The objectives of the assurance practitioner for an assurance engagement on controls are:

1. to obtain limited or reasonable assurance about whether, in all material respects, based on suitable criteria, either:
   1. as at a specified date, the controls were suitably designed, to achieve the identified control objectives and, if included in the scope of the engagement:
      1. the entity’s description of the system of controls fairly presents the system;^[14] and/or
      2. the controls were implemented as designed; or
   2. throughout the period, the controls were suitably designed to achieve the identified control objectives, the controls operated effectively as designed and, if included in the scope of the engagement, the entity’s description of its system fairly presents the system;¹⁴ and
2. to express a conclusion through a written report on the matters in (a) above which expresses either a reasonable or limited assurance conclusion and describes the basis for the conclusion.

In conducting the assurance engagement, the objectives of the assurance practitioner under ASAE 3000^[15] include: “to obtain either reasonable or limited assurance, as appropriate, about whether the subject matter information is free from material misstatement”.  The subject matter information in a controls engagement is the outcome of the evaluation of the design, and/or the description, implementation or operating effectiveness of controls against the criteria.  The evaluation is conducted:

1. in an attestation engagement, by the responsible party or evaluator, and presented in a Statement, which addresses whether the controls are suitably designed to achieve identified control objectives, and if applicable, the description is fairly presented, the controls are implemented as designed and/or operated effectively.  The objective of the assurance practitioner is to obtain reasonable or limited assurance about whether the Statement is free from material misstatement, although the assurance practitioner’s conclusion may be expressed in terms of the subject matter; or
2. in a direct engagement, by the assurance practitioner and presented in the assurance report, therefore, no Statement is prepared by the responsible party or evaluator.  The objectives of the assurance practitioner are to obtain reasonable or limited assurance about whether the controls are suitably designed to achieve identified control objectives, and, if included in the scope of the engagement, the description is fairly presented, the controls were implemented as designed and/or operated effectively.