Assurance engagements, levels of assurance and sustainability assurance

A solar-energy company in Lagos tells investors that its customers saved 12,000 tonnes of carbon last year. A bank tells depositors that its payment systems are secure. A supplier of payroll services tells its clients that its controls work. None of these claims is in the financial statements, yet each reader wants to know whether it can be trusted.

They ask an independent practitioner to give assurance, which means confidence, about information someone else prepared. Audit of financial statements is the best-known form, but assurance is wider.

This topic explains what assurance is, the two levels of assurance, how an audit differs from a review, the five elements of every assurance engagement, assurance on controls, and assurance on sustainability information. The previous topic covered audit itself and the next covers the legal framework for statutory audit.

Key terms in plain English

Syllabus check

This topic is in syllabus area A, introduction to assurance, legal and regulatory frameworks, and audit process (20% of marks). It covers:

• the concepts of audit, assurance and attestation and how they relate
• the levels of assurance that different engagements give
• the elements, objectives and phases of assurance engagements, including sustainability information

CAMA 2020 and assurance

The Companies and Allied Matters Act 2020 (CAMA 2020) is the company law of Nigeria. The sections below apply to this topic.

The rules in more depth

What assurance is

To assure is to give confidence. In an assurance engagement an assurance firm is engaged by one party to give an opinion on a piece of information prepared by another party. The opinion gives the party that hired the firm confidence that the information can be relied on. Assurance can be given by audit (external audit, internal audit, or a mix) and by review.

A statutory audit is one form of assurance: without it, shareholders might not accept that the financial statements are reliable. The more work done and the better the results, the higher the assurance, so some assurance is more reliable than other assurance.

Levels of assurance

Absolute assurance is not possible, because audit evidence is persuasive rather than conclusive and the auditor tests samples.

Assurance by audit and by review

An external audit is performed by an appropriately qualified auditor appointed by the shareholders and independent of the company. An internal audit is a function inside the entity that appraises and monitors operations for management. Entities may outsource internal audit, and many practical procedures are the same for both kinds of audit.

A review is usually a voluntary investigation that gives only moderate assurance, normally expressed as negative assurance: nothing has come to our attention to suggest the information is misstated. It is cheaper and faster than an audit because less evidence is gathered. Negative assurance is used where the practitioner cannot get enough evidence for positive assurance.

For example, a cash flow forecast depends on assumptions about the future, so an accountant cannot say it is accurate, but can say that nothing suggests it contains material errors.

The elements of an assurance engagement

An assurance engagement is one in which a practitioner aims to obtain sufficient appropriate evidence to express a conclusion that increases the confidence of the intended users, other than the responsible party, about the subject matter information. Every engagement has five elements.

Each engagement is also classified on two dimensions: reasonable or limited, and attestation or direct. In an attestation engagement the responsible party measures the subject matter and the practitioner reports on that. In a direct engagement the practitioner measures the subject matter against the criteria and reports the result.

Assurance, attestation and audit compared

The three words are used as if they were the same, but they differ. Assurance is the broad term for any engagement in which a practitioner gives an opinion on information prepared by another. Attestation is an audit-related engagement by an accountant, such as a review of data, agreed-upon procedures or a compilation, and it includes the statutory audit.

An audit is the long-established, formal and closely regulated process that developed because ownership (shareholders) is separate from stewardship (directors) and gives a high level of assurance.

Assurance on internal controls

Directors must identify business risks and design controls to deal with them. Assurance providers help by reporting on the controls of a service organisation, a business that runs part of another entity's processes, such as payroll or payment processing.

A Type 1 report has a description of the service organisation's system, control objectives and controls at a stated date, prepared by its management, and a reasonable assurance report by a service auditor on that description and on whether the controls are suitably designed. A Type 2 report covers a period and adds the service auditor's opinion on whether the controls operated effectively, with a description of the tests and results. ISAE 3402 sets out these reports.

Sustainability and social reports

Customers and investors care about how a business treats the environment and society, and a company's reputation can suffer if it ignores them. Many large companies publish social and environmental or sustainability reports, and credibility is added when an independent practitioner verifies them.

The assurance standards that apply are ISAE 3000 (Revised) for assurance engagements other than audits or reviews of historical financial information, ISAE 3410 for greenhouse gas statements, and ISSA 5000, the General Requirements for Sustainability Assurance Engagements, for periods beginning on or after 15 December 2026. Assurance may be limited or reasonable, and the criteria might be a recognised reporting standard or the entity's own stated methodology.

Assurance on non-financial information: the Ecofriends example

The November 2025 examination asked about Ecofriends Greens, a renewable energy company that wanted assurance on its Environmental Impact Assessment report, which included the carbon emissions saved by customers with solar systems. The answer applies the points above.

• Type of assurance: the company wants confidence for a government agency and for investors. Reasonable assurance would give a high level of confidence but costs more because data collection is complex. Limited assurance gives a moderate level, costs less and may be enough if the report is filed for record. The firm and the company agree on the level, and the conclusion is expressed against the stated criteria.
• Key risks: management bias, because the company wants to look good to attract investors; measurement uncertainty, because carbon savings depend on assumptions and conversion factors; the practitioner's lack of specialist knowledge; and weak internal controls over data collection and calculation.
• Procedures: understand how the company collects and calculates the emissions data; re-perform the calculation using suitable conversion factors; perform analytical procedures against prior years and industry benchmarks; consider using an expert; review the disclosures; and issue the assurance report.

Note on the Pathfinder solution. The Pathfinder says reasonable assurance would conclude that the report is "true and fair". That wording belongs to financial statements. For non-financial information the conclusion is expressed in terms of whether the subject matter information is prepared, in all material respects, in line with the stated criteria, so the Pathfinder solution is slightly different from ours on this point.

The types, risks and procedures in the Pathfinder answer are otherwise right.

Worked examples

1. The forecast depends on assumptions about the future, so the accountant cannot confirm it is accurate.
2. The engagement is a review giving limited assurance.
3. The conclusion is negative: nothing has come to our attention that suggests the forecast has material errors.

1. Practitioner: Okafor and Co. Responsible party: Zenith Power Plc. Intended users: the Energy Regulator.
2. Subject matter: the complaints statistics. Criteria: the regulator's definition of a complaint and counting rules.
3. Evidence: complaint logs and customer records. Report: Okafor and Co's assurance report.

1. The bureau is a service organisation and the claim covers a period and operating effectiveness.
2. A Type 2 report is needed, not Type 1, which covers design at a single date.

1. A review is cheaper and quicker because less evidence is gathered.
2. It gives limited assurance in negative form, which may satisfy the lender.

How to score full marks

• State the level (reasonable or limited) and the wording of the conclusion (positive or negative).
• List the five elements and apply each to the scenario.
• Name the standard: ISAE 3000, ISAE 3402 or ISAE 3410 for the case.
• Give the reason for the level chosen: cost, evidence available and users' needs.

Common mistakes in the exam

• Treating assurance and audit as the same thing.
• Writing "true and fair" for a non-financial report.
• Giving positive wording for a review.
• Forgetting that the practitioner reports to users other than the responsible party.

Quick revision

• Reasonable = positive, audit; limited = negative, review.
• Five elements; two dimensions.
• Type 1: design at a date; Type 2: design and operation over a period.
• ISAE 3000 for non-audit assurance; ISSA 5000 for sustainability.

Practice questions

Questions 1 to 10 are multiple choice. Questions 11 to 13 are written. Try each before opening the answer.

Model answers

Spotted a mistake? Tell us and we will check it.