Assurance engagement process

Levels of assurance

The level of assurance directly correlates with the confidence in the audited information.

There are two main levels of assurance: 

● reasonable assurance

● limited assurance.

Achieving absolute assurance, where there is no engagement risk, is extremely rare. 

To provide greater assurance, an auditor must conduct a more thorough and rigorous evaluation.

Reasonable assurance

Reasonable assurance is achieved by reducing the risk of the assurance engagement to an acceptably low level. This enables the auditor to make a positive statement in their conclusion.

Reasonable assurance provides a high level of confidence, but not absolute certainty.

To achieve reasonable assurance, the auditor must gather sufficient evidence.

Auditors typically use reasonable assurance for most audits.

Limited assurance

Limited assurance means reducing assurance engagement risk to a level that is acceptable in the circumstances of the assurance engagement. The risk is still greater than it is for a reasonable assurance engagement. This leads to a negative statement in the auditor's conclusion.

Evidence-gathering procedures are limited in comparison with a reasonable assurance engagement.

An assurance engagement's purpose is to get an independent conclusion on whether the audited body has complied with legislation.

The assurance process is made up of 4 key phases.

Phases of the assurance process

The three-party relationship

For an audit to be independent, a third-party relationship must exist between us, the audited body and the audit team leader.

This relationship must exist where:

● we are the intended users of the audit report

● the audited body must comply with legislation related to schemes administered by us

● the audit team leader is responsible for either:

● independently assessing information and providing an assurance conclusion

● performing verification engagement procedures in line with engagement terms.

The circumstances surrounding the relationship may be different from where the engagement started because either:

● we required the audited body to seek an audit for compliance purposes

● we appointed the audit team leader on the basis of a risk management approach

● the audited body sought the audit voluntarily.

If we need the audited body to obtain an audit as part of a compliance audit, the three-party relationship remains the same. It also remains the same if we appoint the audit team leader for audits under our audit program.

If the audited body sought the audit voluntarily, the directors of that body are the intended users of the audit report.

Templates and guides