The assurance practitioner shall not represent compliance with this ASAE unless the assurance practitioner has complied with the requirements of this ASAE and ASAE 3000, adapted as necessary in the case of direct engagements.  ASAE 3000 contains requirements and application and other explanatory material specific to attestation assurance engagements but it also applies to direct assurance engagements, adapted as necessary in the engagement circumstances.^[6] If this ASAE makes reference to a requirement in ASAE 3000, that requirement shall be applied to both attestation and direct engagements, unless specified otherwise. (Ref: Para. A1, Appendix 4)

As required by ASAE 3000, the assurance practitioner shall comply with relevant ethical requirements related to assurance engagements.^[7] (Ref: Para. A6)

Preconditions for the Assurance Engagement

The assurance practitioner shall accept or continue a compliance engagement only in the circumstances required by ASAE 3000, including that the preconditions for an assurance engagement are present, unless required to accept the engagement by law or regulation.

Appropriateness of the Subject Matter

When establishing whether the preconditions for an assurance engagement as required by ASAE 3000 are present, the assurance practitioner is required to assess the appropriateness of the subject matter.^[8] In doing so, the assurance practitioner shall determine whether the compliance activities which are to be evaluated are appropriate in addressing the needs of users, that is whether the performance of those activities determines whether the compliance requirements have been met. (Ref: Para. A9-A11)

If the subject matter is not appropriate, the assurance practitioner shall not accept the engagement or, if this is determined after accepting the engagement, either withdraw from the engagement or issue a modified conclusion.

Assessing the Suitability of the Criteria

When establishing whether the preconditions for an assurance engagement as required by ASAE 3000 are present, the assurance practitioner shall determine the suitability of the criteria expected to be applied, whether the criteria are provided by the engaging party, as in an attestation engagement, or are to be identified by the assurance practitioner, as in a direct engagement, including that they exhibit the characteristics set out in ASAE 3000.^[9](Ref: Para. 17(g), A12).

Agreeing on the Terms of the Engagement

ASAE 3000^[10] requires the parties to the engagement to agree on the terms of the assurance engagement in writing. The assurance practitioner shall obtain the agreement of the responsible party, that it acknowledges and understands its responsibility:

1. In an attestation engagement, for evaluating the compliance activity against the compliance requirements and providing a written Statement regarding the outcome of that evaluation and for having a reasonable basis for the written Statement;
2. For identifying suitable compliance requirements and whether they were specified by law, regulation, contract, another party (for example, a user group or a professional body) or developed by the responsible party;
3. For providing the assurance practitioner with:
   1. Access to all information, such as records, documentation and other matters of which the responsible party is aware are relevant to the compliance engagement;
   2. Additional information that the assurance practitioner may request from the responsible party for the purposes of the assurance engagement; and
   3. Unrestricted access to persons within the entity from whom the assurance practitioner determines it necessary to obtain evidence.

The terms of engagement shall identify:

1. The scope of the engagement;
2. Whether the engagement is a reasonable or limited assurance engagement;
3. Whether the engagement is an attestation or direct engagement and, in the case of an attestation engagement, the form of the responsible party’s or evaluator’s evaluation of the compliance activity or Statement and whether that Statement will be available to intended users or only referenced in the assurance report; (Ref: Para. A16,A20)
4. The specified period or specified date to be covered by the engagement; (Ref: Para. A17)
5. The compliance requirements against which the compliance activity will be evaluated;
6. The intended users of the assurance report;
7. The content of the assurance report, including whether it will be a short-form or long form report, including additional information such as the compliance requirements, procedures conducted, detailed findings and recommendations to meet the needs of the intended users; and (Ref: Para. A20)
8. Any other matters required by law or regulation (e.g. reporting all matters of non-compliance identified to the regulator^[11]) to be included in the terms of engagement. (Ref: Para. 27)

Acceptance of a Change in the Terms of the Engagement

If the engaging party requests a change in the terms of the engagement before the completion of the engagement, the assurance practitioner shall be satisfied that there is a reasonable justification for the change as required by ASAE 3000.^[12] (Ref: Para. A16)

Assurance Report Prescribed by Law or Regulation

If law or regulation prescribe the compliance requirements for evaluation or the form and content of the assurance report, the assurance practitioner evaluates the compliance requirements and form and content of the assurance report. If the compliance requirements are unsuitable or if intended users might misunderstand the assurance report, the assurance practitioner shall: (Ref: Para. A16, A52)

1. Not accept the engagement unless additional explanation in the assurance report mitigates these circumstances; or
2. Not include any reference within the assurance report to the engagement having been conducted in accordance with ASAE 3000 or this ASAE, if required to accept the engagement by law or regulation. 

The assurance practitioner shall implement quality control procedures as required by ASAE 3000.^[13]

The assurance practitioner shall apply professional scepticism, exercise professional judgement and apply assurance skills and techniques in planning and performing an assurance engagement on compliance as required by ASAE 3000.^[14]  In applying professional scepticism, the assurance practitioner shall recognise the possibility that matters of non‑compliance due to fraud could exist, notwithstanding the assurance practitioner’s past experience of the honesty and integrity of the entity’s management and those charged with governance.

Planning

The assurance practitioner shall plan the engagement so that it will be performed in an effective manner as required by ASAE 3000.^[15]  (Ref: Para. A22)

Materiality

The assurance practitioner shall consider materiality, as required by ASAE 3000,^[16] when determining the nature, timing and extent of procedures. (Ref: Para.  A24-A29 )

Obtaining an Understanding of the Compliance Framework and Compliance Requirements

Identifying Risks of Fraud

When performing risk assessment procedures and related activities to obtain an understanding of the compliance framework and other engagement circumstances, the assurance practitioner shall obtain sufficient information for use in identifying the risks of the compliance requirements not being met due to fraud. (Ref: Para. A33-A34)

Obtaining an Understanding of the Internal Audit Function

When performing risk assessment procedures and related activities to obtain an understanding of the compliance framework and other engagement circumstances, the assurance practitioner shall obtain sufficient information for use in identifying the risks of the compliance requirements not being met due to fraud. (Ref: Para. A33-A34)

Obtaining an Understanding of the Internal Audit Function

The assurance practitioner shall determine whether the entity has an internal audit function and, if so, makes further enquiries to obtain an understanding of the activities and main findings of the internal audit function with respect to the compliance engagement. (Ref: Para. A35)

The assurance practitioner shall consider based on the compliance engagement circumstances whether it is appropriate to use the work of the internal audit function.

If the assurance practitioner plans to use the work of the internal audit function in accordance with paragraph 37, the assurance practitioner shall evaluate it as required by ASAE 3000.^[17]

Using the Work of the Internal Audit Function

If the assurance practitioner’s evaluation of the internal audit function confirms that the work of the internal audit function can be used for purposes of the compliance engagement, then the assurance practitioner shall determine the planned effect of the work of the internal audit function on the nature, timing or extent of the assurance practitioner’s procedures and in doing so, shall consider: (Ref: Para. A36, A43-A44)

1. The nature and scope of work performed, or to be performed, on the compliance framework by the internal audit function;
2. The significance of that work to the assurance practitioner’s conclusions;
3. The degree of subjectivity involved in the evaluation of the evidence obtained in support of those conclusions; and
4. Re-performing some of the work of the internal audit function that is planned to be used.

The use of internal auditors to provide direct assistance is prohibited in an assurance engagement conducted in accordance with this ASAE.  Direct assistance is the performance of assurance procedures under the direction, supervision and review of the assurance practitioner.^[18]  This prohibition does not preclude reliance on the work of the internal audit function to modify the nature or timing, or reduce the extent, of assurance procedures to be performed directly by the assurance practitioner.  (Ref: Para. A36)

Based on the assurance practitioner’s understanding obtained under paragraph 32L and 32R, the assurance practitioner shall perform assurance procedures to respond to identified or assessed risks in paragraph 32L(b) to obtain limited or 32R(b) to obtain reasonable assurance to support the assurance practitioner’s conclusion. (Ref: Para. A37-A39)

The assurance practitioner shall design and perform additional procedures, the nature, timing and extent of which are responsive to the risks of material deficiency in the compliance framework or matters of non‑compliance with compliance requirements, having regard to the level of assurance required, reasonable or limited, as appropriate.  (Ref: Para. A40)

Responses to Assessed Risks of Fraud

The assurance practitioner shall treat those assessed risks of compliance requirements not being met due to fraud as significant risks.  Accordingly, the assurance practitioner shall design and perform procedures, on controls designed to mitigate such risks, and whose nature, timing and extent are responsive to those assessed risks.  In doing this the assurance practitioner shall have regard to the level of assurance required, reasonable or limited, as appropriate. (Ref: Para. A34)

Obtaining Evidence Regarding the Compliance Activity

When reporting on compliance throughout the specified period or as at a specified date, the assurance practitioner shall evaluate those compliance activities that the assurance practitioner has determined are necessary to meet the compliance requirements identified, and assess their compliance throughout the specified period or as at a specified date. (Ref: Para. A37)

Sampling

When the assurance practitioner uses sampling to test compliance, the assurance practitioner shall: (Ref: Para. 45R)

1. Consider the purpose of the procedure and the characteristics of the compliance activity from which the sample will be drawn when designing the sample;
2. Determine a sample size sufficient to reduce sampling risk to an acceptably low level;
3. Select items for the sample in such a way that each sampling unit in the population has a chance of selection and the sample is representative of the population; and
4. If unable to apply the designed procedures, or suitable alternative procedures, to a selected item, treat that item as a deviation.

When the assurance practitioner plans to use the work of an assurance practitioner’s expert, the assurance practitioner shall comply with the requirements in ASAE 3000.^[19] (Ref: Para. A41)

If the assurance practitioner plans to use information prepared using the work of another assurance practitioner or a responsible party’s or evaluator’s expert, as evidence, the assurance practitioner shall comply with the requirements of ASAE 3000.^[20] (Ref: Para. A42-A43)

In an attestation engagement on compliance the assurance practitioner shall accumulate instances of non‑compliance identified by the entity and the assurance practitioner, other than those that are clearly trivial, in order to form a conclusion on the Statement.  In a direct engagement on compliance the assurance practitioner shall accumulate identified instances of non‑compliance other than those that are clearly trivial in order to form a conclusion.

The assurance practitioner shall evaluate individually and in aggregate, whether the matter of non‑compliance with the compliance requirements is material. (Ref: Para. A45)

The assurance practitioner shall request the responsible party, or other relevant person(s) within the entity to provide written representations, in addition to those required by ASAE 3000,^[21] that the responsible party: (Ref: Para. A46)

1. In the case of an attestation engagement, reaffirms their Statement regarding the outcome of the responsible party’s evaluation of the compliance activity against the compliance requirements throughout the specified period or as at a specified date;
2. Acknowledges its responsibility for the compliance activity, including identifying the risks that threaten the compliance requirements being met, and designing, implementing and maintaining internal controls to mitigate those risks, including the risk of fraud, so that those risks will not prevent achievement of the compliance requirements;
3. Has provided the assurance practitioner with all relevant information and access agreed to, as set out in paragraph 24(c)(i);
4. Has disclosed to the assurance practitioner any of the following of which it is aware may be relevant to the engagement:
   1. Instances of non-compliance with the compliance requirements; or
   2. Any events subsequent to the specified period or as at the specified date covered by the assurance practitioner’s conclusion up to the date of the assurance report that could have a significant effect on the assurance practitioner’s conclusion.

The assurance practitioner shall evaluate written representations in accordance with ASAE 3000. (Ref: Para. A47)

When relevant to the compliance engagement, the assurance practitioner shall consider the effect on the compliance outcome of events up to the date of the assurance report, and shall respond appropriately to facts that become known to the assurance practitioner after the date of the assurance conclusion, that had they been known to the assurance practitioner at that date, may have caused the assurance practitioner to amend the assurance conclusion.  The extent of consideration of subsequent events depends on the potential for such events to impact the assurance practitioner’s conclusion.  The assurance practitioner has no responsibility to perform any procedures regarding the compliance outcome after the date of the assurance report. (Ref: Para. A49-A50)

The assurance practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary, attempt to obtain further evidence.  If the assurance practitioner is unable to obtain necessary further evidence, the assurance practitioner shall consider the implications for the assurance practitioner’s conclusion in accordance with ASAE 3000.^[22]  The assurance practitioner shall qualify their conclusion if the possible effects of undetected matters of non‑compliance with the compliance requirements due to an inability to obtain sufficient appropriate evidence could be material, and shall disclaim their conclusion if the possible effects could be both material and pervasive.

When the assurance practitioner forms a conclusion in accordance with ASAE 3000,^[23] the assurance practitioner shall evaluate the materiality, individually and in aggregate whether due to fraud or error, of any matter(s) of non-compliance with the compliance requirements. If the matters of non-compliance identified are: (Ref: Para. A45-A46)

1. Material but not pervasive, the assurance practitioner shall qualify their assurance conclusion with respect to the relevant matter; or
2. Material and pervasive, the assurance practitioner shall issue an adverse conclusion.

The assurance practitioner shall prepare the assurance report in accordance with ASAE 3000^[24] for attestation engagements and shall also apply those requirements for direct engagements.

Assurance Report Content

For both attestation and direct engagements, the assurance practitioner shall include in the assurance report the basic elements required by ASAE 3000,^[25] which are at a minimum:

1. A title, indicating that it is an independent assurance report;
2. An addressee;
3. An identification of whether reasonable or limited assurance has been obtained by the assurance practitioner;
4. Identification of the compliance requirements;
5. Whether the assurance practitioner is reporting on compliance throughout the specified period or as at a specified date;
6. In the case of an attestation engagement, reference to the responsible party’s Statement as required by paragraph 24(a) and whether that Statement is available to intended users by accompanying the assurance report, reproduction in the assurance report or another identified source;
7. Identification of the overall and/or specific criteria used for evaluating the compliance activity;
8. If appropriate, a description of any significant inherent limitations associated with the evaluation of the compliance activity against the compliance requirements;
9. A statement that the responsible party or evaluator is responsible for:
   1. In an attestation engagement:
      1. Providing a Statement with respect to the outcome of the evaluation of the compliance activity against the compliance requirements;
      2. Identifying the compliance requirements (where not identified by Parliament, the Government, law or regulation, or another party, for example, a user group or a professional body); and
   2. In both an attestation and a direct engagement:
      1. The compliance activity covered by the assurance practitioner’s report;
      2. Identifying, designing and implementing controls to enable the compliance requirements to be met and to monitor ongoing compliance;
10. A statement that the assurance practitioner’s responsibility is to express a conclusion on whether the compliance requirements have, in all material respects, been met;
11. A statement that the engagement was performed in accordance with ASAE 3100 Compliance Engagements;
12. A statement that the firm of which the assurance practitioner is a member applies ASQC 1;
13. A statement that the assurance practitioner complies with the independence and other relevant ethical requirements related to assurance engagements;
14. An informative summary of the work performed as a basis for the assurance practitioner’s conclusion. In the case of a limited assurance engagement, an appreciation of the nature, timing, and extent of procedures performed is essential to understanding the assurance practitioner’s conclusion. In a limited assurance engagement, the summary of the work performed shall state that: (Ref: Para. A53-A57)
    1. The procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement; and
    2. Consequently, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed;
15. When the criteria used to evaluate the compliance requirements are available only to specific intended users, or are relevant only for a specific purpose, a statement restricting the use of the assurance report to those intended users or that purpose; (Ref: Para. A58)
16. Either, the assurance practitioner’s opinion for a reasonable assurance engagement or the assurance practitioner’s conclusion for a limited assurance engagement about whether, in all material respects the entity complied with the compliance requirements throughout the specified period or as at a specified date;
17. When the assurance practitioner expresses a modified conclusion, the assurance report shall contain:
    1. A section (entitled: Basis for Qualified/Adverse/Disclaimer of Conclusion/Opinion) that provides a description of the matter(s) giving rise to the modification; and
    2. A section that contains the assurance practitioner’s modified conclusion;
18. The assurance practitioner’s signature, the date of the assurance report and the location in the jurisdiction where the assurance practitioner practices.

If the assurance practitioner provides a long‑form assurance report to meet the information needs of users, as agreed in the terms of engagement, or as required by law or regulation, the assurance practitioner’s report shall include a separate section, or an attachment, containing any other information and explanations that are not intended to affect the assurance practitioner’s conclusion and are clearly identified as such. (Ref: Para. A51)

If the assurance practitioner is required to conclude on other subject matters under different AUASB standards in conjunction with an engagement to report under this ASAE, the assurance report shall include a separate section for each subject matter in the assurance report, clearly differentiated by appropriate section headings.

Emphasis of Matter and Other Matter Paragraphs

The assurance practitioner shall include an Emphasis of Matter or Other Matter paragraph in the circumstances provided for in ASAE 3000^[26] for an attestation engagement.  In a direct engagement, if the assurance practitioner considers it necessary to communicate a matter that, in the assurance practitioner’s judgement, is relevant to intended users’ understanding of the engagement, the assurance practitioner’s responsibilities or the assurance report, the assurance practitioner shall include in the assurance report an Other Matter paragraph, with an appropriate heading, that clearly indicates the assurance practitioner’s conclusion is not modified in respect of the matter.

Modified Conclusions

If the assurance practitioner concludes that the compliance activity has not met the compliance requirements throughout the specified period or as at a specified date; or the assurance practitioner is unable to obtain sufficient appropriate evidence, the assurance practitioner’s conclusion shall be modified, and the assurance practitioner’s report shall include a section with a clear description of all the reasons for the modification. (Ref: Para. A59-A61)

Scope Limitation

When a scope limitation is imposed by the circumstances of the particular engagement, the assurance practitioner shall attempt to perform alternative procedures to overcome the limitation.  When a scope limitation exists and remains unresolved, the wording of the assurance practitioner’s conclusion shall indicate that it is qualified as to the effects of any instances of non‑compliance with the compliance requirements, which might have been identified had the limitation not existed.  If the effect of the unresolved scope limitation is both material and pervasive, the assurance practitioner shall express a disclaimer of conclusion. (Ref: Para. A62)

The assurance practitioner shall consider whether, pursuant to the terms of the engagement, if applicable, and other engagement circumstances, any matter has come to the attention of the assurance practitioner that is to be communicated with the responsible party, the evaluator, the engaging party, those charged with governance or others, as required by ASAE 3000.^[27]  If during the course of the engagement the assurance practitioner identifies any matters of non‑compliance with the entity’s compliance requirements other than those which are clearly trivial, the assurance practitioner shall communicate on a timely basis to an appropriate level of management those matters of non‑compliance or those charged with governance on a timely basis those matters of material non‑compliance. (Ref: Para. A64)

In limited circumstances the assurance practitioner may be required by law or regulation and  the terms of the engagement to report all instances of non‑compliance with the compliance requirements to the regulator^[28].

If the assurance practitioner has identified a fraud or has obtained information that indicates that a fraud may exist, the assurance practitioner shall communicate these matters on a timely basis to the appropriate level of management or those charged with governance in order to inform those with primary responsibility for the prevention and detection of fraud of matters relevant to their responsibilities.  The assurance practitioner shall determine whether there is a responsibility to report the occurrence or suspicion to a party outside the entity. (Ref: Para. A63)

The assurance practitioner shall design engagement procedures to gather sufficient appropriate evidence to form a conclusion in accordance with the terms of the engagement.  In the absence of a specific requirement in the terms of engagement the assurance practitioner does not have a responsibility to design procedures to identify matters outside the scope of the engagement that may be appropriate to report to management or those charged with governance.

The assurance practitioner shall prepare documentation in accordance with ASAE 3000.^[29] In documenting the nature, timing and extent of procedures performed as required by ASAE 3000, the assurance practitioner shall record (Ref: Para. A65):

1. The identifying characteristics of the compliance activity being tested;
2. Who performed the work and the date such work was completed; and
3. Who reviewed the work performed and the date and extent of such review.

If the assurance practitioner uses specific work of the internal audit function, the assurance practitioner shall document the conclusions reached regarding the evaluation of the adequacy of the work of the internal audit function, and the procedures performed by the assurance practitioner on that work.