2.5 Why Users Demand Assurance: Benefits, Information Risk & Sustainability Reporting
Key Takeaways
- ICAB Syllabus 2023 outcome 1(b) requires candidates to state why users desire assurance reports and to give examples of the benefits, including assurance over a published corporate responsibility or sustainability report.
- Assurance exists to reduce information risk — the risk that information used for a decision is materially wrong — which is created by remoteness, bias, volume and complexity.
- Credible assurance lowers the cost of capital, supports lending decisions, deters management manipulation and gives directors independent feedback on their systems.
- Sustainability and corporate responsibility reports are commonly assured at a limited assurance level under ISAE 3000 (Revised), giving a negatively expressed conclusion.
- Assurance is valuable but bounded: it does not guarantee solvency, does not test every transaction and does not transfer responsibility for the information away from management.
Why Users Demand Assurance: Benefits, Information Risk & Sustainability Reporting
ICAB Syllabus 2023 requires candidates to "state why users desire assurance reports and provide examples of the benefits gained from them such as to assure the quality of an entity's published corporate responsibility or sustainability report." That outcome is examined in two directions: why assurance is wanted at all, and what kinds of information — not only financial statements — get assured.
1. The problem assurance solves: information risk
Information risk is the risk that the information a decision-maker relies on is materially inaccurate, incomplete or biased. A bank in Motijheel deciding whether to extend a BDT 400 million working-capital facility to a ready-made garments exporter is not principally worried about the exporter's ability to type numbers into a spreadsheet. It is worried that the numbers may not faithfully represent the business.
Four structural features of modern business create information risk:
| Driver | What it means | Illustration |
|---|---|---|
| Remoteness | Users cannot personally inspect the entity's records. | A pension fund in Dhaka holding shares in a Chattogram manufacturer has no access to its ledgers. |
| Bias and conflict of interest | The preparer benefits from a favourable picture. | Directors whose bonuses depend on reported profit prepare the profit figure. |
| Volume of data | Millions of transactions cannot be reviewed by users. | A telecom operator processes billions of call records feeding revenue. |
| Complexity | Judgement-laden areas are hard for non-specialists to evaluate. | Expected credit loss provisioning, lease accounting, revenue recognition on long-term contracts. |
Assurance does not remove information risk. It reduces it to a level that supports confident decision-making, by inserting an independent, competent, sceptical professional between preparer and user.
2. The specific benefits users obtain
Do not answer an exam question on this with a single word like "credibility". The syllabus asks for benefits, plural, and there are several distinct ones:
- Enhanced credibility and confidence. An independent conclusion makes the information more believable than management's own word.
- Lower cost of capital. Lenders and investors price uncertainty. Where audited information reduces uncertainty, required returns and interest margins fall, and access to bank credit improves.
- A deterrent effect. The knowledge that an independent professional will examine the records deters both fraudulent financial reporting and misappropriation of assets. This benefit accrues even in years when nothing is found.
- Independent feedback to management and those charged with governance. The management letter reporting control deficiencies is a genuine by-product benefit for the board.
- Regulatory and contractual compliance. Statutory audit is required by the Companies Act 1994; lending covenants, donor agreements and licensing conditions frequently require audited or reviewed information.
- Improved data quality within the entity. Preparing for assurance forces reconciliations, cut-off discipline and documentation that would otherwise slip.
- Comparability. Where many entities are assured against the same criteria, users can compare them meaningfully.
3. Beyond the financial statements: corporate responsibility and sustainability reports
The syllabus deliberately uses a non-financial example. Bangladeshi exporters — particularly in ready-made garments — publish sustainability and corporate responsibility information because international buyers, development finance institutions and regulators demand it. That information covers matters such as factory safety remediation, effluent treatment, energy and water consumption, greenhouse gas emissions, worker headcount and wage data, and supply-chain due diligence.
Users face exactly the same problem here as with financial data: the entity has a strong incentive to present favourably, the user cannot verify, and the subject matter is technical. So the same structure applies.
| Element of the engagement | Financial statement audit | Sustainability report assurance |
|---|---|---|
| Subject matter | Financial position and performance | Emissions, water use, safety incidents, labour metrics |
| Criteria | IFRS/BFRS and the Companies Act 1994 | A reporting framework such as GRI, ISSB standards, or the entity's own stated basis of preparation |
| Practitioner | Statutory auditor | Assurance practitioner (often the same firm, a separate team) |
| Standard applied | ISAs (BSAs as adopted) | ISAE 3000 (Revised), Assurance Engagements Other than Audits or Reviews of Historical Financial Information |
| Typical level | Reasonable assurance | Limited assurance is by far the most common in practice |
| Form of conclusion | Positive: "in our opinion…" | Negative: "nothing has come to our attention…" |
Two points regularly earn marks. First, the criteria must be suitable and available to users; if an entity assures a "carbon intensity" figure, the definition and calculation basis must be disclosed, otherwise the criteria are neither relevant nor understandable. Second, the assurance level must be stated clearly, because a limited assurance conclusion on a sustainability report is materially weaker than an audit opinion and users must not confuse them.
4. What assurance does not do
Being able to state the limits is as examinable as stating the benefits, and it links directly to the expectation gap.
- Assurance is not a guarantee of solvency or future viability. A clean opinion on last year's statements says nothing conclusive about next year's survival.
- Assurance is not a certificate of accuracy. It addresses material misstatement, not every rupee.
- Assurance does not test every transaction. Selective testing is inherent to the exercise.
- Assurance does not transfer responsibility. Management remains responsible for the subject matter information; the practitioner is responsible only for the conclusion.
- Assurance does not detect all fraud, particularly where senior management colludes or forges documents.
5. Applying this in a scenario
A typical item gives a scenario and asks what benefit assurance provides, or whether assurance is appropriate. Work through it in order:
- Who is the user and what decision are they making? Lender, buyer, regulator, donor, shareholder.
- What is the information risk? Bias, remoteness, complexity, volume.
- Are the five elements present? Three parties, appropriate subject matter, suitable criteria, evidence obtainable, written report.
- What level of assurance fits the need and the budget? Reasonable for statutory reporting; limited where the user wants meaningful but not high comfort.
- What is the honest limit? Say what the engagement will not deliver.
A ready-made garments exporter publishes an annual sustainability report covering effluent treatment and worker safety data, and engages a CA firm to provide assurance over it. Which standard and level of assurance would most commonly apply?
Which of the following best describes 'information risk' as the underlying reason users demand assurance?
A shareholder complains that the auditor issued an unmodified opinion on a company that entered liquidation eleven months later. Which statement correctly describes the limits of assurance?