CPA Exam AUD: Compliance and Attestation Engagements

Compliance and Attestation Engagements: CPA Exam AUD Guide

Beyond financial statement audits, CPAs perform various attestation engagements that are tested on the AUD exam. The Statements on Standards for Attestation Engagements (SSAEs), codified as AT-C sections, establish the framework for these engagements. Understanding the types of attestation engagements, the levels of assurance provided, and the reporting requirements is essential.

The Attestation Standards Framework

The AICPA attestation standards provide a framework for engagements in which a CPA is engaged to issue a report on subject matter or an assertion about subject matter that is the responsibility of another party. AT-C Section 105 (Concepts Common to All Attestation Engagements) establishes the general concepts. There are three types of attestation engagements: examination, review, and agreed-upon procedures.

Examination Engagements (AT-C 205)

An examination engagement provides a high level of assurance (the same level as an audit of financial statements). The practitioner obtains sufficient appropriate evidence to express an opinion on the subject matter or the responsible party's assertion. The opinion is expressed in positive form (for example, "In our opinion, [the subject matter] is presented fairly, in all material respects, based on [criteria]"). Examination engagements can cover a wide range of subject matter, including compliance with specified requirements, the effectiveness of internal control over financial reporting (outside the integrated audit context), prospective financial information, and other subject matter where suitable criteria exist.

The practitioner must establish an understanding with the client (engagement letter), assess the suitability of the criteria used to evaluate the subject matter, perform procedures sufficient to reduce attestation risk to an appropriately low level, and issue a report expressing an opinion. Examination reports are generally for general use (not restricted).

Review Engagements (AT-C 210)

A review engagement provides limited assurance (the same conceptual level as a review of financial statements). The practitioner performs procedures that are primarily inquiries and analytical procedures to obtain limited assurance that no material modifications should be made to the subject matter or assertion. The conclusion is expressed in negative assurance form (for example, "Based on our review, we are not aware of any material modifications that should be made to [the assertion]"). Review engagements require less evidence than examinations but more than agreed-upon procedures. Review reports are generally for general use.

Agreed-Upon Procedures Engagements (AT-C 215)

In an agreed-upon procedures (AUP) engagement, the practitioner performs specific procedures that have been agreed upon by the practitioner and specified parties. The practitioner reports the findings (the results of the procedures) without providing an opinion or conclusion. Users of the report draw their own conclusions. The report states the specific procedures performed, the findings, and includes a statement that the practitioner does not express an opinion or conclusion. Under the current standards (effective 2021), AUP reports are no longer restricted to specified parties and can be for general use. The engaging party is responsible for the sufficiency of the agreed-upon procedures.

Compliance Attestation

Compliance attestation engagements involve examining or reviewing an entity's compliance with specified requirements, such as regulatory requirements, contractual obligations, or grant requirements. These engagements are performed under AT-C 315 (Compliance Attestation). The practitioner may examine management's assertion about compliance (providing an opinion) or perform agreed-upon procedures related to compliance.

Key considerations in compliance attestation include identifying the compliance requirements (the criteria), which must be established by a regulatory body, a contractual agreement, or another specified source. The practitioner assesses whether the criteria are suitable and available to the intended users. If the criteria are established by a regulatory body, they are presumed suitable. The practitioner also considers the entity's internal controls over compliance and designs procedures responsive to the assessed risk of material noncompliance.

Prospective Financial Information

AT-C Section 305 covers examination engagements on prospective financial information, which includes financial forecasts (based on expected conditions and expected courses of action) and financial projections (based on hypothetical assumptions, or "what if" scenarios). A forecast may be examined and a general-use report issued. A projection may be examined, but the report should be restricted to specified parties because understanding the hypothetical assumptions is necessary for proper interpretation. The practitioner evaluates the assumptions underlying the prospective information, performs procedures to test the preparation of the information, and issues a report that includes a caveat that actual results may differ from the prospective information.

Pro Forma Financial Information

AT-C Section 310 covers examination and review engagements on pro forma financial information, which shows the effects of a hypothetical transaction on historical financial statements. The practitioner evaluates the appropriateness of management's assumptions, the proper application of pro forma adjustments, and the adequacy of disclosures.

Exam Tips for Attestation Engagements

• Examination provides positive assurance (opinion); review provides negative assurance (conclusion); AUP provides no assurance (findings only).
• AUP reports are now general use under current standards.
• Forecasts may be general use; projections should be restricted use.
• Compliance attestation requires suitable and available criteria.
• Attestation engagements require suitable criteria, sufficient evidence, and a written report.