This Standard on Assurance Engagements (ASAE) deals with assurance engagements undertaken by an assurance practitioner to provide an assurance report on the suitability of the design of controls to achieve identified control objectives, and, if applicable, fair presentation of the description of the system, implementation of the controls as designed and/or operating effectiveness of controls as designed.

This ASAE addresses engagements on controls, except those engagements to which ASAE 3402 applies: (Ref: Para. A2-A7)

1. over any subject matter, whether directed at operations, external reporting, contractual compliance or regulatory compliance; (Ref: Para. A3)
2. evaluated against the achievement of either overall or specific control objectives;
3. covering one or more component/s of control;^[3]
4. providing a limited or reasonable assurance conclusion;
5. for either restricted use, by those charged with governance of the entity or specified third parties, or to be publicly available; (Ref: Para. A5)
6. either based on an attestation engagement or a direct engagement; (Ref: Para. 17(a), 17(o), A6)
7. to conclude either:
   1. as at a specified date, on the suitability of the design of controls to achieve the identified control objectives, and, if included in the scope of the engagement:
      1. fair presentation of the description of the system; and/or
      2. implementation of the controls as designed; or
   2. throughout the period, on the suitability of the design of controls to achieve identified control objectives and operating effectiveness of controls as designed, and, if included in the scope of the engagement, fair presentation of the description of the system.

The scope of an engagement on controls includes either implementation at a specified date or operating effectiveness over the period but not usually both, because implementation is inherent in testing operating effectiveness.

Agreed-upon procedures engagements, where procedures are conducted and factual findings are reported but no conclusion is provided, and consulting engagements, for the purpose of providing advice, on controls are not assurance engagements and are not dealt with in this ASAE.  Agreed-upon procedures engagements are addressed under Standard on Related Services, ASRS 4400.^[4]

Nature of Engagements

Assurance engagements on controls may include, but are not limited to:

1. compliance with contractual requirements agreed with customers, investors, financiers, purchasers or government for controls to achieve identified control objectives at an entity, such as controls over health and safety, ethics, privacy and security of data and information technology (IT) accessibility;
2. compliance with regulatory requirements, such as:
   1. Australian Prudential Regulation Authority (APRA) reporting requirements for limited assurance on controls over compliance, data reliability and other specified matters for general insurers,^[5] authorised deposit-taking institutions,^[6] life companies,^[7] superannuation entities^[8] and APRA–regulated group level 3 heads;^[9] or
   2. legislative requirements for assurance reports on controls at certain government entities;
3. concluding on operational or compliance controls at a service organisation to meet the needs of user auditors, except for financial reporting controls (Ref: Para. 1, A1);^[10] or
4. voluntary engagements initiated by the entity on its own controls over services, activities undertaken or functions which it provides.

The control framework applied in designing the controls is relevant when identifying the components of control and overall control objectives to be addressed in the scope of the engagement and as a basis for the development of specific control objectives. The control framework may be derived from:

1. legislation or regulation;
2. a publicly available framework, such as the Committee of Sponsoring Organizations of the Treadway Commission’s Internal Control Integrated Framework 2013 (COSO Framework) or COBIT 5;
3. industry standard, developed specifically to meet the relevant industry; or
4. in-house development to meet the entity’s needs.

Relationship with ASAE 3000, Other Pronouncements and Other Requirements

The assurance practitioner is required to comply with ASAE 3000 and this ASAE when performing assurance engagements on controls, other than engagements required to be conducted under ASAE 3402. This ASAE supplements, but does not replace, ASAE 3000, and expands on how ASAE 3000 is to be applied to limited and reasonable assurance engagements on controls. This ASAE applies the requirements in ASAE 3000 to attestation engagements and adapts those requirements, as necessary, to direct engagements on controls. ASAE 3000 includes requirements in relation to such topics as engagement acceptance, planning, obtaining evidence and documentation that apply to all assurance engagements, including engagements conducted in accordance with this ASAE. The Assurance Framework, which defines and describes the elements and objectives of an assurance engagement, provides the context for understanding this ASAE and ASAE 3000.

Compliance with ASAE 3000 requires, among other things, that the assurance practitioner complies with relevant ethical requirements related to assurance engagements, or other professional requirements, or requirements in law or regulation, that are at least as demanding.^[11] (Ref: Para. 19)  It also requires the lead assurance practitioner^[12] to be a member of a firm that applies ASQM 1 or other professional requirements, or requirements in law or regulation, that are at least as demanding as ASQM 1.^[13]

An assurance engagement performed under this ASAE may be part of a larger engagement. In such circumstances, this ASAE is relevant only to the portion of the engagement relating to assurance on controls.

If multiple standards are applicable to an assurance engagement on controls, the assurance practitioner applies, in addition to ASAE 3000, either:

1. if the engagement can be separated into parts, the standard relevant to each part of the engagement; or
2. if the engagement cannot be separated into parts, the standard which is most directly relevant to the subject matter.

Assurance conclusions on controls are often required by regulators or users in conjunction with assurance conclusions on financial reports, other historical financial information, compliance and/or other subject matters.  In addition, service auditors may be engaged to report under ASAE 3402, on controls at a service organisation that are likely to be relevant to user entities’ internal control as it relates to financial reporting, as well as to report under this ASAE, on controls over operational or compliance requirements, as agreed in a service level agreement.  In these engagements the subject matter, criteria against which that subject matter is evaluated and the level of assurance sought may vary, in which case different standards will apply.  Assurance reports can include separate sections for each subject matter, criteria or level of assurance in order that the different matters concluded upon are clearly differentiated.  (Ref: Para. A8)

A table showing the AUASB Standards to apply to assurance engagements on controls depending on the subject matter and engagement circumstances is contained in Appendix 3.