Other Assurance and Related Services

Not all engagements provide the same level of assurance. The key distinction is between reasonable assurance, limited assurance, and no assurance:

Key principle: Higher assurance requires more extensive procedures and provides greater confidence to users. An audit involves testing (inspection, confirmation, recalculation, etc.), while a review relies primarily on inquiry and analytical procedures. Agreed-upon procedures and compilations provide no assurance at all — users must assess the significance of the findings or information themselves.

ISRE 2400 — Review of Historical Financial Statements (non-listed entities):

• Objective: To obtain limited assurance that the FS as a whole are free from material misstatement, enabling the practitioner to express a conclusion in a negative form
• Procedures: Primarily inquiry of management and others, and analytical procedures. The practitioner does NOT perform the detailed testing (inspection of documents, confirmation, observation, recalculation) typical of an audit. If the practitioner becomes aware of matters suggesting the FS may be materially misstated, additional procedures are performed.
• Conclusion: Negative form: "Based on our review, nothing has come to our attention that causes us to believe that the financial statements are not prepared, in all material respects, in accordance with [framework]." If the practitioner identifies a material misstatement: a modified conclusion is issued (qualified or adverse).
• Key differences from an audit: Less evidence gathered, fewer procedures, less rigorous testing, lower cost. Appropriate for entities where statutory audit is not required and users need some assurance but not full audit-level comfort.

ISRE 2410 — Review of Interim Financial Information by the Auditor of the Entity:

• Applies when the auditor of the entity is engaged to review interim financial information (e.g., half-yearly results for listed companies)
• The auditor leverages their existing knowledge from the annual audit (understanding of the entity, internal controls, prior year risks)
• Procedures: inquiry of management (focusing on significant changes since the last annual audit), analytical procedures (comparing interim figures to prior interim/annual data, budgets, expectations), reading minutes, considering subsequent events
• Conclusion: same negative form as ISRE 2400
• UK regulatory context: The FCA's Disclosure and Transparency Rules require listed companies to publish half-yearly reports. These are typically reviewed (not audited) by the company's auditor under ISRE 2410.

ISRS 4400 (Revised) covers engagements where the practitioner performs specific procedures agreed with the engaging party and reports the factual findings. No assurance is expressed — the users draw their own conclusions from the findings.

Key features:

• Procedures are agreed in advance with the engaging party (and sometimes with other intended users) — the practitioner does not design procedures based on their own risk assessment
• No opinion or conclusion is expressed — the report states what procedures were performed and what was found (factual findings)
• The practitioner must perform the procedures with professional competence and due care, and must be independent (under the Revised standard) unless agreed otherwise with the engaging party and disclosed in the report
• The report is typically restricted to the engaging party and specified users — because only they understand the context and significance of the findings

Examples of AUP engagements:

• Checking that specified calculations in a contract (e.g., a royalty agreement or franchise fee) have been correctly computed
• Verifying that specific financial covenants have been complied with
• Checking specific accounts payable/receivable balances against supporting documentation
• Verifying grant expenditure against eligible costs
• Testing compliance with specific regulatory requirements

Key distinction from an assurance engagement: In an AUP engagement, the practitioner does NOT form a conclusion about the subject matter. The users (who agreed the procedures) evaluate the findings and form their own conclusions. This makes AUP suitable when specific, targeted verification is needed rather than overall assurance.

ISRS 4410 (Revised) covers engagements where the practitioner assists management in the preparation and presentation of financial information (typically financial statements) without expressing any assurance.

Key features:

• The practitioner uses their accounting expertise to collect, classify, summarise, and present financial information in the form of financial statements or other financial information
• No assurance is expressed — the report states that the practitioner has compiled the FS based on information provided by management, and that no audit or review has been performed
• The practitioner must understand the applicable financial reporting framework and the entity's business to compile the information correctly
• If the practitioner becomes aware that the information is misleading (e.g., management has provided incomplete data or the records contain obvious errors): they must discuss with management and, if unresolved, consider withdrawing from the engagement
• Independence is not required under ISRS 4410 (but if the practitioner is not independent, this should be disclosed)

Common use: Small entities that do not require a statutory audit and cannot prepare their own financial statements. An accountant in practice compiles the FS from the entity's books and records.

Management's responsibility: Management retains responsibility for the financial information — the practitioner does NOT take responsibility for its accuracy or completeness. Management must review and approve the compiled information.

Prospective financial information (PFI) includes forecasts and projections — financial information based on assumptions about future events and management's expected course of action. Examples: profit forecasts in a prospectus, business plan projections, cash flow forecasts for going concern assessment.

Engagement objective: To report on whether the PFI has been properly prepared on the basis of the stated assumptions, and whether the assumptions are reasonable (for forecasts — based on best estimates) or clearly stated (for projections — based on hypothetical assumptions).

Procedures:

• Evaluate the source and reliability of the underlying data
• Consider whether the assumptions are reasonable and internally consistent (for forecasts: based on best-estimate assumptions. For projections: the hypothetical assumptions must be clearly stated)
• Check the mathematical accuracy of the computations
• Consider whether the PFI is properly prepared on the basis of the assumptions
• Consider the presentation and disclosures — are the assumptions clearly stated? Is the sensitivity of the PFI to changes in key assumptions disclosed?
• Obtain written representations from management regarding intended use and completeness of assumptions

Reporting: The practitioner expresses an opinion on whether the PFI is properly prepared on the basis of the assumptions. They do NOT express an opinion on whether the forecast outcomes will be achieved — the future is inherently uncertain.

Sustainability assurance is a rapidly growing area. Companies are increasingly reporting on environmental, social, and governance (ESG) matters, and stakeholders want assurance that this information is reliable.

Applicable standards:

• ISAE 3000 (Revised) — Assurance Engagements Other Than Audits or Reviews of Historical Financial Information. The overarching standard for non-financial assurance, including sustainability reporting. Covers both reasonable and limited assurance.
• ISAE 3410 — Assurance Engagements on Greenhouse Gas Statements. A subject-specific standard for GHG emissions reporting.
• ISSA 5000 — General Requirements for Sustainability Assurance Engagements (issued by IAASB, effective from December 2026). A comprehensive standard specifically for sustainability assurance.

Key challenges in sustainability assurance:

• Multiple reporting frameworks: GRI, SASB, TCFD, ISSB (IFRS S1 and S2), CDP, UN SDGs — the landscape is still evolving and not yet as standardised as financial reporting
• Data quality: ESG data is often less mature than financial data — collected from diverse sources (supply chains, operations, third parties), may involve estimates and assumptions, and may lack robust internal controls
• Subject matter expertise: Sustainability assurance may require knowledge of environmental science, social metrics, supply chain analysis, and carbon accounting — beyond traditional accounting/auditing skills
• Scope and boundaries: Defining the reporting boundary (e.g., Scope 1, 2, and 3 emissions) and determining what is material for ESG purposes is more complex and subjective than for financial reporting
• Level of assurance: Most sustainability reports currently receive limited assurance (review-level), with a trend toward reasonable assurance as the practice matures

Regulatory developments: The EU Corporate Sustainability Reporting Directive (CSRD) requires large companies to obtain assurance on sustainability information. The ISSB standards (IFRS S1, S2) are being adopted globally. In the UK, the FCA and FRC are developing requirements for listed companies.

Due diligence is an investigation and analysis of a business, typically performed in the context of a proposed transaction — most commonly a merger, acquisition, investment, or IPO. The purpose is to help the acquirer/investor assess the risks, opportunities, and value of the target business.

Types of due diligence:

• Financial due diligence: Analysis of the target's financial information — quality of earnings (sustainable vs non-recurring), working capital trends, net debt, normalised profit, cash conversion, tax position, contingent liabilities. Often performed by accountancy firms.
• Commercial/strategic due diligence: Assessment of the market, competitive position, customer base, growth prospects, and strategic rationale for the deal.
• Legal due diligence: Review of contracts, litigation, regulatory compliance, IP, employment matters, and corporate structure. Performed by lawyers.
• Tax due diligence: Review of the target's tax compliance, potential tax exposures, and the tax structuring of the transaction.
• IT/operational due diligence: Assessment of systems, technology, operations, and integration issues.
• ESG due diligence: Emerging area — assessing environmental liabilities, social risks, and governance quality.

Due diligence is NOT an assurance engagement:

• No opinion or conclusion is expressed on the financial statements
• The work is performed for a specific user (the client making the acquisition/investment) — the report is private and restricted
• The scope is agreed with the client and tailored to their needs — it is not governed by ISAs
• The practitioner exercises professional judgement and applies analytical and investigative skills, but the engagement is advisory in nature
• Typically the report includes findings, analysis, and risk identification — but the client decides what to do with the information

Internal audit is an independent, objective assurance and consulting activity designed to add value and improve an organisation's operations. It helps the organisation accomplish its objectives by bringing a systematic, disciplined approach to evaluate and improve the effectiveness of risk management, control, and governance processes.

Key characteristics:

• Scope: Broader than external audit — internal audit covers financial controls, operational efficiency, compliance with policies and regulations, risk management, governance, value for money, and IT controls. Not limited to financial reporting.
• Reporting: Reports to management and the board/audit committee (not to shareholders). This internal reporting line is critical — it means internal audit serves the organisation's management.
• Independence: Must be independent of the operational areas it reviews. Best practice: report functionally to the audit committee (for independence) and administratively to the CEO or CFO (for logistics). Must not audit areas where the head of internal audit has operational responsibility.
• Standards: The Institute of Internal Auditors (IIA) publishes the International Standards for the Professional Practice of Internal Auditing, which internal audit functions should follow.

Activities of internal audit:

• Assurance activities: Evaluating internal controls (design and effectiveness), testing compliance with policies/procedures/regulations, reviewing financial processes, assessing risk management
• Consulting activities: Advising management on control improvements, process redesign, risk assessment, governance structures, new system implementations (advisory role, not decision-making)
• Special investigations: Fraud investigations, whistleblowing follow-up, ad hoc projects requested by the board or audit committee

Outsourcing internal audit: Some organisations outsource their internal audit function to an external firm (often an accountancy firm). Advantages: access to specialists, independence from management, flexibility. Disadvantages: cost, less knowledge of the business, potential conflict if the same firm provides both internal and external audit (ethical and independence concerns — generally prohibited for PIE auditors under the FRC Ethical Standard).

Relationship with external audit: See ISA 610 (covered in the Internal Controls topic). The external auditor may use internal audit work or obtain direct assistance, subject to evaluation of objectivity, competence, and systematic approach.