ISAE 3000 (Revised)

Assurance Engagements Other than Audits or Reviews of Historical Financial Information

1Objective and scope

ISAE 3000 (Revised) deals with assurance engagements other than audits or reviews of historical financial information, which are dealt with in the ISAs and ISREs. It applies to every other assurance engagement a practitioner undertakes: reports on internal control, on sustainability and greenhouse gas information (with ISAE 3410 and ISSA 5000), on compliance with laws or contracts, on key performance indicators, on prospective information (with ISAE 3400), on controls at a service organisation (with ISAE 3402), on pro forma information (with ISAE 3420), on value for money, on the operation of a lottery or a prize draw. Subject-specific ISAEs supplement it; where none exists, ISAE 3000 applies alone. It rests on the IAASB's International Framework for Assurance Engagements, which defines an assurance engagement by its five elements, and it distinguishes reasonable assurance engagements from limited assurance engagements, and attestation engagements from direct engagements.

The objectives are to obtain either reasonable or limited assurance, as appropriate, about whether the subject matter information is free from material misstatement; to express a conclusion regarding the outcome of the measurement or evaluation of the underlying subject matter through a written report that conveys either a reasonable assurance or a limited assurance conclusion and describes the basis for it; and to communicate further as required by the standard and any other relevant ISAE.

2Key definitions

3Requirements

Ethics, quality and acceptance

• Comply with the IESBA Code's independence and other requirements (or other professional requirements at least as demanding) and with ISQM 1; the engagement partner has the competence in assurance skills and techniques and sufficient competence in the underlying subject matter (or uses experts), and takes responsibility for quality.
• Accept or continue only if: the practitioner has no reason to believe ethical requirements will not be satisfied; the practitioner is satisfied that those performing the engagement collectively have the competence and capabilities; and the preconditions are present: the roles and responsibilities of the responsible party, the measurer or evaluator and the engaging party are appropriate; the engagement exhibits the characteristics of an assurance engagement (appropriate underlying subject matter, suitable criteria available to users, access to evidence, a written report in the appropriate form, a rational purpose, and, for a limited assurance engagement, that a meaningful level of assurance can be obtained).
• Agree the terms in writing: the objective and scope, the responsibilities of each party, identification of the subject matter and the criteria, the level of assurance, reference to the expected form and content of the report, and any restriction on use.
• Once accepted, do not agree to change the engagement from reasonable to limited assurance, or from an assurance engagement to a non-assurance engagement, without reasonable justification; a change driven by evidence problems or unfavourable findings is not reasonable justification.

Planning and performing

• Consider materiality when planning and performing, in terms of the information needs of the intended users, considering both quantitative and qualitative factors.
• Where the work of an expert or of another practitioner or an internal audit function is used, evaluate competence, capabilities and objectivity, understand the field, agree the work, and evaluate its adequacy, as under ISA 620 and ISA 610.
• Obtain written representations from the appropriate party that it has provided all information, that the subject matter information is prepared in accordance with the criteria, and on other matters the practitioner requires; a refusal or unreliability leads to a qualified conclusion, a disclaimer, or withdrawal.
• Consider subsequent events where relevant to the subject matter, and read other information in documents containing the subject matter information for material inconsistency.
• Evaluate the sufficiency and appropriateness of the evidence, and, if unable to obtain enough, attempt to obtain further evidence or, failing that, modify the conclusion for a limitation on scope.

Forming the conclusion

The practitioner evaluates the conclusions drawn from the evidence, considering whether the subject matter information is free from material misstatement (including whether the criteria are adequately described and whether the information is presented clearly), and forms an unmodified conclusion or a modified one. A qualified conclusion applies when misstatements or a limitation are material but not pervasive; an adverse conclusion when misstatements are material and pervasive; and a disclaimer when a limitation is material and pervasive. Where the criteria are unsuitable or the underlying subject matter is inappropriate and the matter is material and pervasive, the practitioner expresses an adverse conclusion or, where a conclusion cannot be reached, disclaims or withdraws.

4Documentation and reporting

The assurance report is in writing and contains: a title indicating an independent assurance report; an addressee; identification of the level of assurance obtained, the subject matter information and, where appropriate, the underlying subject matter (for a direct engagement the subject matter information itself); identification of the applicable criteria; where appropriate, a description of any significant inherent limitations associated with the measurement or evaluation of the underlying subject matter against the criteria; where the criteria are designed for a specific purpose, a statement alerting readers to that fact and that the information may not be suitable for another purpose; a statement identifying the responsible party and the measurer or evaluator and describing their responsibilities and the practitioner's; a statement that the engagement was performed in accordance with ISAE 3000 (Revised) or the subject-specific ISAE; a statement that the firm applies ISQM 1 and that the practitioner complies with the independence and other ethical requirements of the IESBA Code; an informative summary of the work performed as the basis for the conclusion (for a limited assurance engagement, an appreciation of the nature, timing and extent of the procedures, stating that they are more limited than for a reasonable assurance engagement and that the assurance obtained is therefore less); the conclusion, in the appropriate form, and, where modified, a basis section; the signature; the date; and the location. The practitioner documents matters significant in providing evidence that supports the report and that the engagement was performed in accordance with the standard, assembles the final file on a timely basis, and retains it under ISQM 1.

5Examinable focus