Skip to main content
Assurance Engagements

ASAE 3100

Compliance Engagements

Download Current Version

Approval Date: 6 September 2022

Operative Date This Assurance Engagements is operative for financial reporting periods beginning on or after 15 December 2022

Download Current Version

Approval Date: 6 September 2022

This Standard on Assurance Engagements (ASAE) deals with assurance engagements to provide an assurance report on whether the entity has complied in all material respects with the compliance requirements, throughout the specified period or as at a specified date, using the criteria.

Preamble

Includes: Preface, Authority Statement, Conformity with International Standards on Auditing

Preface

Reasons for Issuing ASAE 3100

The AUASB issues Standard on Assurance Engagements ASAE 3100 Compliance Engagements pursuant to the requirements of the legislative provisions explained below.

The AUASB is an independent, non-corporate Commonwealth entity of the Australian Government, established under section 227A of the Australian Securities and Investments Commission Act 2001, as amended (ASIC Act).  Under section 227B of the ASIC Act, the AUASB may formulate assurance standards for purposes other than the corporations legislation.

Under the Strategic Direction given to the AUASB by the Financial Reporting Council, the AUASB is required to have regard to any programme initiated by the International Auditing and Assurance Standards Board (IAASB) for the revision and enhancement of International Standards on Auditing and to make appropriate consequential amendments to the Australian Auditing Standards.

The amendments arise from changes made by the IAASB to ISQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Statements, or Other Assurance or Related Services Engagements, ISQM 2 Engagement Quality Reviews and ISA 220 (Revised) Quality Management for an Audit of Financial Statements.

Main Features

This Standard on Assurance Engagements establishes requirements and provides application and other explanatory material regarding the conduct of and reporting on assurance engagements on compliance.  The standard replaces Standard on Assurance Engagements ASAE 3100 Compliance Engagements, issued by the AUASB in February 2017.

This Standard on Assurance Engagements facilitates conformity with current AUASB Standards and revised ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information issued in June 2014.  The standard reflects best practice in compliance engagements and clarifies how to scope, conduct and report on an assurance engagement on compliance, to ensure that assurance engagement quality is maintained and where necessary improved.

Authority Statement

The Auditing and Assurance Standards Board (AUASB) formulates this Standard on Assurance Engagements ASAE 3100 Compliance Engagements pursuant to section 227B of the Australian Securities and Investments Commission Act 2001.

This Standard on Assurance Engagements is to be read in conjunction with ASA 101 Preamble to AUASB Standards, which sets out how AUASB Standards are to be understood, interpreted and applied and ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information, which provides the overarching requirements for all assurance engagements other than those engagements relating to historical financial information.

Conformity with International Standards on Auditing

This Standard on Assurance Engagements ASAE 3100 Compliance Engagements has been formulated for Australian public interest purposes and there is no equivalent International Standard on Assurance Engagements (ISAE), issued by the International Auditing and Assurance Standards Board (IAASB), an independent standard‑setting board of the International Federation of Accountants (IFAC).

This Standard does, however, reflect certain aspects of other Australian ASAEs, which reproduce substantial parts of the equivalent ISAEs issued by the IAASB and published by IFAC, including ISAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information.

Application

1

This Standard on Assurance Engagements applies to limited and reasonable assurance engagements to provide an assurance report on an entity’s compliance with the compliance requirements as evaluated against the suitable criteria. (Ref: Para. A1)

Operative Date

2

This Standard on Assurance Engagements is operative for assurance engagements commencing on or after 15 December 2022.

Introduction

Includes: Scope of this Auditing Standard

Scope of this Auditing Standard

3

This Standard on Assurance Engagements (ASAE) deals with assurance engagements to provide an assurance report on whether the entity has complied in all material respects with the compliance requirements, throughout the specified period or as at a specified date, using the criteria.

4

This ASAE addresses assurance engagements on compliance: (Ref: Para. A2-A5)

  1. With the compliance requirements;
  2. Providing a limited or reasonable assurance conclusion;
  3. For either restricted use, by those charged with governance of the entity or specified third parties, or to be publicly available; and
  4. Either based on an attestation engagement or a direct engagement. (Ref: Para. 17(a), 17(h), A4).

Where this ASAE makes reference to a requirement, that requirement applies to both attestation and direct engagements, unless specified otherwise.

5

Agreed‑upon procedures engagements, where procedures are conducted and factual findings are reported but no conclusion is provided, and consulting engagements, for the purpose of providing advice, on compliance are not assurance engagements and are not dealt with in this ASAE.  Agreed‑upon procedures engagements are addressed under Standard on Related Services, ASRS 4400.[1]

Nature of a Compliance Engagement

6

Compliance engagements are conducted in both the private and public sector, in either case the engaging party will usually be the entity responsible for meeting the compliance requirements which are subject to the compliance engagement.  In these circumstances terms of engagement are agreed with the engaging party.

7

An entity may have an obligation to comply with externally and/or internally established compliance requirements.  These compliance requirements may be established through law and regulation, contractual arrangements or internally established requirements, for example company policies.  A table showing the nature of assurance engagements on compliance is contained in Appendix 3.

Relationship with ASAE 3000, Other Pronouncements and Other Requirements

8

The assurance practitioner is required to comply with ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information (ASAE 3000) and this ASAE when performing compliance engagements.  This ASAE supplements, but does not replace ASAE 3000, and expands on how ASAE 3000 is to be applied in a compliance engagement.  This ASAE applies the requirements in ASAE 3000 to attestation engagements and adapts those requirements, as necessary, to direct engagements on compliance.  ASAE 3000 includes requirements in relation to such topics as engagement acceptance, planning, obtaining evidence and documentation that apply to all assurance engagements, including engagements conducted in accordance with this ASAE.  Framework for Assurance Engagements, which defines and describes the elements and objectives of an assurance engagement, provides the context for understanding this ASAE and ASAE 3000.

9

An assurance engagement performed in accordance with ASAE 3000 measures or evaluates the underlying subject matter against suitable criteria. In a compliance engagement the assurance practitioner determines whether compliance requirements have been met by evaluating the subject matter against the compliance requirements, using the criteria.  The criteria may be the compliance requirements, or a subset thereof. A table explaining the terminology applied in this ASAE is contained in Appendix 2.

10

This ASAE requires the assurance practitioner to apply the ASAE 3000 requirement to comply with relevant ethical requirements related to assurance engagements, or other professional requirements, or requirements in law or regulation, that are at least as demanding.  It also requires the lead assurance practitioner to be a member of a firm that applies ASQM 1 Quality Management for Firms that Perform Audits or Reviews of Financial Reports and Other Financial Information, or Other Assurance or Related Services Engagements or requirements in law or regulation, that are at least as demanding as ASQM 1.

11

An assurance engagement performed under this ASAE may be part of a larger engagement. In such circumstances, this ASAE is relevant only to the portion of the engagement relating to assurance on compliance.

12

If multiple standards are applicable to the assurance engagement, the assurance practitioner applies, in addition to ASAE 3000, either:

  1. If the engagement can be separated into parts, the standard relevant to each part of the engagement, including this ASAE for the part on compliance; or
  2. If the engagement cannot be separated into parts, the standard which is most directly relevant to the subject matter.

13

Assurance conclusions on compliance may be required by Regulators, Government or other users in conjunction with assurance conclusions on financial reports, other historical financial information, and compliance with other requirements, controls and/or other subject matters.  In these engagements the subject matter and criteria against which that subject matter is evaluated and the level of assurance sought may vary, in which case different standards will apply.  Assurance reports can include separate sections for each subject matter, criteria or level of assurance in order that the different matters concluded upon are clearly differentiated.

14

A table showing the AUASB Standards to apply to compliance engagements depending on the subject matter and engagement circumstances is contained in Appendix 4. (Ref: Para. A1)

1

See ASRS 4400 Agreed-Upon Procedures Engagements.

Objectives

15

In conducting a compliance engagement, the objectives of the assurance practitioner are:

  1. To obtain reasonable or limited assurance, about whether the entity has complied in all material respects, with compliance requirements as evaluated against the suitable criteria;
  2. To express a conclusion[2] through a written report on the matters in (a) above which expresses either a reasonable or limited assurance conclusion and describes the basis for the conclusion; and/or
  3. To communicate further as required by this ASAE and any other relevant ASAEs.

16

In conducting the assurance engagement, the objectives of the assurance practitioner under ASAE 3000[3] include: “to obtain either reasonable or limited assurance, as appropriate, about whether the subject matter information is free from material misstatement”. The subject matter information in a compliance engagement is the outcome of the evaluation[4] of compliance with the compliance requirements, as evaluated against the criteria. The evaluation is conducted:

  1. In an attestation engagement on compliance, by the responsible party or evaluator, and presented in a Statement[5] , which addresses whether the compliance requirements have been met. The objective of the assurance practitioner is to obtain reasonable or limited assurance about whether the Statement is free from material misstatement, although the assurance practitioner’s conclusion may be expressed in terms of whether the compliance requirements have been met; or
  2. In a direct engagement on compliance, by the assurance practitioner and presented in the assurance conclusion, therefore, no Statement is prepared by the responsible party. The objective of the assurance practitioner is to obtain reasonable or limited assurance about whether the compliance requirements have been met.

2

The term conclusion also extends to include an opinion expressed in a reasonable assurance engagement.

3

See ASAE 3000, paragraph 10.

4

The term evaluation includes the concept of measurement for quantification aspects of a compliance engagement.

5

See ASAE 3100, paragraph 17(z) for definition of the term Statement.

Definitions

17

For the purposes of this Standard on Assurance Engagements, the following terms have the meanings attributed below:

17(a)

Attestation engagement on compliance―A reasonable or limited assurance engagement in which a party other than the assurance practitioner, being the responsible party or evaluator evaluates compliance with the compliance requirements. The outcome of that evaluation is provided in a Statement, which may either be available to the intended users or may be presented by the assurance practitioner in the assurance report. In an attestation engagement on compliance, the assurance practitioner’s conclusion addresses whether the Statement is free from material misstatement. The assurance practitioner’s conclusion may be phrased in terms of: (Ref: Para. 4(d), A4)

  1. The compliance outcome and the criteria; or
  2. A Statement made by the appropriate party.

17(b)

Compliance activity (subject matter or underlying subject matter)―The activity that is undertaken to meet the compliance requirement(s).

17(c)

Compliance engagement–An assurance engagement in which an assurance practitioner expresses a conclusion after evaluating an entity’s compliance with the compliance requirements.

17(d)

Compliance framework–A framework adopted by the entity, which is designed to ensure that the entity achieves compliance, and includes governance structures, programs, processes, systems, controls and procedures.

17(e)

Compliance outcome (subject matter information)―The outcome of the evaluation of the underlying subject matter (compliance activity) against the compliance requirements, using the criteria.  The compliance outcome is the Statement of the responsible party or evaluator in an attestation engagement on compliance, or the assurance practitioner’s conclusion in a direct engagement on compliance, providing the outcome of their evaluation.

17(f)

Compliance requirement(s)―The  requirements established in law, regulations, other statutory requirements (e.g. ASIC Class Orders and Regulatory Guides and APRA Prudential Standards), contractual arrangements, ministerial directives, industry or professional obligations or internally via entity policies, procedures and frameworks. (Ref: Appendix 1)

17(i)

Engaging party―The party(ies) that engages the assurance practitioner to perform the assurance engagement.

17(j)

Entity―The legal entity, economic entity, or the identifiable portion of a legal or economic entity, or combination of legal or other entities or portions of those entities (for example, a joint venture) to which the compliance requirements relate.

17(k)

Evaluator―The party(ies) who evaluates the underlying subject matter (compliance activities) against the criteria.  The evaluator possesses expertise in the underlying subject matter.

17(l)

Firm―A sole assurance practitioner, partnership or corporation or other entity of individual assurance practitioners.  “Firm” should be read as referring to its public sector equivalents where relevant.

17(m)

Intended users―The individual(s) or organisation(s), or group(s) thereof that the assurance practitioner expects will use the assurance report. In some cases, there may be intended users other than those to whom the assurance report is addressed.

17(n)

Internal audit function―A function of an entity that performs assurance and consulting activities designed to evaluate and improve the effectiveness of the entity’s governance, risk management and internal control processes.

17(o)

Limited assurance engagement―An assurance engagement in which the assurance practitioner reduces engagement risk to a level that is acceptable in the circumstances of the engagement, but where that risk is greater than for a reasonable assurance engagement, as the basis for expressing a conclusion in a form that conveys whether, based on the procedures performed and evidence obtained, a matter(s) has come to the assurance practitioner’s attention to cause the assurance practitioner to believe the compliance requirements have not been met, in all material respects.  The nature, timing and extent of procedures performed in a limited assurance engagement is limited compared with that necessary in a reasonable assurance engagement but is planned to obtain a level of assurance that is, in the assurance practitioner’s professional judgement, meaningful.  To be meaningful, the level of assurance obtained by the assurance practitioner is likely to enhance the intended users’ confidence about the compliance outcome to a degree that is clearly more than inconsequential.

17(p)

Long-form report―Assurance report including other information and explanations that are intended to meet the information needs of users but not to affect the assurance practitioner’s conclusion. In addition to the matters required to be contained in the assurance practitioner’s report, as set out in paragraph 56, long-form reports may describe in detail matters such as:

  1. the terms of the engagement;
  2. the criteria being used and the specific compliance activities designed to meet each compliance requirement;
  3. descriptions of the procedures that were performed;
  4. findings relating to the procedures that were performed or particular aspects of the engagement;
  5. details of the qualifications and experience of the assurance practitioner and others involved with the engagement;
  6. disclosure of materiality levels; or
  7. recommendations.

 

The assurance practitioner may find it helpful to consider the significance of providing such information to meet the needs of the intended users. As required by paragraph 57, additional information is clearly separated from the assurance practitioner’s conclusion and worded in such a manner as to make it clear that it is not intended to alter or detract from that conclusion.

17(q)

Material in the context of a compliance engagement

  1. in relation to potential (for risk assessment purposes) or detected (for evaluation purposes) matter(s) of non-compliance – instance(s) of non-compliance that are significant, individually or collectively, in the context of the entity’s compliance with compliance requirements, and that might influence relevant decisions of intended users or affect the assurance practitioner’s conclusion; and/or
  2. in relation to the compliance framework and controls – instance(s) of deficiency that are significant in the context of the entity’s control environment and that may raise the compliance engagement risk sufficiently to affect the assurance practitioner’s conclusion.

17(r)

Misstatement―For attestation engagements on compliance, a difference between the Statement and the assurance practitioner’s evaluation of compliance with the compliance requirements. Misstatements can be intentional or unintentional, qualitative or quantitative, and include omissions.

17(s)

Non‑compliance―For both attestation and direct engagements on compliance, a failure to meet a compliance requirement in whole or in part.

17(t)

Professional judgement―The application of relevant training, knowledge and experience, within the context provided by assurance and ethical standards, in making informed decisions about the courses of action that are appropriate in the circumstances of the engagement.

17(u)

Professional scepticism―An attitude that includes a questioning mind, being alert to conditions which may indicate possible misstatement or non‑compliance, and a critical assessment of evidence.

17(v)

Reasonable assurance engagement―An assurance engagement in which the assurance practitioner reduces engagement risk to an acceptably low level in the circumstances of the engagement as the basis for the assurance practitioner’s conclusion.  The assurance practitioner’s conclusion is expressed in a form that conveys the assurance practitioner’s opinion on the outcome of the evaluation of the compliance activities against compliance requirements.

17(w)

Representation―Statement by the responsible party, either oral or written, provided to the assurance practitioner to confirm certain matters or to support other evidence.  A representation is additional to but may be provided in combination with the responsible party’s or evaluator’s Statement provided in an attestation engagement, as set out in paragraph 16(a).

17(x)

Responsible party―The party(ies) responsible for the underlying subject matter, being the compliance activity(ies) in a compliance engagement.

17(y)

Short‑form report―Assurance report including only the matters required under paragraph 56 of this ASAE.

17(z)

Statement―The outcome in writing of the responsible party or evaluator’s evaluation of compliance with  the compliance requirements, provided to the assurance practitioner in an attestation engagement.  A Statement is the subject matter information in an attestation engagement on compliance.

Requirements

Includes: Applicability of ASAE 3000, Ethical Requirements , Acceptance and Continuance , Quality Management, Professional Scepticism, Professional Judgement and Assurance Skills and Techniques , Planning and Performing the Engagement, Obtaining Evidence, Work Performed by an Assurance Practitioner’s Expert, Work Performed by Another Assurance Practitioner or a Responsible Party’s or Evaluator’s Expert, Evaluation of Evidence, Written Representations, Subsequent Events, Forming the Assurance Conclusion, Preparing the Assurance Report, Other Communication Responsibilities, Documentation

Applicability of ASAE 3000

18

The assurance practitioner shall not represent compliance with this ASAE unless the assurance practitioner has complied with the requirements of this ASAE and ASAE 3000, adapted as necessary in the case of direct engagements.  ASAE 3000 contains requirements and application and other explanatory material specific to attestation assurance engagements but it also applies to direct assurance engagements, adapted as necessary in the engagement circumstances.[6] If this ASAE makes reference to a requirement in ASAE 3000, that requirement shall be applied to both attestation and direct engagements, unless specified otherwise. (Ref: Para. A1, Appendix 4)

Ethical Requirements

19

As required by ASAE 3000, the assurance practitioner shall comply with relevant ethical requirements related to assurance engagements, or other professional requirements, or requirements imposed by law or regulation, that are at least as demanding.[7] (Ref: Para. A6)

Acceptance and Continuance

Preconditions for the Assurance Engagement

20

The assurance practitioner shall accept or continue a compliance engagement only in the circumstances required by ASAE 3000, including that the preconditions for an assurance engagement are present, unless required to accept the engagement by law or regulation.

Appropriateness of the Subject Matter

21

When establishing whether the preconditions for an assurance engagement as required by ASAE 3000 are present, the assurance practitioner is required to assess the appropriateness of the subject matter.[8] In doing so, the assurance practitioner shall determine whether the compliance activities which are to be evaluated are appropriate in addressing the needs of users, that is whether the performance of those activities determines whether the compliance requirements have been met. (Ref: Para. A9-A11)

22

If the subject matter is not appropriate, the assurance practitioner shall not accept the engagement or, if this is determined after accepting the engagement, either withdraw from the engagement or issue a modified conclusion.

Assessing the Suitability of the Criteria

Agreeing on the Terms of the Engagement

24

ASAE 3000[10] requires the parties to the engagement to agree on the terms of the assurance engagement in writing. The assurance practitioner shall obtain the agreement of the responsible party, that it acknowledges and understands its responsibility:

  1. In an attestation engagement, for evaluating the compliance activity against the compliance requirements and providing a written Statement regarding the outcome of that evaluation and for having a reasonable basis for the written Statement;
  2. For identifying suitable compliance requirements and whether they were specified by law, regulation, contract, another party (for example, a user group or a professional body) or developed by the responsible party;
  3. For providing the assurance practitioner with:
    1. Access to all information, such as records, documentation and other matters of which the responsible party is aware are relevant to the compliance engagement;
    2. Additional information that the assurance practitioner may request from the responsible party for the purposes of the assurance engagement; and
    3. Unrestricted access to persons within the entity from whom the assurance practitioner determines it necessary to obtain evidence.

25

The terms of engagement shall identify:

  1. The scope of the engagement;
  2. Whether the engagement is a reasonable or limited assurance engagement;
  3. Whether the engagement is an attestation or direct engagement and, in the case of an attestation engagement, the form of the responsible party’s or evaluator’s evaluation of the compliance activity or Statement and whether that Statement will be available to intended users or only referenced in the assurance report; (Ref: Para. A16,A20)
  4. The specified period or specified date to be covered by the engagement; (Ref: Para. A17)
  5. The compliance requirements against which the compliance activity will be evaluated;
  6. The intended users of the assurance report;
  7. The content of the assurance report, including whether it will be a short-form or long form report, including additional information such as the compliance requirements, procedures conducted, detailed findings and recommendations to meet the needs of the intended users; and (Ref: Para. A20)
  8. Any other matters required by law or regulation (e.g. reporting all matters of non-compliance identified to the regulator[11]) to be included in the terms of engagement. (Ref: Para. 27)

Acceptance of a Change in the Terms of the Engagement

Assurance Report Prescribed by Law or Regulation

27

If law or regulation prescribe the compliance requirements for evaluation or the form and content of the assurance report, the assurance practitioner evaluates the compliance requirements and form and content of the assurance report. If the compliance requirements are unsuitable or if intended users might misunderstand the assurance report, the assurance practitioner shall: (Ref: Para. A16, A52)

  1. Not accept the engagement unless additional explanation in the assurance report mitigates these circumstances; or
  2. Not include any reference within the assurance report to the engagement having been conducted in accordance with ASAE 3000 or this ASAE, if required to accept the engagement by law or regulation. 

Quality Management

28

The assurance practitioner shall implement quality management procedures as required by ASAE 3000.[13]

Professional Scepticism, Professional Judgement and Assurance Skills and Techniques

29

The assurance practitioner shall apply professional scepticism, exercise professional judgement and apply assurance skills and techniques in planning and performing an assurance engagement on compliance as required by ASAE 3000.[14]  In applying professional scepticism, the assurance practitioner shall recognise the possibility that matters of non‑compliance due to fraud could exist, notwithstanding the assurance practitioner’s past experience of the honesty and integrity of the entity’s management and those charged with governance.

Planning and Performing the Engagement

Planning

Materiality

31

The assurance practitioner shall consider materiality, as required by ASAE 3000,[16] when determining the nature, timing and extent of procedures. (Ref: Para.  A24-A29 )

Obtaining an Understanding of the Compliance Framework and Compliance Requirements

32

Limited Assurance

Reasonable Assurance

L.     The assurance practitioner shall obtain an understanding of the entity’s compliance framework and its key elements, the compliance requirements which are included in the scope of the engagement, and other engagement circumstances, and on the basis of that understanding, the assurance practitioner shall: (Ref: Para. A30- A32)

  1. For a direct engagement, consider whether the identification of criteria is appropriate;
  2. For both attestation and direct engagements:
    1. Identify areas where the risks that may cause non-compliance with each of the compliance requirements to be concluded upon are likely to arise; and
    2. Respond to the risks identified in paragraph 32L(b)(i) and use as a basis for designing and performing assurance procedures.

 

R.     The assurance practitioner shall obtain an understanding of the entity’s compliance framework and its key elements, the compliance requirements which are included in the scope of the engagement, and other engagement circumstances, and on the basis of that understanding, the assurance practitioner shall: (Ref: Para. A30- A32)

  1. For a direct engagement, consider whether the identification of criteria is appropriate;
  2. For both attestation and direct engagements:
    1. Identify and assess the risks that may cause non-compliance with each of the compliance requirements to be concluded upon; and
    2. Respond to the risks identified in paragraph 32R(b)(i) and use as a basis for designing and performing assurance procedures; and
  3. Obtain an understanding of the relevant internal controls over the compliance activity to meet the compliance requirements, evaluate the design of those controls and determine whether they have been implemented.

Identifying Risks of Fraud

Obtaining an Understanding of the Internal Audit Function

Obtaining an Understanding of the Internal Audit Function

35

The assurance practitioner shall consider based on the compliance engagement circumstances whether it is appropriate to use the work of the internal audit function.

36

If the assurance practitioner plans to use the work of the internal audit function in accordance with paragraph 37, the assurance practitioner shall evaluate it as required by ASAE 3000.[17]

Using the Work of the Internal Audit Function

37

If the assurance practitioner’s evaluation of the internal audit function confirms that the work of the internal audit function can be used for purposes of the compliance engagement, then the assurance practitioner shall determine the planned effect of the work of the internal audit function on the nature, timing or extent of the assurance practitioner’s procedures and in doing so, shall consider: (Ref: Para. A36, A43-A44)

  1. The nature and scope of work performed, or to be performed, on the compliance framework by the internal audit function;
  2. The significance of that work to the assurance practitioner’s conclusions;
  3. The degree of subjectivity involved in the evaluation of the evidence obtained in support of those conclusions; and
  4. Re-performing some of the work of the internal audit function that is planned to be used.

38

The use of internal auditors to provide direct assistance is prohibited in an assurance engagement conducted in accordance with this ASAE.  Direct assistance is the performance of assurance procedures under the direction, supervision and review of the assurance practitioner.[18]  This prohibition does not preclude reliance on the work of the internal audit function to modify the nature or timing, or reduce the extent, of assurance procedures to be performed directly by the assurance practitioner.  (Ref: Para. A36)

Obtaining Evidence

39

Based on the assurance practitioner’s understanding obtained under paragraph 32L and 32R, the assurance practitioner shall perform assurance procedures to respond to identified or assessed risks in paragraph 32L(b) to obtain limited or 32R(b) to obtain reasonable assurance to support the assurance practitioner’s conclusion. (Ref: Para. A37-A39)

Responses to Assessed Risks of Fraud

Obtaining Evidence Regarding the Compliance Activity

43

Limited Assurance

Reasonable Assurance

L.     The nature, timing and extent of evaluation of compliance activities, shall be limited to:

  1. discussion and enquiries with entity personnel; and
  2. observation of the activity in operation for compliance; and
  3. walk-through for an appropriate number of material compliance activities to identify any instances of non-compliance.

 

The results of exception reporting, monitoring or other management controls may be examined to provide evidence about the operation of the compliance activity rather than directly testing it. (Ref: Para. A37)

 

R.     The nature, timing and extent of testing and evaluation of compliance activities, shall include:

  1. discussion and enquiries with entity personnel; and
  2. observation of the activity in operation for compliance; and
  3. re-performance on a test basis of compliance activities; or
  4. other examination and follow up of the application of compliance activities, on a test basis to provide sufficient appropriate evidence on which to base a conclusion.

 

The results of exception reporting, monitoring or other management controls may be examined to reduce the extent of direct testing and evaluation of the operation of the compliance activity but shall not eliminate it entirely. (Ref: Para. A37)

44

Limited Assurance

Reasonable Assurance

L.     The assurance practitioner shall apply professional judgement in determining the specific nature, timing and extent of procedures to be conducted, which will depend on the assessed risks of material non-compliance with the compliance requirements. If the assurance practitioner determines that additional assurance procedures are required to dispel or confirm a suspicion that a material matter of non-compliance exists, the performance of such additional procedures shall not convert the engagement to a reasonable assurance engagement as they relate to the reduction of risk to an acceptable level with respect to that matter alone. (Ref: Para. A39-A40)

 

R.     The assurance practitioner shall apply professional judgement in determining the specific nature, timing and extent of procedures to be conducted, which will depend on the assessed risks of material non-compliance with the compliance requirements. (Ref: Para. A39)

45

Limited Assurance

Reasonable Assurance

 

 

R.     When determining the extent of testing and evaluation of compliance activities, the assurance practitioner shall consider matters including the characteristics of the population to be tested and evaluated, which includes the nature of the compliance activity, the frequency of their occurrence (for example, monthly, daily, a number of times per day), and the expected rate of matter(s) of non-compliance. Some compliance activities operate continuously, while others operate only at particular times, so the testing and evaluation of compliance shall be performed throughout the specified period of time that is sufficient to allow the practitioner to conclude.(Ref: Para. A40)

Sampling

46

When the assurance practitioner uses sampling to test compliance, the assurance practitioner shall: (Ref: Para. 45R)

  1. Consider the purpose of the procedure and the characteristics of the compliance activity from which the sample will be drawn when designing the sample;
  2. Determine a sample size sufficient to reduce sampling risk to an acceptably low level;
  3. Select items for the sample in such a way that each sampling unit in the population has a chance of selection and the sample is representative of the population; and
  4. If unable to apply the designed procedures, or suitable alternative procedures, to a selected item, treat that item as a deviation.

Written Representations

51

The assurance practitioner shall request the responsible party, or other relevant person(s) within the entity to provide written representations, in addition to those required by ASAE 3000,[21] that the responsible party: (Ref: Para. A46)

  1. In the case of an attestation engagement, reaffirms their Statement regarding the outcome of the responsible party’s evaluation of the compliance activity against the compliance requirements throughout the specified period or as at a specified date;
  2. Acknowledges its responsibility for the compliance activity, including identifying the risks that threaten the compliance requirements being met, and designing, implementing and maintaining internal controls to mitigate those risks, including the risk of fraud, so that those risks will not prevent achievement of the compliance requirements;
  3. Has provided the assurance practitioner with all relevant information and access agreed to, as set out in paragraph 24(c)(i);
  4. Has disclosed to the assurance practitioner any of the following of which it is aware may be relevant to the engagement:
    1. Instances of non-compliance with the compliance requirements; or
    2. Any events subsequent to the specified period or as at the specified date covered by the assurance practitioner’s conclusion up to the date of the assurance report that could have a significant effect on the assurance practitioner’s conclusion.

 

The assurance practitioner shall evaluate written representations in accordance with ASAE 3000. (Ref: Para. A47)

Forming the Assurance Conclusion

53

The assurance practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary, attempt to obtain further evidence.  If the assurance practitioner is unable to obtain necessary further evidence, the assurance practitioner shall consider the implications for the assurance practitioner’s conclusion in accordance with ASAE 3000.[22]  The assurance practitioner shall qualify their conclusion if the possible effects of undetected matters of non‑compliance with the compliance requirements due to an inability to obtain sufficient appropriate evidence could be material, and shall disclaim their conclusion if the possible effects could be both material and pervasive.

54

When the assurance practitioner forms a conclusion in accordance with ASAE 3000,[23] the assurance practitioner shall evaluate the materiality, individually and in aggregate whether due to fraud or error, of any matter(s) of non-compliance with the compliance requirements. If the matters of non-compliance identified are: (Ref: Para. A45-A46)

  1. Material but not pervasive, the assurance practitioner shall qualify their assurance conclusion with respect to the relevant matter; or
  2. Material and pervasive, the assurance practitioner shall issue an adverse conclusion.

Preparing the Assurance Report

55

The assurance practitioner shall prepare the assurance report in accordance with ASAE 3000[24] for attestation engagements and shall also apply those requirements for direct engagements.

Assurance Report Content

56

For both attestation and direct engagements, the assurance practitioner shall include in the assurance report the basic elements required by ASAE 3000,[25] which are at a minimum:

  1. A title, indicating that it is an independent assurance report;
  2. An addressee;
  3. An identification of whether reasonable or limited assurance has been obtained by the assurance practitioner;
  4. Identification of the compliance requirements;
  5. Whether the assurance practitioner is reporting on compliance throughout the specified period or as at a specified date;
  6. In the case of an attestation engagement, reference to the responsible party’s Statement as required by paragraph 24(a) and whether that Statement is available to intended users by accompanying the assurance report, reproduction in the assurance report or another identified source;
  7. Identification of the overall and/or specific criteria used for evaluating the compliance activity;
  8. If appropriate, a description of any significant inherent limitations associated with the evaluation of the compliance activity against the compliance requirements;
  9. A statement that the responsible party or evaluator is responsible for:
    1. In an attestation engagement:
      1. Providing a Statement with respect to the outcome of the evaluation of the compliance activity against the compliance requirements;
      2. Identifying the compliance requirements (where not identified by Parliament, the Government, law or regulation, or another party, for example, a user group or a professional body); and
    2. In both an attestation and a direct engagement:
      1. The compliance activity covered by the assurance practitioner’s report;
      2. Identifying, designing and implementing controls to enable the compliance requirements to be met and to monitor ongoing compliance;
  10. A statement that the assurance practitioner’s responsibility is to express a conclusion on whether the compliance requirements have, in all material respects, been met;
  11. A statement that the engagement was performed in accordance with ASAE 3100 Compliance Engagements;
  12. A statement that the firm of which the assurance practitioner is a member applies ASQM 1, or other professional requirements, or requirements in law and regulation, that are at least as demanding as ASQM 1. If the assurance practitioner is not a professional accountant, the statement shall identify the professional requirements, or requirements in law and regulation, applied that are at least as demanding as ASQM 1;
  13. A statement that the assurance practitioner complies with the independence and other relevant ethical requirements related to assurance engagements, or other professional requirements, or requirements imposed by law or regulation, that are at least as demanding;
  14. An informative summary of the work performed as a basis for the assurance practitioner’s conclusion. In the case of a limited assurance engagement, an appreciation of the nature, timing, and extent of procedures performed is essential to understanding the assurance practitioner’s conclusion. In a limited assurance engagement, the summary of the work performed shall state that: (Ref: Para. A53-A57)
    1. The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement; and
    2. Consequently, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed;
  15. When the criteria used to evaluate the compliance requirements are available only to specific intended users, or are relevant only for a specific purpose, a statement restricting the use of the assurance report to those intended users or that purpose; (Ref: Para. A58)
  16. Either, the assurance practitioner’s opinion for a reasonable assurance engagement or the assurance practitioner’s conclusion for a limited assurance engagement about whether, in all material respects the entity complied with the compliance requirements throughout the specified period or as at a specified date;
  17. When the assurance practitioner expresses a modified conclusion, the assurance report shall contain:
    1. A section (entitled: Basis for Qualified/Adverse/Disclaimer of Conclusion/Opinion) that provides a description of the matter(s) giving rise to the modification; and
    2. A section that contains the assurance practitioner’s modified conclusion;
  18. The assurance practitioner’s signature, the date of the assurance report and the location in the jurisdiction where the assurance practitioner practices.

Emphasis of Matter and Other Matter Paragraphs

59

The assurance practitioner shall include an Emphasis of Matter or Other Matter paragraph in the circumstances provided for in ASAE 3000[26] for an attestation engagement.  In a direct engagement, if the assurance practitioner considers it necessary to communicate a matter that, in the assurance practitioner’s judgement, is relevant to intended users’ understanding of the engagement, the assurance practitioner’s responsibilities or the assurance report, the assurance practitioner shall include in the assurance report an Other Matter paragraph, with an appropriate heading, that clearly indicates the assurance practitioner’s conclusion is not modified in respect of the matter.

Modified Conclusions

Scope Limitation

Other Communication Responsibilities

62

The assurance practitioner shall consider whether, pursuant to the terms of the engagement, if applicable, and other engagement circumstances, any matter has come to the attention of the assurance practitioner that is to be communicated with the responsible party, the evaluator, the engaging party, those charged with governance or others, as required by ASAE 3000.[27]  If during the course of the engagement the assurance practitioner identifies any matters of non‑compliance with the entity’s compliance requirements other than those which are clearly trivial, the assurance practitioner shall communicate on a timely basis to an appropriate level of management those matters of non‑compliance or those charged with governance on a timely basis those matters of material non‑compliance. (Ref: Para. A64)

63

In limited circumstances the assurance practitioner may be required by law or regulation and  the terms of the engagement to report all instances of non‑compliance with the compliance requirements to the regulator[28].

64

If the assurance practitioner has identified a fraud or has obtained information that indicates that a fraud may exist, the assurance practitioner shall communicate these matters on a timely basis to the appropriate level of management or those charged with governance in order to inform those with primary responsibility for the prevention and detection of fraud of matters relevant to their responsibilities.  The assurance practitioner shall determine whether there is a responsibility to report the occurrence or suspicion to a party outside the entity. (Ref: Para. A63)

Documentation

66

The assurance practitioner shall prepare documentation in accordance with ASAE 3000.[29] In documenting the nature, timing and extent of procedures performed as required by ASAE 3000, the assurance practitioner shall record (Ref: Para. A65):

  1. The identifying characteristics of the compliance activity being tested;
  2. Who performed the work and the date such work was completed; and
  3. Who reviewed the work performed and the date and extent of such review.

6

See ASAE 3000, paragraph 2.

7

See ASAE 3000, paragraphs Aus 20.1 and ASA 102 Compliance with Ethical Requirements when Performing Audits, Reviews and Other assurance Engagements.

8

See ASAE 3000, paragraph 24(b)(i).

9

See ASAE 3000, paragraph 24(b).

10

See ASAE 3000, paragraph 27.

11

An example of where this would apply is the compliance component of an AFSL Licensee FS 71 engagement where the Australian Securities and Investments Commission (ASIC) require reporting of all breaches.

12

See ASAE 3000, paragraph 29.

13

See ASAE 3000, paragraphs 31-36.

14

See ASAE 3000, paragraphs 37-39.

15

See ASAE 3000, paragraph 40.

16

See ASAE 3000, paragraph 44.

17

See ASAE 3000, paragraph 55.

18

See ASAE 3000, paragraphs 3 and Aus 20.1.

19

See ASAE 3000, paragraph 52.

20

See ASAE 3000, paragraphs 53-54.

21

See ASAE 3000, paragraph 56.

22

See ASAE 3000, paragraph 66.

23

See ASAE 3000, paragraphs 64-65.

24

See ASAE 3000, paragraphs 67-69.

25

See ASAE 3000, paragraph 69.

26

See ASAE 3000, paragraph 73.

27

See ASAE 3000, paragraph 78.

28

As an example where this would apply is the compliance component of an AFSL Licensee FS 71 engagement where ASIC require reporting of all breaches.

29

See ASAE 3000, paragraphs 79-83.

Application and Other Explanatory Material

Includes: Application, Introduction, Ethical Requirements, Acceptance and Continuance, Planning and Performing the Engagement, Obtaining Evidence, Work Performed by an Assurance Practitioner’s Expert, Work Performed by Another Assurance Practitioner or a Responsible Party’s or Evaluator’s Expert , Evaluation of Evidence, Written Representations, Subsequent Events, Preparing the Assurance Report , Other Communication Responsibilities, Documentation

Application

(Ref: Para. 1)

A1

Engagements which are covered by this ASAE and those that are covered by other subject matter specific ASAEs have been further illustrated at Appendix 4.

Introduction

(Ref: Para. 3-14)

A3

In a direct engagement, the assurance practitioner evaluates the compliance activity conducted by the responsible party to meet the compliance requirement.  In a attestation engagement, the responsible party evaluates the compliance activity against the compliance requirements and provides a statement on the compliance outcome.

A5

In a three party relationship, which is an element of an assurance engagement,[30] the responsible party may or may not be the engaging party, but is responsible for the compliance activities which are the underlying subject matter of the engagement and is a separate party from the intended users.  The responsible party and the intended users may both be internal to the entity, for example if the responsible party is at an operational level of management and the intended users are at the level of those charged with governance, such as the Board or Audit Committee.  See Appendix 1 for a discussion of how each of these roles relate to an assurance engagement on compliance.

Ethical Requirements

(Ref: Para. 19)

Acceptance and Continuance

Competence and Capabilities to Perform the Engagement

A7

Relevant competence and capabilities, including having sufficient time to perform the compliance engagement, as required by ASAE 3000[31] by persons who are to perform the engagement, include matters such as the following:

  • Knowledge of the relevant industry, compliance frameworks, the nature of the overall compliance requirements (for example: emissions quantification or regulatory compliance).
  • An understanding of controls, IT and systems.
  • Experience in evaluating risks as they relate to the compliance requirements.
  • Experience in the design and execution of tests of compliance and the evaluation of the results.

Rational Purpose

A8

When considering the acceptance of a limited assurance engagement on compliance, ASAE 3000 requires the assurance practitioner to determine whether a meaningful level of assurance is expected to be able to be obtained,[32] which may include whether a limited assurance engagement is likely to be meaningful to users.  In making this assessment, consideration is given to the intended users of the assurance report and whether they are likely to understand the limitations of a limited assurance engagement, including the need to read the assurance report in detail to understand the assurance procedures performed and the assurance obtained.

Assessing the Appropriateness of the Subject Matter (Ref: Para. 21)

A9

An appropriate subject matter is:

  1. Identifiable, and capable of consistent evaluation against the identified criteria; and
  2. Able to be subjected to procedures for gathering sufficient appropriate evidence to support a reasonable assurance or limited assurance conclusion, as appropriate.

A10

Examples of subject matters that may be appropriate for a compliance engagement include compliance with the following:

  • General Insurers and Insurance Groups - Risk Management Strategy & Reinsurance Management Strategy (RMS/REMS).
  • Treasurer’s Instructions.
  • Managed Investment Schemes – Compliance Plan.
  • Registered Superannuation Entity – SIS Act requirements (SPS 310).
  • Financial Services Licensee – Corporations Act 2001 requirements.

A11

For further guidance on assessing the appropriateness of the subject matter refer to Appendix 3 and ASAE 3000[11]

Assessing the Suitability of the Criteria (Ref: Para. 23)

A13

In the context of a compliance engagement, examples of criteria include:

  • Externally imposed criteria under law or directives, including:
    • Legislation.
    • Regulation.
    • Other statutory requirements (e.g. ASIC Regulatory Guides and Practice Notes or APRA Prudential Standards).
    • Ministerial directives.
    • Industry or professional obligations (professional standards or guidance, codes of practice or conduct).
    • Enforceable contractual obligations.
    • Enforceable undertakings.
  • Internally imposed criteria, as determined by management, including:
    • Organisational policies and procedures.
    • Frameworks, for example, compliance framework based on ISO 19600 – Compliance Management Systems.

A14

Criteria need to be identified by the parties to the engagement and agreed by the engaging party and the assurance practitioner.  The assurance practitioner may need to discuss the criteria to be used with those charged with governance, management and the intended users of the report.  Criteria can be either established or specifically developed.  The assurance practitioner normally concludes that established criteria embodied in laws or regulations or issued by professional bodies, associations or other recognised authorities that follow due process are suitable when the criteria are consistent with the objective.  Other criteria may be agreed to by the intended users of the assurance practitioner’s report, or a party entitled to act on their behalf, and may also be specifically developed for the engagement.

A15

In situations where the criteria have been specifically developed for the engagement, the assurance practitioner may obtain from the intended users or a party entitled to act on their behalf, acknowledgment that the specifically developed criteria are sufficient for the user’s purposes. (Ref: Para. 23)

Agreeing on the Terms of the Engagement (Ref: Para. 24-25)

A16

When agreeing whether the engagement is to be conducted as an attestation or direct engagement, the assurance practitioner considers factors such as whether:

  1. there is a regulatory requirement or users need an evaluation of the compliance activity by the responsible party or evaluator (Ref: Para. 27); or
  2. the entity has the resources and expertise to prepare a suitable description or documentation of the compliance activity, compliance requirements and related controls and conduct a meaningful evaluation of the compliance outcome.

A19

Where relevant, the terms of the engagement could also include a reference to, and description of, the auditor’s responsibility in accordance with:

  • applicable law;
  • regulation or relevant ethical requirements, and
  • obligations to report identified or suspected non-compliance with laws and regulations to an appropriate authority outside the entity is required or appropriate in the circumstances.

A21

An example engagement letter(s) is contained in Appendix 5.

Planning and Performing the Engagement

Planning (Ref: Para. 30)

A22

The nature and extent of planning activities will vary with the compliance engagement circumstances, for example the size and complexity of the compliance activity and requirements, the assurance practitioner’s previous experience with this area and the entity as a whole. Examples of the main matters to be considered when developing the engagement plan include:

  1. Matters affecting the industry in which the entity operates, for example economic conditions, laws and regulations, and technology;
  2. Risks to which the entity is exposed that are relevant to the compliance activity being examined;
  3. The quality of the control environment within the entity and the role of the governing body, audit committee and internal audit function;
  4. Knowledge of the entity’s internal control structure obtained during other engagements;
  5. The extent of recent changes if any, in the entity, its operations or its compliance framework;
  6. Methods adopted by management to evaluate the effectiveness of the compliance framework;
  7. Preliminary judgements about significant risk;
  8. The nature and extent of evidence likely to be available;
  9. The nature of control procedures relevant to the compliance activity and their relationship to the compliance framework taken as a whole;
  10. The assurance practitioner’s preliminary judgement about the effectiveness of the compliance framework taken as a whole and of the control procedures within the framework;
  11. The terms of the compliance engagement;
  12. The characteristics of the compliance activity and the identified criteria;
  13. Identification of intended users and their needs, and consideration of materiality and the components of compliance engagement risk; and
  14. Personnel and expertise requirements, including the nature and extent of involvement by experts.

Materiality (Ref: Para.31)

A26

Materiality is considered when determining the nature, timing and extent of evidence gathering procedures, and when evaluating whether a matter of non‑compliance is material.  In considering materiality, the assurance practitioner understands and assesses what factors might influence the decisions of the intended users.

A27

Materiality is considered when evaluating the effect of accumulated deficiencies in the compliance framework or matters of non‑compliance with the compliance requirements.  Material deficiencies or matters of non‑compliance are those which could significantly impact the compliance requirements being met and reasonably be expected to influence relevant decisions of the intended users.

A28

Materiality is considered in the context of quantitative and qualitative factors, such as relative magnitude of instances of detected or suspected matter(s) of non‑compliance, the nature and extent of the effect of these factors on the evaluation of compliance with the compliance requirements and the interests of the intended users.  The assessment of materiality and the relative importance of quantitative and qualitative factors in a particular engagement are matters for the assurance practitioner’s professional judgement, taking into account specific regulatory reporting requirements.

A29

Quantitative and qualitative factors which the assurance practitioner may consider when assessing materiality include:

  • The magnitude of the instances of detected or suspected matter(s) of non-compliance with the compliance requirements.
  • The financial impact of the matter(s) of non-compliance on the entity as a whole.
  • The nature of the matter(s) of non-compliance – one off or systemic.
  • Evidence of a robust compliance framework in place to detect, rectify and report matter(s) of non-compliance.
  • Commonly accepted practices within the relevant industry.
  • The nature of relevant transactions, whether they involve high volumes, large dollar values and complex transactions relative to the compliance activity as a whole.
  • The extent of interest shown in particular aspects of the compliance activity by, for example, governing body, regulatory authorities and agencies or the public.

Obtaining an Understanding of the Compliance Framework and Compliance Requirements (Ref: Para. 32)

A30

The assurance practitioner’s understanding of the compliance framework and compliance requirements, ordinarily, has a lesser depth for a limited assurance engagement than for a reasonable assurance engagement. The assurance practitioner’s procedures to obtain this understanding may include:

  • Review and understand the relevant compliance requirements.
  • Enquiring of those within the entity who, in the assurance practitioner’s judgement, may have relevant information.
  • Observing operations.
  • Inspecting documents, reports, printed and electronic records.
  • Re-performing compliance procedures.

A31

The nature and extent of procedures to gain this understanding are a matter for the assurance practitioner’s professional judgement and will depend on factors such as:

  1. The entity’s size and complexity;
  2. The nature of the activity to be examined, including the compliance requirement(s) to which the compliance procedures are directed and the risk that those compliance requirements will not be met;
  3. The extent to which IT is used; and
  4. The documentation available.

A32

The nature and extent of planning and subsequent evidence-gathering procedures will vary with the engagement circumstances, and the maturity of the entity’s compliance framework.

 

Elements of an entity’s compliance framework ordinarily include the following:

  • Procedures for identifying and updating compliance requirements.
  • Staff training and awareness programs.
  • Procedures for assessing the impact of compliance requirements on the entity’s key business activities.
  • Controls embedded within key business processes designed to ensure compliance with requirements.
  • Processes to identify and monitor the implementation of further mitigating actions required to ensure that compliance requirements are met.
  • A monitoring plan to test key compliance controls on a periodic basis and report exceptions.
  • Procedures for identifying, assessing, rectifying and reporting matters of non-compliance.
  • Periodic sign off by management and/or external third party outsourced service providers[34] as to compliance with requirements.
  • A compliance governance structure that establishes responsibility for the oversight of compliance control activities with those charged with governance, typically a Board Audit, Risk Management or Compliance Committee.

Identifying Risks of Fraud (Ref: Para. 33,41)

A34

The assurance practitioner may consider undertaking the following procedures to obtain sufficient appropriate evidence of the risk of fraud in relation to the compliance requirements:

  1. Make enquiries of management with respect to compliance regarding:
    1. Management’s assessment of the risk that controls may be circumvented due to fraud, including the nature, extent and frequency of such assessment;
    2. Management’s process for identifying and responding to the risks of fraud;
    3. Management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud; and
    4. Management’s communication, if any, to employees regarding its views on corrupt or fraudulent business practices and unethical behaviour;
  2. Make enquiries of those charged with governance, management, and others within the entity as appropriate, to determine whether they have knowledge of any actual, suspected or alleged fraud with respect to compliance affecting the entity;
  3. Make enquiries of the internal audit function, where it exists, to determine whether it has knowledge of any actual, suspected or alleged fraud affecting the entity, and to obtain its views about the risks of fraud;
  4. Obtain an understanding of how those charged with governance exercise oversight of processes for identifying and responding to the risks of fraud in the entity and the internal controls that have been established to mitigate these risks as far as they relate to the compliance requirements;
  5. Consider whether other information obtained by the assurance practitioner indicates risks of compliance requirements not being met due to fraud, for which mitigating controls are necessary;
  6. Evaluate whether the information obtained from the other risk assessment procedures and related activities performed indicates that one or more fraud risk factors are present; and
  7. Identify controls over matters for which decisions or actions are not routine, such as adjustments to records, development of estimates and activities outside the normal course of business.

Obtaining an Understanding of the Internal Audit Function (Ref: Para. 34-38)

A35

In obtaining an understanding of the compliance framework, including controls, the assurance practitioner determines whether the entity has an internal audit function and its effect on the controls within the compliance framework.  The internal audit function ordinarily forms part of the entity’s internal control and governance structures.  The responsibilities of the internal audit function may include, for example, monitoring of internal control, risk management, and review of compliance with laws and regulations, and is considered as part of the assurance practitioner’s assessment of risk.

Obtaining Evidence

(Ref: Para. 42-46)

A37

Compliance engagements require the application of assurance skills and techniques to gather sufficient appropriate evidence as part of an iterative, systematic assurance engagement  process.  As the assurance practitioner performs planned procedures, the evidence obtained may differ significantly from that on which the planned procedures were based and cause the assurance practitioner to perform additional procedures.

A38

When compliance requirements apply throughout the specified period, the assurance practitioner may consider the nature and frequency of the compliance activities undertaken, and modify the nature, timing and extent of evaluation and/or testing to be undertaken on compliance activities.  Knowledge of non‑compliance observed in prior periods is likely to lead the assurance practitioner to increase the extent of evaluation and/or testing throughout the specified period.

Limited and Reasonable Assurance Engagements (Ref: Para. 43)

A40

The level of assurance obtained in a limited assurance engagement is lower than in a reasonable assurance engagement, therefore the procedures the assurance practitioner performs in a limited assurance engagement are different in nature and timing from, and are less in extent than for, a reasonable assurance engagement. The primary differences between the assurance practitioner’s overall responses to assessed risks and further procedures conducted in a reasonable assurance engagement and a limited assurance engagement on compliance include:

  1. The emphasis placed on the nature of various procedures as a source of evidence will likely differ, depending on the engagement circumstances. For example, the assurance practitioner may judge it to be appropriate in the circumstances of a particular limited assurance engagement to place relatively greater emphasis on indirect evaluation of compliance activities, such as enquiries of the entity’s personnel, and relatively less emphasis, on evaluation of compliance activities, such as observation, re-performance or inspection, than may be the case for a reasonable assurance engagement.
  2. In a limited assurance engagement, the further procedures performed are less in extent than in a reasonable assurance engagement in that those procedures may involve:
    1. Selecting fewer items for examination;
    2. Performing fewer types of procedures; or
    3. Performing procedures at fewer locations.

Work Performed by an Assurance Practitioner’s Expert

(Ref: Para. 47)

A41

ASAE 3000[35] provides application material for the circumstances where an assurance practitioner’s expert is involved in the engagement.  This material may also be used as  guidance when using the work of another assurance practitioner or a responsible party’s or evaluator’s expert.

Work Performed by Another Assurance Practitioner or a Responsible Party’s or Evaluator’s Expert

(Ref: Para. 48)

A42

When information on compliance activities to be used as evidence has been prepared using the work of a responsible party’s or evaluator’s expert, the nature, timing and extent of procedures with respect to the work of the responsible party’s or evaluator’s expert may be affected by such matters as:

  1. The nature and complexity of the compliance activity to which the expert’s work relates;
  2. The risks of a material deficiency in the compliance framework or non-compliance with the compliance requirements throughout the specified period or as at a specified date;
  3. The availability of alternative sources of evidence or mitigating controls;
  4. The nature, scope and objectives of the expert’s work;
  5. Whether the expert is employed by the entity, or is a party engaged by it to provide relevant services;
  6. The extent to which the responsible party or evaluator can exercise control or influence over the work of the expert;
  7. Whether the expert is subject to technical performance standards or other professional or industry requirements;
  8. The nature and extent of any controls within the entity over the expert’s work;
  9. The assurance practitioner’s knowledge and experience of the expert’s field of expertise; and
  10. The assurance practitioner’s previous experience of the work of that expert.

Work Performed by the Internal Audit Function (Ref: Para.  34-38)

A43

The nature, timing and extent of the assurance practitioner’s procedures on specific work of the internal auditors will depend on the assurance practitioner’s assessment of the significance of that work to the assurance practitioner’s conclusions, the evaluation of the internal audit function and the evaluation of the specific work of the internal auditors. Such procedures may include:

  1. Examination of evidence of the operation of the compliance activity already examined by the internal auditors;
  2. Examination of evidence of the operation of other instances of the same compliance activity;
  3. Examination of the outcomes of monitoring of controls by internal auditors; and
  4. Observation of procedures performed by the internal auditors.

Written Representations

(Ref: Para. 51)

A48

The person(s) from whom the assurance practitioner requests written representations will ordinarily be a member of senior management or those charged with governance.  However, because management and governance structures vary by entity, reflecting influences such as different cultural and legal backgrounds, and size and ownership characteristics, it is not possible for this ASAE to specify for all engagements the appropriate person(s) from whom to request written representations.  The process to identify the appropriate person(s) from whom to request written representations requires the exercise of professional judgement.

Subsequent Events

(Ref: Para 52)

Preparing the Assurance Report

(Ref: Para. 55-58)

Assurance Report Content

A51

The assurance practitioner may expand the report to include other information not intended as a qualification of the assurance practitioner’s conclusion. If the report includes other information it is a long-form report as the information is additional to the basic elements required in paragraph 56 for a short-form report. This additional information may be required by regulation or agreed in the terms of the engagement to meet the needs of users. When considering whether to include any such information the assurance practitioner assesses the materiality of that information in the context of the objectives of the engagement. Other information is not to be worded in such a manner that it may be regarded as a qualification of the assurance practitioner’s conclusion and may include for example:

  • Relevant background information and historical context.
  • The assurance approach.
  • Underlying facts and criteria applied.
  • Disclosure of materiality levels.
  • Findings relating to particular aspects of the compliance engagement.
  • Analysis of the causes of non-compliance with the compliance requirements.
  • Recommendations for improvements to address identified compliance framework deficiencies.

Summary of the Work Performed (Ref: Para 56(n))

A54

In a limited assurance engagement an appreciation of the nature, timing, and extent of procedures performed is essential to understanding the assurance conveyed by the conclusion, therefore the summary of the work performed is ordinarily more detailed than for a reasonable assurance engagement and identifies the limitations on the nature, timing, and extent of procedures.  It also may be appropriate to indicate certain procedures that were not performed that would ordinarily be performed in a reasonable assurance engagement.  However, a complete identification of all such procedures may not be possible because the assurance practitioner’s required understanding and consideration of engagement risk is less than in a reasonable assurance engagement.

A55

Factors to consider in determining the level of detail to be provided in the summary of the work performed include:

  1. Circumstances specific to the entity (e.g. the maturity of the entity’s compliance framework compared to those typical in the industry sector);
  2. Specific engagement circumstances affecting the nature and extent of the procedures performed; and
  3. The intended users’ expectations of the level of detail to be provided in the report, based on market practice, or applicable law or regulation.

A57

Illustrative examples of assurance practitioner’s reports are contained in Appendix 6.

Intended Users and Specific Purpose of the Assurance Report (Ref: Para.  56(o))

Modified Conclusions (Ref: Para. 6061)

A59

Modifications to the assurance report may be made in the following circumstances:

  1. A qualified conclusion may be issued if the following matters are material but not pervasive:
    1. Unsuitable criteria mandated by legislation or regulation where the assurance practitioner is unable to resign from the engagement;
    2. Scope limitation;
    3. Non-compliance with the compliance requirements;
    4. Misstatement in the Statement;
  2. An adverse conclusion may be issued if the following matters are both material and pervasive:
    1. Unsuitable criteria mandated by legislation or regulation where the assurance practitioner is unable to resign from the engagement;
    2. Non-compliance with the compliance requirements;
    3. Misstatement in the Statement;
  3. A disclaimer may be issued if there is a limitation of scope which is both material and pervasive.

A60

Illustrative examples of elements of modified assurance practitioner’s reports are contained in Appendix 7.

Other Communication Responsibilities

(Ref: Para. 62-65)

A63

Appropriate actions to respond to the circumstances identified in paragraph 65 may include:

  • Obtaining legal advice about the consequences of different courses of action.
  • Communicating with those charged with governance of the entity.
  • Communicating with third parties (for example, a regulator) when required to do so.
  • Modifying the assurance practitioner’s conclusion, or adding an Other Matter paragraph.
  • Withdrawing from the engagement.

Documentation

(Ref: Para. 66-67)

31

See ASAE 3000, paragraph 32.

32

See ASAE 3000, paragraph 24(b)(vi).

33

See ASAE 3000, paragraph 24(b)(i). 

34

Refer to ASA 402 Audit Considerations Relating to an Entity Using a Service Organisation and GS013 Special Considerations in the Audit of Compliance Plans of Managed Investment Schemes paragraphs 36 and 37 for further guidance.

35

See ASAE 3000, paragraphs A120-A134.

36

See ASAE 3000, paragraphs A136-A139.

37

See ASAE 3000, paragraphs A193-A200.

Appendices

Includes: Roles and Responsibilities - Direct and Attestation Compliance Engagements, Terminology Table - ASAE 3000 and ASAE 3100, Examples - Nature of Assurance Engagements on Compliance, Standards Applicable to Example Engagements on Compliance, Example Engagement Letters, Example Assurance Reports on Compliance, Example Modified Assurance Reports on Compliance

Roles and Responsibilities - Direct and Attestation Compliance Engagements

Appendix 1

 

Download Roles and Responsibilities in a Direct and Attestation Compliance Engagement Diagram.

 

 

Terminology Table - ASAE 3000 and ASAE 3100

Appendix 2

 

Download Terminology Table for ASAE 3000 and ASAE 3100.

 

Examples - Nature of Assurance Engagements on Compliance

Appendix 3

 

Download Example Scopes of Assurance Engagements on Compliance.

 

Standards Applicable to Example Engagements on Compliance

Appendix 4

 

Download Application of AUASB Standards to Compliance Engagements Table.

 

Example Engagement Letters

Appendix 5

 

Download Example Engagement Letters.

 

Example Assurance Reports on Compliance

Appendix 6

 

Download Example Assurance Reports on Compliance.

 

Example Modified Assurance Reports on Compliance

Appendix 7

 

Download Example Modified Assurance Reports on Compliance.

 

Top of Page