQM 1, paragraph 31(b).

13

See, for example, paragraphs R360.31–360.35 A1 of APES 110 Code of Ethics for Professional Accountants (including Independence Standards) (the Code).

14

See, for example, paragraphs R360.36-R360.37 of the Code.

15

See, for example, paragraphs R114.1, 114.1 A1, AUST 114.1 A1.1 and R360.37 of the Code.

16

See, for example, paragraph 360.39 A1 of the Code.

17

See ASQM 1, paragraph 31(f).

18

See ASQM 1, paragraph A83.

19

See ASQM 1, paragraph 31(f).

20

See ASQM 1, paragraph A85.

Roles and Responsibilities

Appendix1

Download Appendix 1