AT-C 205: Assertion-Based Examination Engagements

The American Institute of Certified Public Accountants (AICPA) provides a framework for examination engagements. Governed by AT-C Section 205, an assertion-based examination is a service where a certified public accountant (CPA) provides a high level of assurance on a formal statement, or “assertion,” made by a company’s management. This differs from a direct examination, where a practitioner reports on the subject matter without a written assertion from the responsible party.

An assertion-based examination involves a practitioner independently gathering evidence to support a conclusion about the accuracy of a company’s claim. This process is distinct from a financial statement audit as it can cover a wide range of non-financial topics, resulting in a formal opinion for stakeholders, regulators, or other interested parties.

Core Concepts of an Assertion-Based Examination

An assertion-based examination involves several distinct parties and concepts. The practitioner is the independent CPA or firm engaged to perform the examination, who must possess the competence and objectivity to evaluate the subject matter without bias.

The responsible party, usually company management, makes the assertion and is accountable for the subject matter. This party must have a reasonable basis for its assertion and provide it in writing to the practitioner.

The subject matter is the specific area being evaluated. This can be diverse, ranging from the effectiveness of internal controls over financial reporting to compliance with specific contractual obligations. Other examples include the measurement of greenhouse gas emissions or the security of IT systems. The nature of the subject matter dictates the evidence the practitioner must gather.

The assertion is the responsible party’s formal, written declaration about the subject matter. For instance, an assertion might state, “Management of XYZ Company asserts that its system of internal control over compliance with Regulation AB was effective as of December 31, 2025.” This statement is the focus of the practitioner’s work.

Criteria are the benchmarks used to measure the subject matter, which must be objective, measurable, complete, and relevant. For an examination of internal controls, the COSO framework is a common example, while other criteria may be found in laws or contracts.

The outcome is examination-level assurance, which is a high, but not absolute, level of assurance. It means the practitioner has obtained sufficient evidence to reduce the risk of a material misstatement to an acceptably low level, allowing for a positive opinion.

Preconditions for Accepting an Engagement

Before accepting an engagement, a practitioner must ensure several preconditions are met. These safeguards confirm the engagement is appropriate and can be performed according to professional standards. The practitioner must be independent and possess the professional competence to handle the specific subject matter.

The responsible party must accept its responsibilities in writing. This includes acknowledging its accountability for the subject matter and for having a reasonable basis for its assertion.

The practitioner must determine that the subject matter is appropriate. An appropriate subject matter can be consistently measured against suitable criteria and is subject to procedures for gathering sufficient evidence.

The criteria used for the evaluation must be suitable and available to the intended users of the report. This allows them to understand the basis for the practitioner’s conclusion. If the criteria are developed by the responsible party, the practitioner must scrutinize them for potential bias.

Finally, the practitioner must secure specific agreements from the responsible party. The responsible party must agree to provide its written assertion; without it, an assertion-based examination cannot be performed. The responsible party must also agree to provide the practitioner with access to all relevant information and unrestricted access to personnel. It must also agree to provide a written representation letter at the conclusion of the engagement.

Performing the Examination Engagement

Once preconditions are met, the practitioner plans the engagement by developing an overall strategy and a detailed work plan. This involves gaining a deeper understanding of the subject matter, the applicable criteria, and the entity’s operations.

The practitioner then assesses the risk of material misstatement. This is done by considering the nature of the subject matter, the entity’s processes, and its internal controls. This risk assessment forms the basis for designing the specific procedures to be performed.

With the risks identified, the practitioner obtains evidence by performing various procedures. These depend on the subject matter but include inspection of records and documents, observation of processes, and inquiry of knowledgeable persons within the entity. For example, when examining an assertion about regulatory compliance, the practitioner might inspect compliance reports, observe relevant control activities, and interview the compliance officer. The goal is to accumulate sufficient evidence to reduce attestation risk to an acceptably low level.

Toward the end of the engagement, the practitioner must obtain a written representation letter from the responsible party. In this letter, dated as of the practitioner’s report, the responsible party reconfirms its responsibilities and the information it provided. This letter serves as corroborating evidence but does not replace other necessary procedures.

The Practitioner’s Examination Report

The practitioner’s examination report is the formal, written communication of the conclusion to intended users. The report’s title must include the word “independent” to emphasize objectivity. It is addressed to the appropriate parties, such as the company that engaged the practitioner.

The report’s body identifies the responsible party’s assertion, the subject matter, and the criteria used for evaluation. It includes separate paragraphs describing the responsibilities of both the responsible party and the practitioner. The practitioner’s responsibility section summarizes the work performed, stating the examination followed AICPA attestation standards to obtain reasonable assurance.

The report provides the practitioner’s opinion on the assertion. There are four types of opinions:

• Unmodified opinion: Issued when the practitioner concludes that the responsible party’s assertion is fairly stated in all material respects.
• Qualified opinion: Issued when a material misstatement is found that is not pervasive to the subject matter.
• Adverse opinion: Issued when a material misstatement is found that is pervasive, stating the assertion is not fairly stated.
• Disclaimer of opinion: Issued when the practitioner is unable to obtain sufficient evidence to form an opinion.