17.1 The SSAE Attestation Framework: Assertion-Based and Direct Examinations and Reviews

17.1 The SSAE Attestation Framework: Assertion-Based and Direct Examinations and Reviews

Core Principle: An attestation engagement is one in which an independent CPA practitioner is engaged to issue an examination, review, or agreed-upon procedures report on subject matter, or an assertion about subject matter, that is the responsibility of another party (the responsible party). Governed by the AICPA's Statements on Standards for Attestation Engagements (SSAE) under the authority of the Auditing Standards Board (ASB), the attestation standards expand the CPA's assurance role beyond historical financial statements to a vast array of financial and non-financial data.

---

1. The SSAE Regulatory Framework & Codification Architecture

While historical financial statement audits are governed by Statements on Auditing Standards (SAS) codified under AU-C, non-audit assurance and attestation engagements are governed by the SSAE, codified under AT-C sections. The standard-setting authority for both frameworks rests with the AICPA's Auditing Standards Board (ASB).

+---------------------------------------------------------------------------------------------------------+
|                                AICPA PROFESSIONAL STANDARDS ARCHITECTURE                                |
|                                                                                                         |
|   FRAMEWORK:                     GOVERNING BODY:       CODIFICATION:   PRIMARY SUBJECT MATTER:          |
|   ---------------------------------------------------------------------------------------------------   |
|   Statements on Auditing         Auditing Standards    AU-C Sections   Historical Financial Statements  |
|   Standards (SAS)                Board (ASB)                           (Audits)                         |
|                                                                                                         |
|   Statements on Standards for    Auditing Standards    AT-C Sections   Subject Matter other than        |
|   Attestation Engagements (SSAE) Board (ASB)                           Historical Financial Statements  |
|                                                                                                         |
|   Statements on Standards for    Accounting & Review   AR-C Sections   Unaudited Historical FS of       |
|   Accounting & Review Services   Services Committee                    Non-issuers (Compilations/       |
|   (SSARS)                        (ARSC)                                Reviews/Preparations)            |
+---------------------------------------------------------------------------------------------------------+

The AT-C Codification Structure

The SSAE codification is organized into core series within the AT-C framework:

• AT-C Section 105 (Concepts Common to All Attestation Engagements): Establishes universal preconditions, ethical mandates, quality control standards, and acceptance criteria applicable across all attestation engagements.
• AT-C Section 205 (Assertion-Based Examination Engagements): Examinations in which the responsible party provides an assertion; reasonable assurance and an opinion.
• AT-C Section 206 (Direct Examination Engagements, added by SSAE No. 21): Examinations in which the practitioner measures or evaluates the underlying subject matter against criteria without an assertion; reasonable assurance and an opinion.
• AT-C Section 210 (Review Engagements): Governs engagements designed to obtain limited assurance resulting in a negative conclusion.
• AT-C Section 215 (Agreed-Upon Procedures Engagements): The practitioner performs procedures the engaging party has acknowledged as appropriate and reports findings without any assurance (covered in Section 17.2).
• AT-C Subject-Specific Sections: Specialized standards including AT-C 305 (Prospective Financial Information), AT-C 315 (Compliance Attestation), and AT-C 320 (Reporting on Controls at a Service Organization).

---

2. Defining Attestation & The Tripartite Relationship

At the heart of every attestation engagement is a structured tripartite relationship involving three distinct parties:

                                  THE ATTESTATION TRIPARTITE RELATIONSHIP
                                                     
                                      +-----------------------------+
                                      |      RESPONSIBLE PARTY      |
                                      |  (Management of entity that | 
                                      |    owns the subject matter) |
                                      +-----------------------------+
                                         /                       \ 
                   Provides Subject Matter/                       Responsible to Provide 
                   Written Assertion                              Information / Criteria
                                       /                           \ 
                                      v                             v
        +-----------------------------------+                 +-----------------------------------+
        |            PRACTITIONER           |                 |          INTENDED USERS           |
        |  (Independent CPA who evaluates   |                 | (Parties who rely on the report;  |
        |  subject matter against criteria) |                 |  e.g., Banks, Regulators, Public) |
        +-----------------------------------+                 +-----------------------------------+
                                            \                     /
                                             \                   /
                                          Issues Attestation Report
                                          (Examination, Review, or AUP)

Key Definitions

• Subject Matter: The phenomenon that is measured or evaluated against criteria (e.g., entity's compliance with grant provisions, effectiveness of cybersecurity controls, greenhouse gas emissions disclosures, prospective cash flows).
• Assertion: A formal, written declaration by the responsible party stating that the subject matter conforms to the specified criteria.
• Responsible Party: The party responsible for the subject matter. While usually client management, the responsible party can sometimes be a third party (e.g., a vendor whose software is being examined on behalf of a user client).
• Practitioner: The independent CPA firm engaged to perform the attestation service.

Subject Matter and Criteria Requirements (AT-C 105)

A practitioner may accept an attestation engagement only if:

1. The practitioner is independent in both fact and appearance.
2. The responsible party takes responsibility for the subject matter.
3. The subject matter is identifiable and capable of consistent evaluation or measurement against suitable criteria.
4. The criteria are suitable (objective, measurable, complete, and relevant) and available to intended users.
5. The practitioner expects to obtain the evidence needed to arrive at a conclusion or opinion.

Exam Watch: Criteria cannot be vague or subjective (e.g., "management acts with good moral judgment" is not suitable criteria). Examples of suitable criteria include specific statutory regulations, frameworks such as COSO Internal Control—Integrated Framework, or the AICPA Trust Services Criteria.

---

3. The Three Levels of Attestation Service

Under the SSAE, a CPA may provide one of three distinct levels of attestation service, each marked by differing procedural scopes, evidence-gathering thresholds, and reporting language.

+---------------------------------------------------------------------------------------------------------+
|                                   THE THREE LEVELS OF ATTESTATION SERVICE                               |
|                                                                                                         |
|   FEATURE:             EXAMINATION (AT-C 205)      REVIEW (AT-C 210)           AGREED-UPON PROCEDURES   |
|   ---------------------------------------------------------------------------------------------------   |
|   Level of Assurance   Reasonable Assurance        Limited Assurance           NO Assurance             |
|                        (High, but not absolute)    (Moderate / Sub-audit)      (Zero assurance)         |
|                                                                                                         |
|   Form of Reporting    Positive Opinion            Negative Conclusion         List of Factual Findings |
|                        ("In our opinion...")       ("We are not aware...")     (No opinion or summary)  |
|                                                                                                         |
|   Primary Procedures   Inspection, observation,    Inquiry and Analytical      Procedures specifically  |
|                        confirmation, reperformance, Procedures ONLY            stipulated by specified  |
|                        testing internal controls   (Substantive tests barred)  parties                  |
|                                                                                                         |
|   Report Distribution  General Use (usually)       General Use (usually)       General or restricted      |
|                        or Restricted Use           or Restricted Use           (practitioner judgment) |
|                                                                                                         |
|   Sufficiency of       Practitioner determines     Practitioner determines     ENGAGING PARTY        |
|   Procedures           procedural sufficiency      procedural sufficiency      acknowledges appropriateness|
+---------------------------------------------------------------------------------------------------------+

Level 1: Examination Engagements (AT-C 205)

An examination is the attestation equivalent of a financial statement audit.

• Assurance: Provides reasonable assurance that the subject matter complies with the criteria in all material respects.
• Work Effort: Requires extensive risk assessment, understanding and testing of internal controls if relied upon, inspection, confirmation, recalculation, and analytical verification.
• Reporting: Expresses a positive opinion. Standard unmodified wording: "In our opinion, the subject matter is presented in accordance with the specified criteria, in all material respects." (Alternatively, the practitioner may express an opinion directly on management's assertion).
• Modifications: If material non-compliance or material misstatement exists, the practitioner must express a qualified opinion or an adverse opinion. If there is a material scope limitation, the practitioner must express a qualified opinion or disclaim an opinion.

Level 2: Review Engagements (AT-C 210)

A review provides a moderate level of assurance based on limited procedures.

• Assurance: Provides limited assurance that no material modifications should be made to the subject matter.
• Work Effort: Consists primarily of inquiries and analytical procedures. Substantive tests of details, corroborative confirmations, and control testing are not performed.
• Reporting: Expresses a negative conclusion. Standard unmodified wording: "Based on our review, we are not aware of any material modifications that should be made to the accompanying subject matter in order for it to be in accordance with the specified criteria."
• Review Engagements Not Permitted: A practitioner may not perform a review of:
  1. Prospective financial information (forecasts and projections).
  2. Internal control.
  3. Compliance with requirements of specified laws, regulations, rules, contracts, or grants (compliance attestation is limited to examinations and agreed-upon procedures).

Level 3: Agreed-Upon Procedures (AUP) Engagements (AT-C 215)

An AUP engagement reports the procedures performed and the findings, with no opinion, conclusion, or negative assurance. SSAE No. 19 changed this engagement substantially: no written assertion is required, users other than the engaging party need not agree to the procedures, and the report may be for general use. Section 17.2 covers AUP engagements in detail.

---

4. Preconditions & Written Assertion Requirements

Written Assertions by Engagement Type

Direct Examination Engagements (SSAE No. 21, AT-C 206)

SSAE No. 21, effective for reports dated on or after June 15, 2022, created direct examinations. The practitioner obtains reasonable assurance by measuring or evaluating the underlying subject matter against the criteria and expresses an opinion that conveys the result, without requesting an assertion from the responsible party.

• Why it exists: Some entities want an examination but are not positioned to make an assertion about the subject matter, such as nonfinancial metrics.
• What does not change: The practitioner must be independent, the criteria must be suitable and available, and the responsible party must acknowledge responsibility for the underlying subject matter.
• How it works: The practitioner applies the AT-C 205 requirements unless they cannot apply as written or AT-C 206 replaces them.
• New terms: The underlying subject matter is what is measured or evaluated; the subject matter information is the outcome of that measurement or evaluation. SSAE No. 21 also renamed AT-C 205 "Assertion-Based Examination Engagements."

---

5. Prospective Financial Statements (AT-C 305)

Prospective financial statements are forward-looking financial presentations. Under AT-C 305, there are two distinct categories of prospective statements that candidates must differentiate:

+---------------------------------------------------------------------------------------------------------+
|                                 PROSPECTIVE FINANCIAL PRESENTATIONS                                     |
|                                                                                                         |
|   DIMENSION:              FINANCIAL FORECAST                     FINANCIAL PROJECTION                   |
|   ---------------------------------------------------------------------------------------------------   |
|   Basis of Assumptions    EXPECTED CONDITIONS                    HYPOTHETICAL ASSUMPTIONS               |
|                           Reflects expected conditions and       Reflects a 'what-if' scenario not      |
|                           expected courses of action             necessarily expected to occur          |
|                                                                                                         |
|   Permitted Distribution  GENERAL USE or LIMITED USE             LIMITED USE ONLY                       |
|                           Suitable for broad public release      Restricted strictly to parties with    |
|                           (e.g., bond offering, prospectus)      whom entity is directly negotiating    |
|                                                                                                         |
|   Permissible Services    1. Examination (AT-C 205)              1. Examination (AT-C 205)              |
|                           2. Agreed-Upon Procedures (AT-C 215)   2. Agreed-Upon Procedures (AT-C 215)   |
|                           3. Preparation / Compilation (SSARS)   3. Preparation / Compilation (SSARS)   |
|                           (Review is PROHIBITED)                 (Review is PROHIBITED)                 |
+---------------------------------------------------------------------------------------------------------+

Financial Forecasts vs. Financial Projections

1. Financial Forecast: Presents an entity's expected financial position, results of operations, and cash flows to the best of the responsible party's knowledge and belief. It is based on assumptions reflecting conditions management expects to exist and the course of action management expects to take.
   • Distribution: May be issued for general use (e.g., to potential equity investors, lenders, or the general public) or limited use.
2. Financial Projection: Presents prospective results given one or more hypothetical assumptions (e.g., "What will our net income look like if we acquire our competitor and double our production capacity?").
   • Distribution: Because hypothetical assumptions cannot be properly evaluated by uninformed third parties, a financial projection is strictly restricted to limited use (e.g., direct negotiation with a commercial bank for a specific credit line). General use of a financial projection is strictly prohibited!

Required Procedures in an Examination of Prospective Financial Statements

When examining a forecast or projection under AT-C 305, the practitioner must evaluate:

• The preparation and presentation of the prospective statements for conformity with AICPA presentation guidelines.
• The reasonableness of the underlying assumptions:
  • For forecasts: Whether the assumptions provide a reasonable basis for the forecast.
  • For projections: Whether the hypothetical assumptions are consistent with the purpose of the projection and all other assumptions provide a reasonable basis given the hypothetical assumptions.

Exam Trap: The practitioner's examination report on prospective financial statements never guarantees or assures that the prospective results will actually be achieved. In fact, every examination report includes an explicit caveat stating: "There will usually be differences between the forecasted and actual results because events and circumstances frequently do not occur as expected, and those differences may be material."

---

6. Master Attestation Comparison Matrix

---

7. Realistic Exam Scenarios & Traps

Scenario 1: Releasing a Projection to the General Public

• Situation: A startup company prepares a 5-year financial projection based on hypothetical assumptions regarding receiving FDA regulatory approval for a medical device. The startup asks a CPA to examine the projection and include the report in a public crowdfunding campaign.
• Resolution: The CPA must refuse to issue the examination report for general public distribution. Projections contain hypothetical assumptions and cannot be distributed to general users. The CPA can only issue the examination report if distribution is restricted to specified negotiating parties (such as a specific venture capital firm).

Scenario 2: Providing Negative Assurance in an AUP Engagement

• Situation: A bank requests that a CPA perform agreed-upon procedures on a borrower's accounts receivable aging schedule and add a concluding sentence stating, "Nothing came to our attention that caused us to believe the aging schedule is materially misstated."
• Resolution: The CPA cannot comply. Under AT-C 215, negative assurance is strictly prohibited in an AUP report. The CPA may only list the procedures performed and the resulting objective factual findings.