The assurance practitioner shall not represent compliance with this ASAE unless the assurance practitioner has complied with the requirements of this ASAE and ASAE 3000, adapted as necessary in the case of direct engagements. ASAE 3000 contains requirements and application and other explanatory material specific to attestation assurance engagements but it also applies to direct assurance engagements, adapted as necessary in the engagement circumstances.^[18] If this ASAE makes reference to a requirement in ASAE 3000, that requirement shall be applied to both attestation and direct engagements, unless specified otherwise. (Ref: Para. A6)

As required by ASAE 3000, the assurance practitioner shall comply with relevant ethical requirements related to assurance engagements.^[19] (Ref: Para. A10)

Preconditions for the Assurance Engagement

The assurance practitioner shall accept or continue an assurance engagement on controls only in the circumstances required by ASAE 3000,^[20] including that the preconditions for an assurance engagement are present, unless required to accept the engagement by law or regulation. (Ref: Para. A11-A14)

Assessing the Appropriateness of the Subject Matter

When establishing whether the preconditions for an assurance engagement as required by ASAE 3000 are present, the assurance practitioner is required to assess the appropriateness of the subject matter.^[21] In doing so, the assurance practitioner shall determine whether the control components and specific controls are identifiable, the controls are capable of consistent evaluation against the control objectives and the scope of the controls within the assurance engagement provide an appropriate basis for that engagement. If the subject matter is not appropriate, the assurance practitioner shall not accept the engagement or, if this is determined after accepting the engagement, either withdraw from the engagement or issue a modified conclusion. (Ref: Para. A15)

Assessing the Suitability of the Criteria

When establishing whether the preconditions for an assurance engagement as required by ASAE 3000 are present, the assurance practitioner shall determine the suitability of the criteria expected to be applied, whether the criteria are provided by the engaging party, as in an attestation engagement, or are to be identified, selected or developed by the assurance practitioner, as in a direct engagement, including that they exhibit the characteristics set out in ASAE 3000.^[22] The main criteria are: (Ref: Para. A16-A26)

1. control objectives, for evaluating the design of the controls; and
2. controls, necessary to achieve the control objectives, as designed, for evaluating the description of the system, implementation of controls or operating effectiveness.

If the assurance practitioner considers that the identified criteria are unsuitable, the assurance practitioner shall either:

1. agree on suitable criteria with the engaging party prior to accepting or continuing with the engagement.  If unable to agree on suitable criteria, the assurance practitioner shall withdraw from the engagement; or
2. issue a modified conclusion, either qualified or a disclaimer depending on the extent of the unsuitable criteria, if the assurance practitioner is required to perform the engagement using the unsuitable criteria, such as under a legislative mandate.

Agreeing on the Terms of the Engagement

The parties to the engagement shall agree on the terms of the assurance engagement in writing, as required by ASAE 3000,^[23] and the assurance practitioner shall obtain the agreement of the responsible party, if they are a party to the engagement, that it acknowledges and understands its responsibility: (Ref: Para. A27)

1. in an attestation engagement,
   1. for evaluating the suitability of the design of controls to achieve the identified control objectives, and if applicable, the presentation of the description, implementation and/or operating effectiveness of controls, as designed, which are the subject matter of the assurance engagement, and providing a written Statement regarding the outcome of that evaluation;
   2. for having a reasonable basis for the written Statement; (Ref: Para. A37-A39)
2. in both an attestation and a direct engagement:
   1. for identifying suitable control objectives and whether they were specified by law, regulation, contract, another party (for example, a user group or a professional body) or developed by the responsible party or assurance practitioner;
   2. for identifying the risks that threaten achievement of those control objectives;
   3. for designing controls to mitigate those risks so they will not prevent achievement of the identified control objectives, and therefore the control objectives will be achieved;
   4. if included in the scope of the engagement:
      1. for preparing a description of the system, including identification of any controls operated by a third party, service or sub-service organisation, which may be material to the engagement, and whether the inclusive or carve-out method has been used in relation to those third party controls;
      2. for implementing the controls as designed; or
      3. for the operation of the controls as designed throughout the period;
   5. to provide the assurance practitioner with:
      1. access to all information, such as records, documentation and other matters of which the responsible party is aware are relevant to the system and the controls within that system;
      2. additional information that the assurance practitioner may request from the responsible party for the purposes of the assurance engagement; and
      3. unrestricted access to persons within the entity from whom the assurance practitioner determines it necessary to obtain evidence;
   6. if controls are designed to be operated by a third party, service or sub-service organisation, which may be material to the engagement, to obtain either:
      1. a reasonable or limited assurance report, as appropriate, on the design and, if included in the scope of the engagement, the description of controls and/or implementation or operating effectiveness of controls, which covers the relevant controls at the third party; or
      2. access to all information relevant to the design, description, implementation and/or operation of those controls, any additional information requested and access to persons from whom to obtain evidence at the third party.

The terms of engagement shall identify: (Ref: Para. A28-A36)

1. the purpose of the engagement;
2. whether the engagement is a reasonable or limited assurance engagement;
3. whether the engagement is an attestation or direct engagement and, in the case of an attestation engagement, the form of the responsible party’s or evaluator’s evaluation of the controls or Statement and whether that Statement will be available to intended users or only referenced in the assurance report;  (Ref: Para. A28)
4. the subject matter of the engagement, including identification of the system and the component/s of control to be addressed and the functional and physical boundaries of that system and whether the subject matter includes description, implementation or operating effectiveness of controls, in addition to design; (Ref: Para. A29-A31, A34)
5. the date or time period to be covered by the engagement; (Ref: Para. A32)
6. if a third party operates controls on behalf of the entity which are integral to the system included in the scope of the assurance engagement, whether the inclusive or carve-out method has been used in relation to those third party controls;
7. the criteria against which the design of controls will be assessed, expressed either as control objectives or as the overall objectives which those control objectives seek to address, including the source of those objectives or the party who is to provide or develop those objectives; (Ref: Para. A33-A34)
8. the intended users of the assurance report;
9. the content of the assurance report, including whether it will be a short-form or long‑form report, including additional information such as the specific control objectives, the related controls, tests of controls conducted or detailed findings; and (Ref: Para. A35-A36)
10. any other matters required by law or regulation to be included in the terms of engagement.

Acceptance of a Change in the Terms of the Engagement

If the engaging party requests a change in the terms of the engagement before the completion of the engagement, the assurance practitioner shall be satisfied that there is a reasonable justification for the change as required by ASAE 3000.^[24] (Ref: Para. A26, A40-A41)

Assurance Report Prescribed by Law or Regulation

If law or regulation prescribes the criteria for evaluation of the relevant controls or the form and content of the assurance report, the assurance practitioner evaluates the criteria and form and content of the assurance report. If the criteria are unsuitable or if intended users might misunderstand the assurance report, the assurance practitioner shall:

1. not accept the engagement unless additional explanation in the report mitigates these circumstances; or
2. not include any reference within the assurance report to the engagement having been conducted in accordance with ASAE 3000 or this ASAE, if required to accept the engagement by law or regulation.

The assurance practitioner shall implement quality control procedures as required by ASAE 3000.^[25]

The assurance practitioner shall apply professional scepticism, exercise professional judgement and apply assurance skills and techniques in planning and performing an assurance engagement on controls as required by ASAE 3000.^[26] In applying professional scepticism, the assurance practitioner shall recognise the possibility that a deficiency in design, misstatement in the description of the system, deficiency in implementation or deviation in the operating effectiveness of controls due to fraud could exist, notwithstanding the assurance practitioner’s past experience of the honesty and integrity of the entity’s management and those charged with governance.

The assurance practitioner shall discuss with the engagement team how and where the entity’s controls may be susceptible to circumvention due to fraud, including how fraud might occur.  The discussion shall occur setting aside beliefs that the engagement team members may have that management and those charged with governance are honest and have integrity.

Planning

The assurance practitioner shall plan the engagement so that it will be performed in an effective manner as required by ASAE 3000.^[27]  (Ref: Para. A42-A46)

In planning the engagement, if the scope of the engagement is based on overall control objectives, then the assurance practitioner shall identify, select or develop specific control objectives, to achieve the agreed overall control objectives against which the design of controls can be tested.  If a description of the system is included in the scope of the engagement the specific control objectives are ordinarily included in that description.  In an attestation engagement, if there is no description, the specific control objectives ordinarily are identified in documentation on which the responsible party’s Statement is based.  However, in a direct engagement, where the responsible party does not explicitly evaluate the controls for the purposes of the engagement or provide a Statement on the outcome of that evaluation, if there is no description, the assurance practitioner shall take a more active role in identifying, selecting or developing specific control objectives against which to evaluate the design of controls.  (Ref: Para. A44-A45)

The assurance practitioner shall identify the controls relevant to the achievement of each specific control objective, which are either, identified in the terms of the engagement, or identified, selected or developed in planning the engagement under paragraph 32.

Materiality

The assurance practitioner shall consider materiality, as required by ASAE 3000,^[28] when determining the nature, timing and extent of procedures.

The assurance practitioner shall identify a control or combination of controls as material if it is fundamental to the achievement of a control objective, included in the scope of the engagement, by mitigating the risks that threaten achievement of that objective.  During the engagement the assurance practitioner shall reassess the materiality of the controls if matters come to their attention which indicate that the basis on which the materiality of those controls was determined has changed.  (Ref: Para. A47-A52)

The assurance practitioner shall also consider materiality when evaluating the effect of accumulated deficiencies in the design, and if applicable, misstatements in the description of the system, deficiencies in implementation or deviations in operating effectiveness of controls as designed.  Material deficiencies, misstatements and deviations are those which could reasonably be expected to influence relevant decisions of the intended users. (Ref: Para. A49-A50)

Obtaining an Understanding of the Entity’s System and Other Engagement Circumstances and Identifying and Assessing Risks of Material Misstatement

The assurance practitioner shall obtain an understanding of the system, including controls, or the control components within the system that are included in the scope of the engagement, and other engagement circumstances, and on the basis of that understanding, the assurance practitioner shall: (Ref: Para. A53-A55)

1. for a direct engagement, consider whether the identification, selection or development of control objectives is appropriate, and/or select or develop further suitable control objectives; and
2. for both attestation and direct engagements:
   1. identify the risks that threaten achievement of the control objectives;
   2. identify the controls designed to mitigate those risks;
   3. identify and assess the risk that: (Ref: Para. A56-A66)
      1. the controls are not suitably designed to achieve the control objectives identified;
      2. the description (if included in the scope of the engagement) does not fairly present the system as designed;
      3. the controls were not implemented (if included in the scope of the engagement) as designed; and
      4. the controls were not operating effectively (if included in the scope of the engagement) throughout the period; and
   4. identify the characteristics of the controls identified as a basis for designing assurance procedures to respond to the risks identified in paragraph 37(b)(iii).

When understanding the system within which the controls operate, the assurance practitioner shall consider other components of control beyond the components being reported upon, which may impact on the design, implementation or operating effectiveness of those controls.  (Ref: Para. A67-A69)

Identifying Risks of Fraud

When performing risk assessment procedures and related activities to obtain an understanding of the system and other engagement circumstances, the assurance practitioner shall perform the following procedures, to obtain information for use in identifying the risks of the control objectives not being achieved due to fraud: (Ref: Para. A70)

1. make enquiries of management regarding:
   1. management’s assessment of the risk that controls may be circumvented due to fraud, including the nature, extent and frequency of such assessment;
   2. management’s process for identifying and responding to the risks of fraud;
   3. management’s communication, if any, to those charged with governance regarding its processes for identifying and responding to the risks of fraud; and
   4. management’s communication, if any, to employees regarding its views on corrupt or fraudulent business practices and unethical behaviour;
2. make enquiries of those charged with governance, management, and others within the entity as appropriate, to determine whether they have knowledge of any actual, suspected or alleged fraud affecting the entity;
3. make enquiries of the internal audit function, where it exists, to determine whether it has knowledge of any actual, suspected or alleged fraud affecting the entity, and to obtain its views about the risks of fraud;
4. obtain an understanding of how those charged with governance exercise oversight of management’s processes for identifying and responding to the risks of fraud in the entity and the internal control that management has established to mitigate these risks;
5. consider whether other information obtained by the assurance practitioner indicates risks of control objectives not being achieved due to fraud, for which mitigating controls are necessary;
6. evaluate whether the information obtained from the other risk assessment procedures and related activities performed indicates that one or more fraud risk factors are present; and
7. identify controls over matters for which decisions or actions are not routine, such as adjustments to records, development of estimates and activities outside the normal course of business.

Obtaining an Understanding of the Internal Audit Function

In planning the engagement, the assurance practitioner shall determine whether the entity has an internal audit function. If so the assurance practitioner shall obtain an understanding of the internal audit function and perform a preliminary assessment regarding: (Ref: Para. A71)

1. its impact on the system and the components of control within that system, including the control environment, risk assessment, information and communication, monitoring activities and control activities in relation to the system; and
2. its effect on procedures to be performed by the assurance practitioner.

If the assurance practitioner plans to use the work of the internal audit function, in accordance with paragraph 40, the assurance practitioner shall evaluate it as required by ASAE 3000.^[29]  (Ref: Para. A72)

The use of internal auditors to provide direct assistance is prohibited in an assurance engagement conducted in accordance with this ASAE. Direct assistance is the performance of assurance procedures under the direction, supervision and review of the assurance practitioner.^[30]  This prohibition does not preclude reliance on the work of the internal audit function to modify the nature or timing, or reduce the extent, of assurance procedures to be performed directly by the assurance practitioner.  (Ref: Para. A71)

Determining Whether and to What Extent to Use the Work of the Internal Audit Function

If the assurance practitioner’s evaluation of the internal audit function confirms that the work of the internal audit function can be used for purposes of the engagement, then the assurance practitioner shall determine the planned effect of the work of the internal audit function on the nature, timing or extent of the assurance practitioner’s procedures and in doing so, shall consider: (Ref: Para. A72)

1. the nature and scope of work performed, or to be performed, on controls within the system by the internal audit function;
2. the significance of that work to the assurance practitioner’s conclusions; and
3. the degree of subjectivity involved in the evaluation of the evidence obtained in support of those conclusions.

Documentation of the System

When obtaining an understanding of the system, if a description of the system is not prepared by the responsible party, the assurance practitioner shall document the system, to the extent considered appropriate as a basis for planning the engagement, which ordinarily includes identification of:

1. the control objectives; and
2. the controls designed to achieve those objectives.

Based on the assurance practitioner’s understanding obtained under paragraph 37 the assurance practitioner shall perform assurance procedures to respond to assessed risks identified in paragraph 37(b)(iii) to obtain limited or reasonable assurance to support the assurance practitioner’s conclusion. (Ref: Para. A73-A77)

The assurance practitioner shall design and perform additional procedures, the nature, timing and extent of which are responsive to the risks of material deficiency in the design, misstatement in the description, deficiency in the implementation or deviation in operating effectiveness of controls, having regard to the level of assurance required, reasonable or limited, as appropriate.  (Ref: Para. A77)

Responses to Assessed Risks of Fraud

The assurance practitioner shall treat those assessed risks of control objectives not being achieved due to fraud as significant risks and accordingly, the assurance practitioner shall design and perform further assurance procedures, on controls designed to mitigate such risks, whose nature, timing and extent are responsive to those assessed risks, having regard to the level of assurance required, reasonable or limited, as appropriate.

Obtaining Evidence Regarding the Design of Controls

The assurance practitioner shall determine which of the controls at the entity are necessary to achieve the control objectives, whether those controls are presented in the entity’s description of its system or identified by the assurance practitioner, and shall assess whether those controls were suitably designed. This determination shall include: (Ref: Para. A78-A84)

1. identifying the risks that threaten achievement of the control objectives;
2. evaluating whether the controls as designed would be sufficient to mitigate those risks when operating effectively, in all material respects; and
3. for engagements over a period, evaluating whether any changes in controls as designed during the period would be sufficient to mitigate those risks, in all material respects.

Obtaining Evidence Regarding the Description

If the scope of the engagement includes assurance on the entity’s description of the system, the assurance practitioner shall obtain and read that description, and shall evaluate whether those aspects of the description included in the scope of the engagement are fairly presented, including whether: (Ref: Para. A86)

1. the functions and services of the system are adequately identified;
2. the geographic, operational or functional boundaries of the system are appropriate in the circumstances of the engagement;
3. the date or time period covered by the description is appropriate;
4. the components of control covered by the description are appropriate for the scope of the engagement;
5. controls are described in sufficient detail to enable them to be identified for testing;
6. in the case of a report covering operating effectiveness of controls, changes to the system or to controls during the period covered by the description are described adequately;
7. the description does not omit or distort information relevant to the scope of the system or the controls being described;
8. in the case of a service organisation, complementary user entity or client controls necessary to achieve the control objectives, are adequately described, including their importance in achieving the relevant objectives; (Ref: Para. A87)
9. controls are described as designed and, if included in the scope of the engagement, as implemented; and
10. functions outsourced to a third party or service organisation, if any, are adequately described, including whether the inclusive method or the carve‑out method has been used in relation to them.

Obtaining Evidence Regarding Implementation of Controls

If implementation is included in the scope of the engagement, the assurance practitioner shall obtain sufficient appropriate evidence that the controls identified as necessary to achieving the identified control objectives, were implemented as designed as at the specified date.  Consequently, the assurance practitioner’s evaluation of the design of controls often influences the nature, timing and extent of tests of implementation.  (Ref: Para. A89-A90)

When designing and performing tests of implementation, the assurance practitioner shall determine whether controls implemented depend upon other controls (indirect controls) and, if so, whether it is necessary to obtain evidence supporting the implementation of those indirect controls.

Obtaining Evidence Regarding Operating Effectiveness of Controls

When reporting on operating effectiveness over the period, the assurance practitioner shall test those controls that the assurance practitioner has determined are necessary to achieve the control objectives identified, and assess their operating effectiveness throughout the period.  Consequently, the assurance practitioner’s evaluation of the design of controls often influences the nature, timing and extent of tests of operating effectiveness.  Evidence obtained in prior engagements about the satisfactory operation of material controls in prior periods does not provide a basis for a reduction in testing of those controls, even if it is supplemented with evidence obtained during the current period.  (Ref: Para. A91-A95, A104)

If a material control did not operate during the period, because the circumstances necessary to trigger that control did not arise, the assurance practitioner shall conclude that the controls, necessary to achieve the control objectives, operated effectively as designed if the assurance practitioner obtained sufficient appropriate evidence that the circumstances necessary to trigger the control were adequately monitored by the entity and those circumstances did not arise during the period.  (Ref: Para. A100)

Where control procedures have changed during the period subject to examination, the assurance practitioner shall test the operating effectiveness of both the superseded control(s) and the new control(s) and consider whether the new controls have been in place for a sufficient period to assess their effectiveness.

Sampling

When the assurance practitioner uses sampling to select controls for testing operating effectiveness over a period, the assurance practitioner shall: (Ref: Para. A102-A107)

1. consider the purpose of the procedure and the characteristics of the controls from which the sample will be drawn when designing the sample;
2. determine a sample size sufficient to reduce sampling risk to an acceptably low level;
3. select items for the sample in such a way that each sampling unit in the population has a chance of selection and the sample is representative of the population; and
4. if unable to apply the designed procedures, or suitable alternative procedures, to a selected item, treat that item as a deviation.

Evaluating the Evidence Obtained

ASAE 3000^[31] requires the assurance practitioner to accumulate uncorrected misstatements identified during the engagement other than those that are clearly trivial. Misstatements in an engagement on controls include:

1. deficiencies in the suitability of the design of controls to achieve the control objectives;
2. misstatements in the description of the system;
3. deficiencies in the implementation of controls as designed; and
4. deviations in the operating effectiveness of controls as designed.

Deficiencies in Design of Controls

Where the assurance practitioner is unable to identify controls which are suitable or controls as designed are not suitable to achieve the identified control objective/s, this shall constitute a deficiency in the design of controls.  The assurance practitioner shall accumulate deficiencies in the design of controls, other than those which are clearly trivial, and identify any compensating controls in the design which may mitigate those deficiencies in achieving the identified control objectives.  The existence of compensating controls may be identified during the course of the engagement even if they were not identified in the design at the outset.  The assurance practitioner shall assess the design deficiencies and determine whether they have a material impact on achieving the control objectives on which the assurance practitioner is required to conclude.

Misstatements in the Description of the System

If misstatements, such as insufficient detail to meet the needs of users or controls are described differently to the controls designed, are identified by the assurance practitioner in the description of the system, the assurance practitioner shall advise the responsible party of those inaccuracies, inadequacies or omissions, other than those which are clearly trivial.  The assurance practitioner shall provide the responsible party with the opportunity to amend the description, unless prohibited by legislation or the terms of the engagement, so that it reflects the system as designed at a point in time and/or during the period. 

If the responsible party declines to amend the description when misstatements are identified,  the assurance practitioner shall consider the materiality of the misstatements and their impact on the assurance conclusion.  If the assurance conclusion is to be modified with respect to the fair presentation of the description of the system, the assurance practitioner shall consider whether the description can provide a basis for testing the design, implementation or operating effectiveness of the system.

Deficiencies in Implementation of Controls

The assurance practitioner shall accumulate any deficiencies in implementation of controls as designed, identified during the engagement, other than those which are clearly trivial, and assess whether the combined deficiencies will have a material impact on the implementation of controls as designed.

Deviations in Operating Effectiveness of Controls

The assurance practitioner shall investigate the nature and cause of any deviations from the design identified in the operation of the controls, other than those which are clearly trivial, and shall determine whether: (Ref: Para. A108-A109)

1. identified deviations are within the expected rate of deviation and are acceptable; therefore, the testing that has been performed provides an appropriate basis for a reasonable or limited assurance conclusion, as applicable, that the control operated effectively throughout the period;
2. additional testing of the control or of other compensating or indirect controls is necessary to reach a reasonable or limited assurance conclusion, as applicable, on whether the controls relative to a particular control objective operated effectively throughout the period; or
3. the testing that has been performed provides an appropriate basis for a reasonable or limited assurance conclusion, as applicable, that the control/s did not operate effectively throughout the period. 

In the extremely rare circumstances when the assurance practitioner considers a deviation discovered in a sample to be an anomaly and no other deviations have been identified that lead the assurance practitioner to conclude that the relevant control is not operating effectively throughout the period, the assurance practitioner shall obtain a high degree of certainty that such deviation is not representative of the population.  The assurance practitioner shall obtain this degree of certainty by performing additional procedures to obtain sufficient appropriate evidence that the deviation is anomalous.

The assurance practitioner shall accumulate deviations in the operating effectiveness of controls identified during the engagement, other than those which are clearly trivial, and identify any compensating controls which may mitigate those deviations.

The assurance practitioner shall assess the impact of the combined control deviations and determine whether they will have a material impact on the operation of the system as designed in achieving the identified control objectives.  (Ref: Para. A108-A109)

Indication of Fraud

If the assurance practitioner identifies a misstatement in the description, deficiency in the design or implementation of a control or a deviation in the operating effectiveness of that control, the assurance practitioner shall evaluate whether such a misstatement, deficiency or deviation is indicative of fraud.  If there is such an indication, the assurance practitioner shall respond appropriately. (Ref: Para. A110)

If the assurance practitioner confirms that, the controls are not suitably designed, the description is materially misstated, the controls were not implemented as designed or did not operate effectively throughout the period or is unable to reach a conclusion, as a result of fraud the assurance practitioner shall modify the assurance conclusion accordingly.

Non-compliance with Laws or Regulations

If the assurance practitioner becomes aware of information concerning an instance of non‑compliance or suspected non-compliance with respect to laws and regulations, whether due to the controls themselves not meeting compliance requirements or a failure of controls to prevent or detect non-compliance by the entity, the assurance practitioner shall:

1. discuss the matter with management and, if those matters are intentional or material, those charged with governance, unless management or those charged with governance are suspected of involvement in the non‑compliance, in which case a level of authority above those suspected of involvement;
2. determine whether the assurance practitioner has a responsibility to report the identified or suspected non-compliance to parties outside of the entity and, if necessary, seek legal advice;
3. if sufficient information regarding suspected non-compliance cannot be obtained, evaluate the effect of insufficient evidence on the assurance report;
4. evaluate the implications of non-compliance in relation to other aspects of the engagement, including the risk assessment and the reliability of written representations; and
5. consider the impact on the assurance practitioner’s conclusion of identified non‑compliance.

When the assurance practitioner plans to use the work of an assurance practitioner’s expert, the assurance practitioner shall comply with the requirements in ASAE 3000.^[32]  (Ref: Para. A111)

If the assurance practitioner plans to use information prepared using the work of another assurance practitioner or a responsible party’s or evaluator’s expert, as evidence, the assurance practitioner shall comply with the requirements of ASAE 3000.^[33]  (Ref: Para. A112-A113)

Using the Work of the Internal Audit Function

In order for the assurance practitioner to use specific work of the internal audit function, the assurance practitioner shall determine its adequacy for the assurance practitioner’s purposes in accordance with ASAE 3000.^[34] In doing so, the assurance practitioner shall evaluate whether: (Ref: Para. A114)

1. the work was performed by internal auditors having adequate technical training and proficiency;
2. the work was properly supervised, reviewed and documented;
3. adequate evidence has been obtained to enable the internal auditors to draw reasonable conclusions;
4. conclusions reached are appropriate in the circumstances and any reports prepared by the internal auditors are consistent with the results of the work performed; and
5. exceptions relevant to the engagement or unusual matters disclosed by the internal auditors are properly resolved.

Although the assurance practitioner may consider the results of any tests of the operating effectiveness of controls conducted by the internal audit function when evaluating operating effectiveness, the assurance practitioner shall remain responsible for obtaining sufficient appropriate evidence to support the assurance practitioner’s conclusion and, if appropriate, corroborate the results of such tests.  When evaluating whether sufficient appropriate evidence has been obtained, the assurance practitioner shall consider that evidence obtained through direct personal knowledge, observation, re-performance and inspection is more persuasive than information obtained indirectly, from internal audit or from management or other entity personnel. Further, judgements about the sufficiency and appropriateness of evidence obtained and other factors affecting the assurance practitioner’s conclusion, such as the materiality of identified control deficiencies or deviations, shall be those of the assurance practitioner.  (Ref: Para. A114)

Effect on the Assurance Report

If the work of the internal audit function has been used, the assurance practitioner shall make no reference to that work in the section of the assurance report that contains the assurance practitioner’s conclusion.  (Ref: Para. A115)

The assurance practitioner shall request the responsible party, or other relevant person(s) within the entity, and any third party or service organisation(s), who are responsible for material controls for which the inclusive method has been used, to provide written representations, in addition to those required by ASAE 3000,^[35] that the responsible party (or third party or service organisation, as applicable):

1. in the case of an attestation engagement, reaffirms their Statement regarding the outcome of the responsible party’s evaluation of the controls against the control objectives with respect to the suitability of the design, and if included in the scope of the engagement, fair presentation of the description, implementation as designed and/or operating effectiveness, at a point in time or throughout the period as appropriate;
2. acknowledges its responsibility for establishing and maintaining the entity’s system, including identifying the risks that threaten achievement of the identified control objectives, and designing, implementing and maintaining controls to mitigate those risks, including the risk of fraud, so that those risks will not prevent achievement of the control objectives and therefore that the identified control objectives will be achieved;
3. has provided the assurance practitioner with all relevant information and access agreed to, as set out in paragraph 24(b)(v);
4. has disclosed to the assurance practitioner any of the following of which it is aware may be relevant to the engagement:
   1. deficiencies in the design of controls to achieve the identified control objectives;
   2. uncorrected misstatements, including omissions, in the description of the system;
   3. deficiencies in the implementation of controls as designed;
   4. instances where controls have not operated effectively as designed, including instances of non-compliance or suspected non-compliance with laws and regulations, fraud or suspected fraud;
   5. any events subsequent to the period covered by the assurance practitioner’s report up to the date of the assurance report that could have a significant effect on the assurance practitioner’s report; and
   6. The identity of any third parties who operate controls on behalf of the entity, which form part of the system, and whether the carve-out method or inclusive method has been used in the description in relation to those controls and related control objectives.

The assurance practitioner shall evaluate written representations in accordance with ASAE 3000.^[36]  (Ref: Para. A116-A118)

Assurance procedures required to be conducted under ASAE 3000,^[37] to identify all matters up to the date of the assurance report that may have caused the assurance practitioner to amend the assurance report on the design and/or description, implementation or operating effectiveness of controls, shall include enquiry as to whether the responsible party is aware of any events subsequent to the period covered by the assurance engagement up to the date of the assurance practitioner’s report that may have caused the assurance practitioner to amend the assurance report.  If the assurance practitioner is aware of such an event, remedial action is either not taken or is not effective in mitigating the impact on the assurance conclusion and information about that event is not disclosed by the responsible party, the assurance practitioner shall disclose the subsequent event in the assurance practitioner’s report.  If the event may impact the assurance conclusion, the assurance practitioner shall gather further evidence sufficient to determine whether the assurance conclusion remains appropriate or a modified assurance conclusion is required.  (Ref: Para. A119-A123)

When any documents, that the assurance practitioner is aware of will contain the assurance practitioner’s report on controls, also include other information, the assurance practitioner shall read that other information and respond to any material inconsistencies identified with the entity’s system or an apparent misstatement of fact, in accordance with ASAE 3000.^[38] (Ref: Para. A124-A126)

The assurance practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary, attempt to obtain further evidence. If the assurance practitioner is unable to obtain necessary further evidence, the assurance practitioner shall consider the implications for the assurance practitioner’s conclusion in accordance with ASAE 3000.^[39] The assurance practitioner shall qualify their conclusion if the possible effects of undetected misstatements, deficiencies or deviations due to an inability to obtain sufficient appropriate evidence could be material, and shall disclaim their conclusion if the possible effects could be both material and pervasive.

When the assurance practitioner forms a conclusion in accordance with ASAE 3000,^[40] the assurance practitioner shall evaluate the materiality, individually and in aggregate whether due to fraud or error, of any: (Ref: Para. A127)

1. deficiencies in the design of controls to achieve the identified control objectives;
2. uncorrected misstatements in the description of the system;
3. deficiencies in the implementation of controls as designed; and
4. deviations in the operating effectiveness of controls.

The assurance practitioner shall identify any compensating or indirect controls which may mitigate the deficiencies or deviations identified and impact on the evaluation of material deficiencies or deviations.

The assurance practitioner shall assess the impact of uncorrected deficiencies in the design, misstatements in the description, deficiencies in the implementation or deviations in operating effectiveness of controls, which are material individually or in combination, on the assurance practitioner’s conclusion on the suitability of the design of the controls, and/or fair presentation of the description, implementation as designed or operating effectiveness of controls. If the deficiencies or deviations identified are: (Ref: Para. A127-A128)

1. material but not pervasive, the assurance practitioner shall qualify their assurance conclusion with respect to the relevant matter; or
2. material and pervasive, the assurance practitioner shall issue an adverse conclusion.  If those material and pervasive deficiencies relate to the design, the assurance practitioner shall issue a modified report without performing any tests of operating effectiveness, as any conclusion on the operating effectiveness of controls based on an unsuitable design may be misleading.

The assurance practitioner shall prepare the assurance report in accordance with ASAE 3000^[41] for attestation engagements and shall also apply those requirements for direct engagements.

Assurance Report Content

For both attestation and direct engagements, the assurance practitioner shall include in the assurance report the basic elements required by ASAE 3000,^[42] which are at a minimum: (Ref: Para. A139)

1. a title, indicating that it is an independent assurance report;
2. an addressee;
3. an identification of whether reasonable or limited assurance has been obtained by the assurance practitioner;
4. identification of the controls which comprise the underlying subject matter of the engagement including:
   1. the distinguishing features of the system, boundaries of the system and the control components within that system which was subject to the assurance engagement;
   2. the date/s or period covered by the assurance engagement;
   3. the description of the system, if included in the scope of the engagement, and any parts of the description that are not covered by the assurance practitioner’s conclusion;
   4. in the case of an attestation engagement, reference to the responsible party’s Statement as required by paragraph 24(a)(i) and whether that Statement is available to intended users by accompanying the assurance report, reproduction in the assurance report or another identified source;
   5. if functions relevant to the system of controls are performed by a third party:
      1. the nature of activities performed by the third party and whether the inclusive method or the carve‑out method has been used in relation to the relevant controls operating at the third party;
      2. where the carve‑out method has been used, a statement that the assurance engagement excludes the control objectives and related controls at relevant third parties, and that the assurance practitioner’s procedures did not extend to controls at the third party; and
      3. where the inclusive method has been used, a statement that the assurance engagement includes control objectives and related controls at the third party, and that the assurance practitioner’s procedures extended to controls at the third party.
5. identification of the overall and/or specific control objectives used as criteria for evaluating the design of controls and the party specifying those control objectives; (Ref: Para. A132)
6. if appropriate, a description of any significant inherent limitations associated with the evaluation of the design of the controls against the control objectives;
7. when the control objectives are designed for a specific purpose, a statement alerting users to this fact and that, as a result, the description and/or responsible party’s or evaluator’s Statement may not be suitable for another purpose;  (Ref: Para. A133-A134, A140)
8. a statement that the responsible party or evaluator is responsible for:
   1. in an attestation engagement:
      1. providing a Statement with respect to the outcome of the evaluation of the design against the identified control objectives, and, as applicable, the description, implementation and/or operating effectiveness of controls against the design;
      2. identifying the control objectives (where not identified by law or regulation, or another party, for example, a user group or a professional body); and
   2. in both an attestation and a direct engagement:
      1. the functions or services within the entity’s system covered by the assurance practitioner’s report;
      2. preparing the description of the entity’s system, if included in the scope of the engagement, including the completeness, accuracy and method of presentation of that description; and
      3. designing and, if included in the scope of the engagement, implementing or operating effectively controls to achieve the control objectives relevant to the entity’s system;
9. a statement that the assurance practitioner’s responsibility is to express a conclusion on the design of controls related to the overall and/or specific control objectives relevant to the entity’s system, and, if included in the scope of the engagement:
   1. the entity’s description of the system;
   2. the implementation of the controls as designed; and/or
   3. the operating effectiveness of those controls;
10. a statement that the engagement was performed in accordance with ASAE 3150 Assurance Engagements on Controls;
11. a statement that the firm of which the assurance practitioner is a member applies ASQC 1;
12. a statement that the assurance practitioner complies with the independence and other relevant ethical requirements related to assurance engagements;
13. a summary of the work performed by the assurance practitioner to obtain reasonable or limited assurance and a statement of the assurance practitioner’s belief that the evidence obtained is sufficient and appropriate to provide a basis for the assurance practitioner’s conclusion, and, if applicable, a statement that the assurance practitioner has not performed any procedures regarding the implementation or operating effectiveness of controls and therefore no conclusion is expressed thereon.  In the case of a limited assurance engagement, in which an appreciation of the nature, timing, and extent of procedures performed is essential to understanding the assurance practitioner’s conclusion, the summary of the work performed shall state that: (Ref: Para. A135-A138)
    1. the procedures performed in a limited assurance engagement vary in nature and timing from, and are less in extent than for, a reasonable assurance engagement; and
    2. consequently, the level of assurance obtained in a limited assurance engagement is substantially lower than the assurance that would have been obtained had a reasonable assurance engagement been performed;
14. a statement of the limitations of controls and, if applicable, of the risk of projecting to other periods the outcome of any evaluation of the operating effectiveness of controls; (Ref: Para. A129)
15. either, the assurance practitioner’s opinion for a reasonable assurance engagement or the assurance practitioner’s conclusion for a limited assurance engagement about whether, in all material respects:
    1. for a report on design of controls:
       1. the controls were suitably designed to achieve the identified control objectives; and
       2. if included in the scope of the engagement, the description fairly presents the system as designed;
    2. as at a specified date
    3. for a report on design and implementation of controls:
       1. the controls were suitably designed to achieve the identified control objectives;
       2. if included in the scope of the engagement, the description fairly presents the system as designed; and
       3. the controls, necessary to achieve the control objectives, were implemented as designed;
    4. as at a specified date;
    5. for a report on design and operating effectiveness of controls:
       1. the controls were suitably designed to achieve the identified control objectives;
       2. if included in the scope of the engagement, the description fairly presents the system as designed; and
       3. the controls, necessary to achieve the control objectives, operated effectively as designed;
    6. throughout the period;
    7. when the assurance practitioner expresses a modified conclusion, the assurance report shall contain:
       1. a section (entitled: Basis for Qualified/Adverse/Disclaimer of Conclusion/Opinion) that provides a description of the matter(s) giving rise to the modification; and
       2. a section that contains the assurance practitioner’s modified conclusion;
16. the assurance practitioner’s signature, the date of the assurance report and the location in the jurisdiction where the assurance practitioner practices.

If the assurance practitioner is required to provide a long-form assurance report to meet the information needs of users, as agreed in the terms of engagement, or as required by law or regulation, the assurance practitioner’s report shall include a separate section, or an attachment, containing any other information and explanations that are not intended to affect the assurance practitioner’s conclusion and are clearly identified as such.  (Ref: Para. A130-A131)

If the assurance practitioner is required to conclude on other subject matters under different AUASB standards in conjunction with an engagement to report under this ASAE, the assurance report shall include a separate section for each subject matter in the assurance report, clearly differentiated by appropriate section headings.

Emphasis of Matter and Other Matter Paragraphs

The assurance practitioner shall include an Emphasis of Matter or Other Matter paragraph in the circumstances provided for in ASAE 3000^[43] for an attestation engagement.  In a direct engagement, if the assurance practitioner considers it necessary to communicate a matter that, in the assurance practitioner’s judgement, is relevant to intended users’ understanding of the engagement, the assurance practitioner’s responsibilities or the assurance report, the assurance practitioner shall include in the assurance report an Other Matter paragraph, with an appropriate heading, that clearly indicates the assurance practitioner’s conclusion is not modified in respect of the matter. (Ref: Para. A122-A123, A149)

Modified Conclusions

If the assurance practitioner concludes that:

1. the controls were not suitably designed to achieve the control objectives, in all material respects;
2. the entity’s description does not fairly present, in all material respects, the system as designed;
3. the controls were not implemented as designed, in all material respects;
4. the controls tested, which were those necessary to achieve the control objectives, did not operate effectively, in all material respects throughout the period; or
5. the assurance practitioner is unable to obtain sufficient appropriate evidence;

the assurance practitioner’s conclusion shall be modified, and the assurance practitioner’s report shall include a section with a clear description of all the reasons for the modification.  (Ref: Para. A141-A148)

Scope Limitation

A limitation on the scope of the assurance practitioner’s work may be imposed by the terms of the engagement or by the circumstances of the particular engagement. When the limitation is imposed by the terms of the engagement, and the assurance practitioner believes that an inability to form an opinion or reach a conclusion would need to be expressed, the engagement shall not be accepted or continued past the current period, unless required to do so by law or regulation.

When a scope limitation is imposed by the circumstances of the particular engagement, the assurance practitioner shall attempt to perform alternative procedures to overcome the limitation.  When a scope limitation exists and remains unresolved, the wording of the assurance practitioner’s conclusion shall indicate that it is qualified as to the effects of any evidence that the controls are not suitably designed, the description is not fairly presented, the controls are not implemented as designed or not operating effectively, which might have been identified had the limitation not existed.  If the effect of the unresolved scope limitation is both material and pervasive, the assurance practitioner shall express a disclaimer of conclusion.  (Ref: Para. A148)

The assurance practitioner shall consider whether, pursuant to the terms of the engagement and other engagement circumstances, any matter has come to the attention of the assurance practitioner that is to be communicated with the responsible party, the evaluator, the engaging party, those charged with governance or others, as required by ASAE 3000.^[44] If during the course of the engagement the assurance practitioner identifies any control design deficiencies, deficiencies in implementation or deviations in operating effectiveness, other than those which are clearly trivial, the assurance practitioner shall report to an appropriate level of management or those charged with governance on a timely basis those control deficiencies or deviations. (Ref: Para. A149-A150)

If the assurance practitioner has identified a fraud or has obtained information that indicates that a fraud may exist, the assurance practitioner shall communicate these matters on a timely basis to the appropriate level of management or those charged with governance in order to inform those with primary responsibility for the prevention and detection of fraud of matters relevant to their responsibilities.  The assurance practitioner shall determine whether there is a responsibility to report the occurrence or suspicion to a party outside the entity.  (Ref: Para. A150)

The assurance practitioner shall design engagement procedures to gather sufficient appropriate evidence to form a conclusion in accordance with the terms of the engagement.  In the absence of a specific requirement in the terms of engagement the assurance practitioner does not have a responsibility to design procedures to identify matters outside the scope of the engagement that may be appropriate to report to management or those charged with governance.

The assurance practitioner shall prepare documentation in accordance with ASAE 3000.^[45] In documenting the nature, timing and extent of procedures performed as required by ASAE 3000, the assurance practitioner shall record: (Ref: Para. A151)

1. the identifying characteristics of the controls being tested;
2. who performed the work and the date such work was completed; and
3. who reviewed the work performed and the date and extent of such review.

If the assurance practitioner uses specific work of the internal audit function, the assurance practitioner shall document the conclusions reached regarding the evaluation of the adequacy of the work of the internal audit function, and the procedures performed by the assurance practitioner on that work.