The meaning of assurance, audit and audit-related services

Every person who relies on financial information has the same worry: is it right? A shareholder cannot check the books. A bank cannot check the borrower’s records. A regulator cannot check every report. Assurance is the service that answers this worry. An independent professional examines information prepared by someone else and gives the user a measured amount of comfort about it.

This topic covers what assurance means, the five elements every assurance engagement needs, the levels of assurance, the limits of an audit, and the audit-related services of review, agreed-upon procedures and compilation. Examiners use this material to test whether you can classify an engagement, state how much assurance it gives and say how the conclusion is worded. The same ideas return in almost every later topic.

What is assurance?

An assurance engagement has three features. First, a practitioner is engaged by one party. Second, the practitioner is asked to give an opinion. Third, the opinion is about information that another party prepared. The opinion is an expression of comfort, or assurance, about the information that has been examined. The practitioner does not own the information. That distance is what makes the opinion worth having.

A statutory audit is one form of assurance engagement. It is an independent examination of a company’s books of account with a view to expressing an opinion. Shareholders do not simply accept what the directors say in the financial statements. The audit gives them a reason to trust the figures, because the independent opinion adds credibility to the financial statements.

Assurance is not limited to audits. Regulators now require directors to report to shareholders and other stakeholders on a wider range of matters than the accounts. Users want confidence in that wider information too, and auditors can supply it by giving an opinion on those reports. Examples of non-audit assurance engagements are reports on:

• corporate social responsibility;
• environmental policy;
• employment policies;
• non-financial performance indicators; and
• sustainability policies and practices.

The five elements of an assurance engagement

An assurance engagement performed by a practitioner has five elements. If one is missing, the engagement is not a proper assurance engagement.

The three-party relationship matters most. The practitioner and the responsible party must be different people. If an accountant prepares information and then “gives assurance” on it, nobody independent has examined anything. The topic on assurance engagements in this course develops these elements for International Standard on Assurance Engagements (ISAE) 3000.

Levels of assurance

The amount of comfort a practitioner gives is called the level of assurance. It depends on how much work was done. There are three positions.

The level of assurance in a review is described as “low” in some places and “moderate” in others, and later as “limited”. These are the same thing. Use “limited” in your answers and add “low or moderate” in brackets if you wish.

A positive opinion says something firm, for example that the financial statements give a true and fair view. A negative conclusion says only that the practitioner has found nothing wrong. Its typical wording is that nothing has come to the practitioner’s attention to suggest that the information is materially misstated. It is weaker because less work lies behind it.

Why an audit never gives absolute assurance

Even the highest level, reasonable assurance, is not absolute. The statutory audit gives a high level of comfort, but never a guarantee. The reasons are:

• Audit evidence is persuasive, not conclusive. The auditor gathers evidence that points towards a conclusion. It seldom proves the conclusion beyond doubt.
• The opinion is a matter of judgement. Fair values, depreciation lives, provisions and many other figures are estimates. Two competent auditors can disagree on them.
• Accounting and control systems have inherent limitations. Controls can be bypassed, overridden by management or defeated by people working together.
• Testing is usually selective. Auditors normally test a sample, so there is a risk that the sample does not represent the whole.
• Time and cost are limited. The audit must be finished at a reasonable cost and by a deadline.

Chapter 12 adds that assurance of any kind cannot be absolute because of the lack of precision in the subject matter, the nature of the available evidence and the time scale involved. Note a trap that quiz questions often set. Even where the auditor could test every transaction in a very simple entity, doing so removes only sampling risk.

Judgement about estimates and the inherent limits of controls remain, so absolute assurance is still not possible.

The meaning of audit

International Standard on Auditing (ISA) 200 says the purpose of an audit is to raise the confidence that intended users have in the financial statements. The auditor does this by giving an opinion on whether the financial statements are prepared, in all material respects, in line with an applicable financial reporting framework. A framework may be set by the law of a country, together with international financial reporting standards.

In Nigeria the framework is mainly IFRS and Companies and Allied Matters Act 2020 (CAMA 2020), whose audit provisions are in Chapter 15 (Audit), with the auditors’ report in s. 404. The opinion usually says whether the financial statements give a true and fair view, or present fairly, the financial position and results of the reporting entity.

Audits grew out of the separation of ownership from control. The shareholders own the company, but the directors run it as stewards. The directors know the position better than the owners, and they have a reason to present it in a good light. The audit protects shareholders from incorrect or misleading information from the directors by giving them a high level of assurance.

Audits are long established, formal and closely regulated by law and by professional practice, which is why they carry more weight than other services.

Audit-related services

Accountants also provide audit-related services. These are engagements to carry out reviews of data, agreed-upon procedures or compilations. They are less demanding than an audit, and the reports they produce give less comfort.

Review

A review gives a low (moderate) level of assurance that the information is free from material misstatement. The conclusion is usually negative: nothing has come to the accountant’s attention to suggest that the information is materially misstated. A review takes less time than an audit and therefore costs less. The trade-off is lower credibility for the user.

Evidence in a review comes mainly from enquiry and analytical procedures, and the amount of work is lower than in an audit because the required level of assurance is lower.

Agreed-upon procedures

In an agreed-upon procedures engagement, the client who hires the accountant decides which procedures the accountant must follow. The accountant carries them out and reports the findings. The accountant gives no assurance. The user reads the findings and draws their own conclusions. An example is a lender who asks an accountant to confirm particular balances in a borrower’s receivables ledger.

Compilation

In a compilation the accountant is engaged to prepare information for the client. The accountant does not audit or check information that someone else prepared. The syllabus gives the example of an accountant who prepares a tax computation for a client. No assurance is given on the information.

Putting the engagements side by side

The ideas in more depth

Why the level of assurance depends on the work done

Assurance is a trade between comfort and cost. To give a positive opinion, the auditor must collect enough evidence to reduce the risk of giving the wrong opinion to a low level. That means testing controls, confirming balances with third parties, inspecting assets and examining estimates.

To give only a negative conclusion, the accountant needs enough evidence to say nothing looks wrong, and that can be done with enquiry and analytical procedures. If the accountant only performs steps chosen by the client, or only prepares the information, there is nothing from which to draw a conclusion about the whole. This is why the labels “reasonable”, “limited” and “none” track the volume of work.

Why the practitioner must be separate from the responsible party

The three-party structure supplies independence. Management prepares the financial statements and is responsible for them. The auditor reports to the shareholders. If one person did both jobs, the report would only repeat the preparer’s own view. This is also why compilation gives no assurance: the accountant has prepared the information, so there is no independent examination.

A numerical illustration of sampling risk

A company issued 1,200 sales invoices in the year. The auditor tests 60 of them, which is 5% of the population (60 ÷ 1,200). Suppose all 60 are correct. The auditor concludes that the population is probably correct, but cannot be certain, because 1,140 invoices were not examined. If the auditor tested all 1,200 invoices, sampling risk would disappear, yet judgement on estimates such as the allowance for doubtful receivables would remain.

This is why the answer to “can we test everything?” is “that still does not give absolute assurance”.

Choosing the level of assurance

Users and practitioners choose the level using four tests. How important is the information to the user’s decision? What does the law require? How much can the user afford to spend? How risky is the subject matter? The law requires an audit for the annual financial statements of companies under CAMA 2020.

Section 401 deals with the appointment of auditors, and s. 402 exempts small companies, as defined in s. 394(3), and companies that have not carried on business since incorporation, other than banks and insurers. A lender may be happy with a review of interim figures. A board that wants to check a narrow set of facts may ask for agreed-upon procedures.

A small business owner who only needs figures prepared may ask for a compilation. A report must never suggest more assurance than was given. Calling a compiled set of figures “audited” would mislead the user.

Worked example: classifying four requests

1. Request 1. This is a statutory audit, a form of assurance engagement. The level is reasonable (high but not absolute). The firm expresses a positive opinion on whether the statements give a true and fair view.
2. Request 2. The bank has chosen the procedures, so this is an agreed-upon procedures engagement. The level is none. The firm reports what it did and what it found, and the bank draws its own conclusions.
3. Request 3. The firm prepares information for the client, so this is a compilation. The level is none. No opinion or conclusion on the figures is given.
4. Request 4. Sustainability indicators are non-financial information, so this is a non-audit assurance engagement. The client asks for moderate comfort, so the level is limited. The conclusion is negative: nothing has come to the firm’s attention to suggest the indicators are materially misstated.
5. Check of the elements. In requests 1 and 4 there is a three-party relationship. In request 4 the firm must also confirm that suitable criteria exist for the indicators, because without them it cannot form a conclusion.

How to score full marks

Questions on this topic are usually written as “explain”, “distinguish”, “describe” or “classify”. They reward precise terms and clear contrasts, so a short answer built on correct labels earns most of the marks.

• Match the number of points to the marks. For a 10-mark discursive question, make about ten distinct, explained points, or five points with a clear explanation each. A bare list earns about half of the marks.
• Use the exact terms. Write “reasonable assurance”, “limited assurance”, “positive opinion”, “negative conclusion”, “responsible party” and “suitable criteria”. Examiners look for them.
• For “distinguish” questions, use a table or compare in pairs. Every point must name both sides. Saying only what a review is does not distinguish it from an audit.
• For classification questions, use three labels per scenario. Name the engagement, state the level of assurance, and state the form of the conclusion. Give a short reason from the scenario.
• For the five elements, define each and tie it to the scenario. One sentence of definition and one of application per element is a full-mark pattern.
• Time. Spend time in proportion to the marks. Read the requirement twice before writing. Leave a few minutes at the end to check that each part has been answered.
• Presentation. Use headings that repeat the words of the question, short paragraphs and one idea per sentence.

Common mistakes in the exam

• Saying an audit gives absolute or 100% assurance. It gives reasonable assurance.
• Saying a review or agreed-upon procedures engagement gives the same assurance as an audit.
• Saying agreed-upon procedures give limited assurance. They give none.
• Describing a compilation as an assurance engagement. The accountant prepares the information, so there is no independent opinion.
• Naming only three or four of the five elements, usually leaving out suitable criteria or sufficient appropriate evidence.
• Confusing the responsible party with the practitioner. In an audit, management is the responsible party and the auditor is the practitioner.
• Writing that testing every transaction gives absolute assurance. Judgement and inherent limits remain.
• Writing the review conclusion in positive form. It must be negative.

Quick revision

• Assurance: a practitioner, engaged by one party, gives an opinion on information prepared by another party.
• Five elements: three parties, subject matter, suitable criteria, sufficient appropriate evidence, report.
• Audit: reasonable assurance, positive opinion, never absolute. Evidence is persuasive, and judgement and control limits remain.
• Review: limited (low or moderate) assurance, negative conclusion, enquiry and analytical procedures.
• Agreed-upon procedures: client sets the procedures, accountant reports findings, no assurance.
• Compilation: accountant prepares information, no assurance, for example a tax computation.
• Non-audit assurance: social responsibility, environmental, employment, sustainability and non-financial indicator reports.

Practice questions

These are original questions written in the style of the Institute of Chartered Accountants of Nigeria (ICAN) exam. Try each one before you open the answer. Full model answers follow the written questions.

Recall check: multiple choice

The real ICAN paper has no multiple-choice section. These questions are for quick recall. The written questions that follow are closer to the exam.

Written questions

Model answers

Spotted a mistake? Tell us and we will check it.