Assurance engagements and ISAE 3000

The audit of annual financial statements is the best-known assurance service, but it is not the only one. Companies report on many things that no law requires to be audited: their governance, their risks, their systems, their performance and, increasingly, their impact on the environment. Readers of that information want it to be believable, and a professional accountant can give it credibility through an assurance report.

This topic covers the framework for these engagements and International Standard on Assurance Engagements (ISAE) 3000, the standard that governs them. It covers the objective, the three parties, the elements of an engagement, the levels of assurance, the suitable criteria and the report. The next topic covers the main types of engagement. Together they carry the questions on assurance, including the sustainability assurance part of May 2026 Question 4.

The need for assurance services

The traditional assurance role of the accountant is the statutory audit of published annual financial statements. An audit gives a high, but not absolute, level of assurance. Its purpose is to add credibility to the statements.

But organisations also report to stakeholders on a wide range of information that is not subject to statutory audit. The syllabus lists:

• corporate governance, including risk assessment and internal control systems;
• e-commerce and the operation of e-commerce activities;
• systems reliability;
• performance measurement, financial and non-financial; and
• value for money.

This information may not be audited, but users still want it to be credible. A report from a professionally qualified accountant can supply that credibility.

The International Framework for Assurance Engagements

Guidance on assurance engagements comes from two sources: the International Framework for Assurance Engagements, revised in 2013, and ISAE 3000, Assurance engagements other than audits and reviews of historical financial information.

Two distinctions

Why absolute assurance is not possible

Three things stop the practitioner from giving absolute assurance:

1. the lack of precision often found in the subject matter;
2. the nature of the evidence available; and
3. the time scale involved.

Reasonable assurance

Reasonable assurance can be given only when:

• the subject matter is the responsibility of another party; and
• the subject matter is identifiable and can be tested by evidence-gathering techniques.

In other words, the practitioner must be looking at information that someone else prepared, and must be able to get enough evidence to give a positive opinion.

Limited assurance

With limited assurance the risk is higher than in a reasonable assurance engagement, but still low enough to allow a negative expression of the conclusion, as in a review report.

Non-assurance engagements

The Framework separates assurance from non-assurance engagements. Examples of non-assurance are:

• preparing tax returns;
• management or tax consulting; and
• agreed-upon procedures or compilation engagements (see the earlier topic).

ISAE 3000: key general points

• Ethics. The International Ethics Standards Board for Accountants (IESBA) code of ethics should be followed.
• Quality control. Appropriate quality control procedures apply to each engagement.
• Scepticism. The engagement is planned and performed with professional scepticism, recognising that the subject matter may be materially misstated.
• Changes in the engagement. Before the work is complete, the client may ask for the engagement to be changed to a non-assurance engagement or for the level of assurance to be reduced. The practitioner considers whether the request is appropriate and should not agree to it without a good reason.

Accepting an assurance engagement

Background: The acceptance process is like that for other engagements and is risk-based.

The practitioner checks that the firm’s acceptance and continuance procedures are followed, that ethical requirements including independence will be met by the team and any specialists, that there is no scope limitation that would lead to a modified conclusion, that the terms are set in an engagement letter covering the basis of reporting and whether the conclusion will be reasonable or limited assurance, and that there are enough competent resources, including specialists.

The engagement partner is responsible for the quality of the work. These points are the ones May 2026 Question 4(a) asked for, applied to sustainability assurance.

The objective and elements of an assurance engagement

The objectives are:

1. to obtain reasonable or limited assurance, as appropriate, about whether the subject matter information is free from material misstatement;
2. to express a conclusion on the outcome of the measurement or evaluation of the underlying subject matter, in a written report that conveys a reasonable or limited assurance conclusion and describes the basis for it; and
3. to communicate further as ISAE 3000 and other relevant ISAEs require.

The accountant who carries out the engagement is called the practitioner.

The three parties

1. The practitioner, who gives the conclusion.
2. The party responsible for the subject matter. This is, for example, the management of the client.
3. The intended user of the subject matter information. This is, for example, the shareholders.

The other elements

• a defined subject matter;
• suitable criteria for assessment;
• sufficient appropriate evidence; and
• a report containing a conclusion based on the evidence gathered and evaluated.

Suitable criteria

Suitable criteria are the standards against which the subject matter is assessed. This can be the hardest part of an engagement. It is relatively easy where the criteria are set by regulation, such as law or accounting standards. It is harder for more subjective subjects such as customer care or labour relations.

The syllabus gives the example of a report on the standard of patient care at a state hospital. Mortality rates might be proposed as a criterion, but they are also affected by the age of patients and the seriousness of their illnesses, so they may not be a suitable measure of the hospital’s performance.

Background: The Framework says suitable criteria should be relevant, complete, reliable, neutral and understandable. Criteria may be established by law or by recognised bodies, or developed specifically for the engagement. If they are developed for the engagement, the practitioner makes sure they are available to the intended users.

The assurance report

The report at the end of the engagement includes:

1. a title showing that it is an independent assurance report;
2. an addressee;
3. identification of the level of assurance obtained;
4. the subject matter, with relevant information such as the period the information covers;
5. the suitable criteria selected;
6. any inherent limitations in performing the work;
7. where appropriate, a statement that use of the report is restricted to specified users or a specific purpose;
8. a statement that identifies the responsible party and the measurer and describes their responsibilities and the practitioner’s;
9. a statement that the engagement followed ISAEs, International Standard on Quality Management (ISQM) 1 and independence and ethical requirements;
10. a summary of the work performed;
11. the practitioner’s conclusion; and
12. the date, name and address of the practitioner.

As in an audit report, the conclusion may be modified. The level of materiality of the matter decides whether the report is qualified, adverse or a disclaimer.

The rules in more depth

Why the practitioner must not be the responsible party

If the practitioner prepared the information, the practitioner would be checking his own work. That is why reasonable assurance requires that the subject matter is the responsibility of someone else. If the practitioner measures the subject matter directly in a direct engagement, the practitioner still must not be the party responsible for the subject matter itself.

Attestation or direct?

Most engagements in the syllabus, such as reports on risk assessments or performance measures, are attestation engagements in which management makes an assertion. In a direct engagement the practitioner does the measuring. The distinction affects the report: in an attestation engagement the conclusion is on the assertion or on the subject matter information, and in a direct engagement the conclusion is on the subject matter itself.

Choosing the level of assurance

Reasonable assurance needs more evidence, so it costs more and takes longer. Limited assurance suits information where the client mainly wants some independent comfort, or where the subject matter does not allow enough evidence for a positive opinion. The engagement letter states the level, and the conclusion must match it.

Worked example: choosing criteria and level

Scenario. Lakeside Hospital Trust asks an accounting firm to report on the quality of patient care in its main hospital for 2025. Management has prepared a report with three measures: the mortality rate within 30 days of surgery (3.2%), the average waiting time for outpatient appointments (21 days) and the share of patients who rate their care good or very good (88% from a survey of 600 patients).

Step 1: parties and subject matter. The practitioner is the firm, the responsible party is the Trust’s management and the intended users are the board and the health ministry. The subject matter is the three measures.

Step 2: criteria. The waiting time and survey results have clear definitions. Mortality is less suitable, because it depends on the age and condition of patients. The practitioner asks management to adjust it for case mix, or to state its limits clearly in the report, and agrees the definitions in advance with the users.

Step 3: level of assurance. The practitioner can test waiting times against records and re-perform the survey calculation, so reasonable assurance is possible for those two. The mortality measure depends on the data on patient condition, which may be incomplete, so limited assurance is chosen for that measure and the report explains why.

Step 4: reporting. If management refuses to give the practitioner access to patient records for the mortality figures, that is a scope limitation. A qualified conclusion or disclaimer on that measure would follow. If the criteria are not agreed with the users, the report states the limits and restricts its use.

How to score full marks

• Name the three parties. They are the practitioner, the responsible party and the intended users.
• Give all four elements. Subject matter, suitable criteria, sufficient appropriate evidence and a report.
• Link the level of assurance to the form of the conclusion. Reasonable is positive, limited is negative.
• Give the two conditions for reasonable assurance. Another party’s responsibility, and subject matter that can be tested.
• Test the criteria in the scenario. Say what makes a measure suitable or unsuitable, using the facts.
• For acceptance, use the risk-based checklist. Ethics, scope, engagement letter and competent resources.

Common mistakes in the exam

• Giving only two parties.
• Describing reasonable assurance as absolute assurance.
• Saying agreed-upon procedures or compilations are assurance engagements.
• Forgetting that the practitioner needs suitable criteria before accepting.
• Giving a positive conclusion in a limited assurance engagement.
• Agreeing to reduce the level of assurance because the client asks, with no good reason.

Quick revision

• Three parties, four elements: subject matter, criteria, evidence, report.
• Attestation: responsible party measures. Direct: practitioner measures.
• Reasonable: positive conclusion. Limited: negative form. Never absolute.
• Non-assurance: tax returns, consulting, agreed-upon procedures, compilations.
• ISAE 3000: ethics, quality control, scepticism, do not reduce assurance without good reason.
• Report: 12 elements. Modify for scope limitation, misstatement or unsuitable criteria.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.