AUD, Auditing and Attestation
Sources for Reporting on Attestation Engagements
Last reviewed
The standards and authorities behind PocketCPA's AUD lessons on Reporting on Attestation Engagements. The topic rests on AT-C 105.
About this topic
A CPA is sometimes hired to give assurance on something that is not a set of financial statements: a schedule, a service organization's controls, a forecast, a compliance claim. This topic covers that work and the reports it produces.
AT-C 105 is Concepts Common to All Attestation Engagements. Its Definitions paragraph, AT-C 105.10, fixes the vocabulary that the engagement-specific sections build on.
Key points
- An agreed-upon procedures engagement applies specific procedures agreed to by the engaging party and reports findings without an opinion.
- An examination provides positive assurance (opinion) on subject matter; a review provides negative (limited) assurance.
- The engaging party, not the practitioner, is responsible for the sufficiency of the agreed-upon procedures.
- AUP reports may now be for general use, not just restricted to specified parties.
What the lessons cover
- The three levels
- Subject matter and criteria
- System and organization controls (AT-C 320)
- Which standard applies
- Modifying the report
- Prospective financial information (AT-C 305)
- The same engagements under PCAOB standards
Authoritative references
Where these requirements sit in the literature.
- AT-C 105, Concepts Common to All Attestation Engagements, with AT-C 105.10 as its Definitions paragraph. AT-C 105 carries:
- the three levels of service, and independence for all of them.
- the rule that the subject matter or assertion belongs to a party other than the practitioner.
- suitable-and-available criteria.
- the boundary excluding historical financial statements handled under the SASs or SSARS.
- The engagement-specific sections:
- AT-C 205 (examination, the written-assertion request and its refusal fork, the modification framework, and SOC 2).
- AT-C 210 (review, negative-assurance conclusion).
- AT-C 215 (agreed-upon procedures as replaced by SSAE No. 19).
- AT-C 305 (prospective financial information).
- AT-C 320 (SOC 1).
- PCAOB AS 2601, Consideration of an Entity's Use of a Service Organization.
- .02 (the two report names).
- .12 and .37 (no operating-effectiveness evidence in a design-only report, and no control-risk reduction below the maximum).
- .14 (the three ways to obtain operating-effectiveness evidence).
- .16 (relevance, period covered, time elapsed).
- .18 (the service auditor's professional reputation).
- .21 (no reference, no division of responsibility).
- .22 (independent of the service organization, not of each user organization).
- .36 (specified control objectives only).
- .38 (the illustrative report and its intended-use paragraph).
- .43 (changes more than twelve months before the reporting date ordinarily are not significant).
- .53 (ordinarily a six-month minimum period).
- PCAOB AS 2201, An Audit of Internal Control Over Financial Reporting That Is Integrated with An Audit of Financial Statements.
- .01 and .03 (an integrated audit, an opinion on ICFR effectiveness, a material weakness possible without a material misstatement).
- .74 (disclaim or withdraw on a scope limitation).
- .90 (adverse on a material weakness).
- .B21 through .B25 (sufficiency of the service auditor's report, user-entity-dependent qualifications, reputation and competence and independence, additional procedures once time has elapsed).
- .B27 (no reference in the ICFR opinion).
- AR-C 90, the SSARS review of a nonissuer's historical financial statements, which is what an AT-C 210 review is most often confused with.
How PocketCPA uses these sources
Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.