The assurance practitioner shall not represent compliance with this ASAE unless the assurance practitioner has complied with the requirements of this ASAE and the requirements of ASAE 3000 identified in this ASAE as relevant to performance engagements, adapted as necessary for direct engagements.  ASAE 3000 contains requirements and application and other explanatory material specific to attestation assurance engagements but it may also be applied to direct engagements, adapted and supplemented as necessary in the engagement circumstances.^[3]

Inability to Comply with Relevant Requirements

Where in rare and exceptional circumstances, factors outside the assurance practitioner’s control prevent the assurance practitioner from complying with a relevant requirement in this ASAE, the assurance practitioner shall:

1. if possible, undertake appropriate alternative evidence-gathering procedures; and
2. document in the working papers:
   1. the circumstances surrounding the inability to comply;
   2. the reasons for the inability to comply; and
   3. justification of how alternative evidence-gathering procedures achieve the objectives of the relevant requirement.

When the assurance practitioner is unable to undertake appropriate alternative evidence‑gathering procedures, the assurance practitioner shall assess the implications for the assurance report.

As required by ASAE 3000, the assurance practitioner shall comply with relevant ethical requirements related to assurance engagements.^[4] (Ref: Para A5)

The assurance practitioner shall initiate, where the assurance practitioner has the legislative mandate to do so, or accept a performance engagement only when:

1. the assurance practitioner has no reason to believe that relevant ethical requirements, including independence, will not be satisfied;
2. the assurance practitioner is satisfied that those persons who are to perform the engagement collectively have the appropriate competence and capabilities;
3. the preconditions for an assurance engagement are present, as required by ASAE 3000;^[5] and
4. the basis on which the engagement is to be performed has been communicated and where relevant, agreed by the assurance practitioner and either:
   1. the engaging party, in written terms of engagement, including the assurance practitioner’s reporting responsibilities; or
   2. the responsible party, in an engagement initiated by the assurance practitioner where there is no engaging party, by issuing a written communication advising the responsible party of the planned engagement.

Preconditions for the Assurance Engagement

When establishing whether the preconditions for an assurance engagement are present, the assurance practitioner shall determine, based on their preliminary knowledge of the performance engagement circumstances, whether: (Ref: Para A6-A12)

1. the activities (underlying subject matter) which are to be evaluated are appropriate;
2. the criteria identified, selected or developed by the assurance practitioner or agreed with the engaging party are suitable in evaluating the activities, including that they exhibit the characteristics of suitable criteria,^[6] and will be available to users;
3. the assurance practitioner expects to be able to obtain the evidence needed to support the assurance practitioner’s conclusion, which will be contained in a written report; and
4. the engagement has a rational objective.

When identifying, selecting or developing suitable criteria or determining whether the identified criteria selected by the engaging party are suitable, the assurance practitioner shall consider whether the identified criteria are reasonable quantitative or qualitative measures of performance against which the activity’s performance may be assessed. Suitable criteria for a performance engagement shall reflect the overall objective/s, the assertions to be addressed (economy, efficiency and/or effectiveness) and have the following characteristics: (Ref: Para A13-A18)

1. relevance: relevant criteria contribute to conclusions that assist decision-making by the intended users.
2. completeness: criteria are sufficiently complete when relevant factors that could affect the conclusions in the context of the performance engagement circumstances are not omitted.
3. reliability: reliable criteria allow reasonably consistent evaluation or measurement of the activity, including when used in similar circumstances by similarly qualified assurance practitioners.
4. neutrality: neutral criteria contribute to conclusions that are free from bias.
5. understandability: understandable criteria contribute to conclusions that are clear, comprehensive, and not subject to significantly different interpretations.

Agreeing on or Communicating the Terms of the Performance Engagement

If the performance engagement is initiated by an engaging party, the assurance practitioner shall agree the terms of engagement with the engaging party in writing. (Ref: Para A19-A20)

If the performance engagement is initiated by a State, Territory or the Commonwealth Auditor‑General and does not involve an engaging party, then the assurance practitioner shall communicate the terms of engagement with the responsible party. (Ref: Para A21)

The assurance practitioner shall implement quality control procedures as required by ASAE 3000.^[7]

The assurance practitioner shall apply professional scepticism, exercise professional judgement and apply assurance skills and techniques in planning and performing a performance engagement.^[8]

Planning

The assurance practitioner shall plan the performance engagement so that it will be performed in an effective manner as required by ASAE 3000^[9] and achieves the objectives as communicated and/or agreed in the terms of engagement. (Ref: Para A2, A22-A25)

Materiality

The assurance practitioner shall consider materiality when determining the nature, timing and extent of procedures.

The assurance practitioner shall identify any matter relating to the activity as material if it is significant to the performance of the activity in relation to economy, efficiency and/or effectiveness evaluated against the identified criteria.  During the performance engagement the assurance practitioner shall reassess the materiality of any matter if there is any indication that the basis on which the materiality was determined has changed.

The assurance practitioner shall also consider materiality when evaluating the effect of any identified variations, taken individually and in combination, to the performance of the activity as evaluated against the identified criteria.  Material variations are those which could impact performance in relation to economy, efficiency and/or effectiveness and be reasonably expected to influence relevant decisions of the intended users of the assurance report. (Ref: Para A26-A34)

Understanding the Activity and Other Performance Engagement Circumstances

The assurance practitioner shall obtain an understanding of the activity, which is included in the scope of the performance engagement, and other engagement circumstances sufficient to enable the assurance practitioner to be able to identify and assess any risks of material variations in the activity’s performance in relation to economy, efficiency and/or effectiveness as evaluated against the identified criteria. (Ref: Para A35)

In doing so, the assurance practitioner shall obtain an understanding of internal controls the assurance practitioner considers are relevant to the evaluation of the activity’s performance against the identified criteria.  This includes evaluating the design of those controls pertinent to the objective of the performance engagement and, if relevant, determining whether they have been implemented by performing procedures in addition to inquiry of the responsible party. (Ref: Para A36-A39)

The assurance practitioner shall implement non‑compliance with laws and regulations procedures as required by ASAE 3000.^[10]

Based on the assurance practitioner’s understanding obtained in paragraphs 32, 33 and 34 the assurance practitioner shall: (Ref: Para A40-A42)

1. identify and assess the risks of material variation in the activity’s performance to be concluded upon;
2. consider the impact of assessed risks on the appropriateness of the performance engagement objective and the suitability of the identified criteria and, if necessary, seek to amend the objective and/or identified criteria;
3. design and perform assurance procedures to respond to assessed risks identified in paragraph 35(a); and
4. obtain sufficient appropriate evidence to support the assurance practitioner’s conclusion.

Work Performed by an Assurance Practitioner’s Expert

When the assurance practitioner plans to use the work of an assurance practitioner’s expert, the assurance practitioner shall comply with the requirements in ASAE 3000.^[11]

Work Performed by Another Assurance Practitioner, a Responsible Party’s or Evaluator’s Expert or an Internal Auditor

If the assurance practitioner plans to use information prepared by another party as evidence, the assurance practitioner shall comply with the requirements of ASAE 3000.^[12]

Written Representations

The assurance practitioner shall endeavour to obtain written representations, as appropriate for the performance engagement, from the responsible party or parties. (Ref: Para A43-A45)

(Ref: Para A46)

The assurance practitioner shall evaluate the impact of identified variations in the entity’s performance of the activity which are material, individually or in combination, on the assurance practitioner’s conclusion.  The assurance practitioner shall describe the extent and impact of those variations and conclude whether the activity partially performed or did not perform against the identified criteria in the assurance report.^[13] (Ref: Para A46)

When relevant to the performance engagement, the assurance practitioner shall consider the effect on the activity’s performance of events that become known to the assurance practitioner up to the date of the assurance report, and shall respond appropriately to facts that become known to the assurance practitioner after the date of the assurance report, that, had they been known to the assurance practitioner at that date, may have caused the assurance practitioner to amend the assurance report.  The extent of consideration of subsequent events depends on the assurance practitioners’ judgement of the potential for such events to affect the performance of the activity and to affect the appropriateness of the assurance practitioner’s conclusion.  However, the assurance practitioner has no responsibility to perform any procedures regarding performance of the activity after the date of the assurance report. (Ref: Para A47-A48)

The assurance practitioner shall evaluate the sufficiency and appropriateness of the evidence obtained in the context of the performance engagement, and if necessary, attempt to obtain further evidence. If the assurance practitioner is unable to obtain necessary further evidence, the assurance practitioner shall consider the implications for the assurance practitioner’s conclusion.  The assurance practitioner shall state in their conclusion that there was not sufficient or appropriate evidence to conclude whether the activity was free of material variation, in terms of economy, efficiency and/or effectiveness, as evaluated against the identified criteria.^[14]

The assurance practitioner shall form a conclusion about whether the performance of the activity as evaluated against the identified criteria is free of material variation.  In forming that conclusion, the assurance practitioner shall consider the outcomes of procedures performed in paragraphs 39, 40 and 41.

The assurance report shall be in writing and shall contain a clear expression of the assurance practitioner’s reasonable assurance conclusion about the activity’s performance against the objectives communicated and/or agreed in the terms of the performance engagement. (Ref: Para A49)

The assurance practitioner’s conclusion shall be clearly separated from other sections of the assurance report containing information or explanations that are not intended to affect the assurance practitioner’s conclusion, including findings and recommendations. (Ref: Para A52-A54)

Assurance Report Content

The assurance report shall include at a minimum the following base elements, to the extent that it is not inconsistent with relevant legislation or regulation: (Ref: Para A50-A51)

1. a title, indicating that it is an independent assurance report;
2. an addressee;
3. identification of the scope of the performance engagement including:
   1. the responsible party or (parties) and a description of their responsibilities;
   2. the activity which was the subject matter of the performance engagement;
   3. a description of the objective of the performance engagement;
   4. identification of the criteria for evaluating the performance of the activity and the party specifying those criteria, if it was not the assurance practitioner;
   5. if appropriate, a description of any significant inherent limitations associated with the evaluation of the activity’s performance against the identified criteria; and
   6. the assurance practitioner’s responsibilities.
4. a statement that the performance engagement was performed in accordance with ASAE 3500 Performance Engagements;
5. a statement that the assurance practitioner complies with the independence and other relevant ethical requirements related to assurance engagements;
6. a summary of the work performed by the assurance practitioner to obtain reasonable assurance and to provide a basis for the assurance practitioner’s conclusion;
7. the assurance practitioner’s conclusion about the performance, in terms of economy, efficiency and/or effectiveness, of the activity as evaluated against the identified criteria;
8. when the assurance practitioner has been unable to obtain sufficient appropriate evidence or has identified material variations in the activity’s performance in terms of economy, efficiency and/or effectiveness as evaluated against the identified criteria, the assurance report shall contain:
   1. a description of the extent and impact of those matter(s); and
   2. the assurance practitioner’s conclusion that either the activity did not perform in certain material respects, did not perform in all material respects, or there was not sufficient or appropriate evidence to conclude whether the activity was performed.
9. signature of the assurance practitioner, the Audit Office or location in the jurisdiction where the assurance practitioner practices, and the date of the assurance report.

If the assurance practitioner is required to conclude on other subject matters under different AUASB standards in conjunction with an engagement to report under this ASAE, the assurance report shall include a separate section for each subject matter in the assurance report, clearly differentiated by appropriate section headings.

Scope Limitation

A limitation on the scope of the assurance practitioner’s work may be imposed by the terms of the engagement, if the engagement was initiated by an engaging party, or by the circumstances of the particular engagement. When the limitation is imposed by the terms of the engagement, and it is likely to prevent the assurance practitioner from reaching a conclusion, the engagement shall not be accepted, unless required to do so by law or regulation.

When a scope limitation is imposed by the circumstances of the particular engagement, the assurance practitioner shall attempt to perform alternative procedures to overcome the limitation.  When a scope limitation exists and remains unresolved, the wording of the assurance practitioner’s conclusion shall describe the limitations on their engagement and the matters on which they are unable to conclude. (Ref: Para A54-A55)

If during the course of the performance engagement the assurance practitioner identifies any material variations in the activity’s performance, the assurance practitioner shall report those variations to the responsible party(ies) on a timely basis in order to allow the responsible party sufficient time to investigate and respond to the identified variations.

The assurance practitioner shall consider whether, pursuant to the terms of the performance engagement, if applicable, and other engagement circumstances or legislative requirements, any matter has come to the attention of the assurance practitioner that is to be communicated with Parliament, the responsible party, the engaging party (if applicable) or others, as required by ASAE 3000.^[15]

The assurance practitioner shall determine whether there is a responsibility or legislative requirement for the assurance practitioner to report the occurrence or suspicion of fraud or other misconduct to a party outside the entity, including Parliament, a regulator or government agency.  Any such reporting shall be in accordance with the relevant legislation.

The assurance practitioner shall prepare documentation in accordance with ASAE 3000.^[16] In documenting the nature, timing and extent of procedures performed as required by ASAE 3000, the assurance practitioner shall record: (Ref: Para A56-A58)

1. the identifying characteristics of the activity’s performance being tested;
2. who performed the work and the date such work was completed; and
3. who reviewed the work performed and the date.