Assurance engagement is an engagement in which a practitioner auditor expresses a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party about the outcome of the evaluation or measurement of a subject matter against criteria.
The practitioner auditor provides a written report containing a conclusion that conveys the assurance obtained about the subject matter information. NSAs, NSREs and NSAEs establish basic elements for assurance reports. In addition, the practitioner considers other reporting responsibilities, including communicating with those charged with governance when it is appropriate to do so. In an assertion-based engagement, the practitioner’s conclusion can be worded either:
In terms of the responsible party’s assertion (for example: “In our opinion the responsible party’s assertion that internal control is effective, in all material respects, based on XYZ criteria, is fairly stated”); or
Directly in terms of the subject matter and the criteria (for example: “In our opinion internal control is effective, in all material respects, based on XYZ criteria”).
In a direct reporting engagement, the practitioner’s conclusion is worded directly in terms of the subject matter and the criteria. In a reasonable assurance engagement, the practitioner expresses the conclusion in the positive form, for example: “In our opinion internal control is effective, in all material respects, based on XYZ criteria.” This form of expression conveys “reasonable assurance.”
Having performed evidence gathering procedures of a nature, timing and extent that were reasonable given the characteristics of the subject matter and other relevant engagement circumstances described in the assurance report, the practitioner has obtained sufficient appropriate evidence to reduce assurance engagement risk to an acceptably low level. In a limited assurance engagement, the practitioner expresses the conclusion in the negative form, for example, “Based on our work described in this report, nothing has come to our attention that causes us to believe that internal control is not effective, in all material respects, based on XYZ criteria.”
This form of expression conveys a level of “limited assurance” that is proportional to the level of the practitioner’s evidence-gathering procedures given the characteristics of the subject matter and other engagement circumstances described in the assurance report.