Attestation tune-up

Written on Mar 28, 2018

SSAE changes affect 2018 engagements

By Laura Hay, CPA, CAE

As part of the AICPA’s clarity initiative, Statement on Standards for Attestation Engagements (SSAE) No. 18, Attestation Standards: Clarification and Recodification, was issued by the Auditing Standards Board in April 2016. Effective for reports dated on or after May 1, 2017, SSAE No. 18 replaces much of the prior SSAE guidance.

Restructuring of attestation standards

Similar to clarity updates for other standards, the attestation standards are reorganized and codified to make them more readable and easier to apply, including objectives and definitions sections, and separating requirements from application and other explanatory material. “AT” section numbers are replaced with “AT-C” sections for the clarified attestation standards.

The revised attestation standards include concepts common to all engagements, AT-C section 105, and sections that clearly differentiate requirements and explanatory material for specific levels of service:

-AT-C section 205 Examination Engagements
-AT-C section 210 Review Engagements
-AT-C section 215 Agreed-upon Procedures Engagements

Additional subject matter sections address incremental performance and reporting requirements, and application guidance for specific subject matters, including prospective financial information (forecasts and projections), pro forma financial information, compliance attestation and reporting on service organization controls. Therefore, the practitioner will need to consult the common requirements, level of service requirements and requirements specific to the subject matter as applicable to engagements.

Guidance for compilation and preparation of forecasts and projections previously included in SSAEs have been removed. SSARS No. 23, Omnibus Statement on Standards for Accounting and Review Services—2016 revised AT-C sections 70 and 80 to include requirements and guidance for preparation and compilation, respectively, of prospective financial information in the SSARSs literature. CPAs need to be aware that SSARS 23 was not a simple relocation of the requirements and guidance and that there are some significant changes for practitioners who perform preparation or compilation of prospective financial information.

Changes from previous attestation standards

Written assertion

For all attestation engagements, a written assertion is required from the responsible party about the measurement or evaluation of the subject matter against the criteria. In examination and review engagements, when the engaging party is also the responsible party, refusal to provide a written assertion requires withdrawal from the engagement, if permitted by applicable laws and regulations. If the engaging party is not the responsible party, the refusal is disclosed in the report and the use of the report must be restricted to the engaging party. In an agreed-upon procedures engagement, refusal to provide a written assertion must be disclosed in the report.

Risk assessment

SSAE No. 18 incorporates a risk assessment requirement for examination engagements. In an examination, the practitioner is required to obtain an understanding of the subject matter sufficient to identify the risks of material misstatement, and provide a basis for designing and performing procedures to respond to assessed risks and support the practitioner’s opinion.

Engagement letters and representation letters

Written engagement letters and representation letters are now required for all attestation services, including agreed-upon procedures engagements. However, if a responsible party who is not the engaging party refuses to provide a representation letter, the practitioner is not required to conclude that a scope limitation exists if the practitioner is able to obtain satisfactory oral responses from the responsible party to matters included in the representation letter. In that case, use of an examination or review report would be restricted to the engaging party. Oral responses should be documented by the practitioner.

Scope limitations

Previous requirements related to scope limitations have been clarified to provide more options, permitting the practitioner to assess the effect of the scope limitation, including whether the practitioner should issue a qualified opinion, disclaim an opinion or withdraw from the engagement.

Reporting on controls at service organizations

Changes made to requirements for reporting on controls at a service organization (commonly referred to as SOC reports), include monitoring the effectiveness of controls at subservice organizations, and the addition of robust risk assessment procedures by the auditor.

Reporting changes

Practitioners are advised to consult the revised standards for updated reporting language for all attestation services.

Common applications

Glenn Roberts, CPA, senior technical reviewer for OSCPA, identified applications of SSAEs most likely to be of concern for upcoming peer reviews:

Ohio title agency reviews

Practitioners performing title agency reviews for the Ohio Department of Insurance can no longer rely upon guidance published by OSCPA when the 2014 requirement went into effect, including sample letters and report language. Practitioners should consult the updated agreed-upon procedures guidance and report language in SSAE No. 18. Note that the attestation standards require practitioners to obtain a representation letter as part of these engagements, even though such a letter is not required by the rules promulgated by the Ohio Department of Insurance for title agency reviews.

HUD audit electronic submissions

Practitioners issuing agreed-upon procedures reports related to other submissions included with financial statements in HUD audits will need to amend procedures and reports in accordance with SSAE No. 18. They will also need to obtain a representation letter in connection with these reports. Since the audit and the agreed-upon procedures are separate engagements under professional standards, Roberts recommended that auditors obtain a separate representation letter for the agreed-upon procedures engagement.

Not-for-profit budget comparisons

Budgets that have expired at the end of the reporting period are considered to be historical financial information. Budgets that have not expired at the end of the reporting period are considered prospective financial information. Therefore, compilation or preparation engagements that include expired and/or unexpired budget information follow SSARS performance and reporting guidance. Reviews of expired budgets would also follow SSARS guidance. CPAs are precluded from performing a review of prospective financial information.

What's next?

The AICPA Auditing Standards Board is currently considering:

• Revising the standards to remove the requirement for the practitioner to request or obtain a written assertion from the responsible party. This proposed revision is in consideration of situations where a client, frequently a smaller or less complex entity, cannot or is unwilling to provide an assertion.

• Revising the requirements for an agreed-upon procedures engagement to permit increased flexibility with respect to the development of procedures and to permit the issuance of a general-use report.

Laura Hay, CPA, CAE, is executive vice president of The Ohio Society of CPAs and staff liaison to the Accounting & Auditing Committee. She can be reached at or 614-323-0682.

Leave a comment