Attest Flexibility: New Examination and Revised Review Engagements

Reviews are generally identified in context of historical financial statements, either in accordance with the statements on auditing standards (SAS) or statements on standards for accounting and review services (SSARS). However, for those reviews that fall within the scope of the statements on standards for attestation engagements (SSAE), there is a pathway to perform an attestation service on other than historical financial statements. There are three types of attestation engagements: agreed-upon procedures, examinations, and reviews.

The December 2019 issuance of SSAE No. 19 established great flexibility for agreed-upon procedures, providing for greater reliance on a CPA’s expertise by removing the requirement for written assertions from the responsible party. (See the Journal of Accountancy for an article coauthored by PICPA member John Fleming, CPA.¹) The Auditing Standards Board (ASB) followed up in 2020 with SSAEs that revised examination engagements and review engagements.

SSAE No. 21

The ASB issued SSAE No. 21, Direct Examination Engagements, in September 2020. In it, a whole new section was created at AT-C 206, providing guidance for services to clients that previously had been prohibited. Now, CPAs performing an SSAE No. 21 engagement can provide a level of reasonable assurance on information that is not a set of historical financial statements. Here’s how that might work: prior to AT-C 206, if an entity that was required to provide an assertion about whether an underlying subject was in compliance with certain criteria, and that entity was unable to make such an assertion because they did not possess the expertise necessary, they could not engage a CPA to perform an examination that would provide the public with confidence in the information about the underlying subject. This initial measurement and evaluation are often referred to as “going first.”

SSAE No. 21 defines two important terms with regard to these types of engagements:

• Underlying subject matter (USM) is that which is being measured or evaluated.
• Subject matter information (SMI) is the outcome of the measurement or evaluation against criteria.

The characteristics that must be present for a direct examination engagement to be performed are as follows: there must be a party other than the CPA that must be responsible for the USM, and the CPA must be independent of the USM (and the CPA’s report must state that the CPA is independent).

The expanded provisions of AT-206 represent a consistent application as introduced in SSAE No. 19, Agreed-Upon Procedures Engagements, which also lifts the requirement that the responsible party must provide the assertion. Consequently, a CPA performing a direct examination will express an opinion in a report that conveys the results of the CPA’s measurement and/or evaluation rather than an opinion on the entity’s assertion or the compliance of the subject matter with specified criteria.

SSAE No. 22

The ASB also issued SSAE No. 22, Review Engagements, in December 2020. This guidance revises and supersedes the existing review engagement attestation standards contained in AT-C 210. The revisions focus on three areas and are coordinated with the changes made via SSAE No. 21 and to reviews contained in SSARS No. 25. The focus areas are as follows:

• The CPA may now issue a report containing an adverse conclusion when the subject matter is materially and pervasively misstated (consistent with SSARS No. 252), if the CPA has obtained sufficient appropriate review evidence and concludes that misstatements, individually or in the aggregate, are both material and pervasive to the subject matter.
• The CPA’s report must include an informative summary of the work performed as a basis for the CPA’s conclusion. Providing this description helps users of the attest report understand the basis for the CPA’s conclusion.
• Based on a more expanded description of the procedures that may be performed, the CPA is required to identify areas in which a material misstatement of the subject matter is likely to arise and design and perform procedures to address such areas to obtain limited assurance to support the conclusion in the CPA’s report. Requisite review evidence is to be obtained through the performance of inquiry and analytical procedures so as to provide a reasonable basis for obtaining limited assurance. However, analytical procedures may not be possible (or make sense) when the subject matter is qualitative, rather than quantitative. If an expectation cannot be developed, analytical procedures might not provide sufficient review evidence – accordingly, other procedures besides analytical procedures would be necessary, such as inspection, observation, confirmation, recalculation, or reperformance. Determinations necessitate a risk-based consideration of applicable procedures, applying active professional skepticism.

Other Considerations

Reports under SSAE Nos. 21 and 22 must also include a paragraph affirming independence, such as, “We are required to be independent and to meet other ethical responsibilities in accordance with relevant ethical requirements related to the engagement.” This is consistent with the requirements established in SAS No. 134 and SSARS No. 25.

Revised sections AT-C 205 and AT-C 206 under SSAE Nos. 21 and 22 are effective for reports dated after June 15, 2022. 

1 Alan Reinstein, CPA, CGMA, DBA, Cathleen L. Miller, CPA, PhD, and John Fleming, CPA, “More Flexibility for Agreed-Upon Procedures,” Journal of Accountancy, (Sept. 1, 2020). www.journalof-accountancy.com/issues/2020/sep/ssae-no-19-flexibility-for-agreed-upon-procedures.html

2 SSARS No. 25, Materiality in a Review of Financial Statements and Adverse Conclusions, was issued February 2020 and is effective for engagement periods ending on or after Dec. 15, 2021, with early implementation permitted.