Assurance report

Reports for assurance engagements that are compliant with ISAE 3000 (Revised) and standards based on ISAE 3000 (Revised) (such as ISAE 3402, ISAE 3410, AAF 01/06 and IFT 01/07) must include a number of basic elements.

The practitioner tailors these elements for the specific engagement depending on the subject matter and, where appropriate, considers a qualified conclusion. In addition, the practitioner considers other reporting responsibilities, including communicating with those charged with governance where it is appropriate.

It would be unusual, but not impossible, for a single report to cover more than one subject matter. It is relatively straight-forward and relatively common for a report to cover more than one aspect of a single subject matter.

Where the subject matter information comprises a number of aspects of a single topic, separate conclusions may be provided on each aspect. This is achieved by clearly identifying each aspect separately in the:

• scope of the assurance report (including the: level of assurance being provided; description of what reporting standard is being applied and criteria being used)
• description of the work performed; and
• conclusion to the report.

Accordingly, not all the conclusions need to relate to the same extent of evidence-gathering procedures. Each conclusion is clearly expressed in the form that is appropriate to whichever type of assurance is required - reasonable or limited. Such structures are used where the subject matter is wide-ranging, such as in corporate responsibility reports, and the users’ needs are relatively complex.

By contrast, although a report could address and include conclusions on a range of differing subject matters, such as certain quantitative information (KPIs), the state of regulatory compliance and the quality of financial controls, this can be confusing to the recipient of the assurance report.

This may be because each subject matter would have a different user or would require different criteria and evidence gathering methods. It may be more appropriate and avoid confusion for recipients for them to receive separate reports on each subject matter.

The IAASB's Amended International Frameworks for Assurance Engagements states that the practitioner expresses a qualified or adverse conclusion or a disclaimer of conclusion where:

• the practitioner concludes that there is not sufficient appropriate evidence to support an assurance conclusion due to the limitation on the scope of the practitioner’s work (qualified or disclaimer);
• the responsible party’s assertion or the report on the subject matter is materially misstated (qualified or adverse); or
• after accepting the engagement, the criteria or subject matter turns out to be inappropriate for an assurance engagement (qualified, adverse or disclaimer).

The practitioner may also need to consider withdrawing from the engagement when necessary.

• Read more on assurance reports
• Read more on the elements of an assurance report required by ISAE 3000 (Revised)