Chapter 20 - Additional Assurance Services: Other Information

CHAPTER 20

Additional Assurance Services:

Other Information

Review Questions
20-1

Assurance services are independent professional services that improve the quality of information,
or its context for decision makers; attestation services are those assurance services that involve
issuing an examination, review or agreed-upon procedures report on subject matter (or an assertion
about the subject matter) that is the responsibility of another party. Assurance services may go
beyond attestation services in that they may involve analyzing data or placing it in a form to
facilitate decision making.

20-2

The statement is incorrect. While it is correct that all attest services are assurance services, some
assurance services are not attest services (e.g., some PrimePlus/ElderCare engagements)

20-3

Assurance services developed as a natural extension of the audit function. Management has
recognized that contracting costs may be reduced in many situations by providing users access to
information that is certified as to its reliability. Developments in information technology also have
fueled the demand for assurance services as users can now have instantaneous access to a broad
range of "on-line" information that may be customized to their needs.

20-4

No. While attestation engagements involve a written report, not all assurance services result in a
written report as any reasonable form of communication is acceptable.

20-5

The three types of attestation engagements outlined in the attestation standards are:
(1) ExaminationAn examination is designed to provide the highest level of assurance that CPAs
providethe same level as an audit of financial statements. When performing an examination,
CPAs select procedures to gather sufficient evidence to allow the issuance of a report with a
positive opinion on whether the subject matter being examined are presented in accordance
with the selected criteria. Sufficient evidence has been obtained when attestation risk is driven
to a low level.

20-1

Chapter 20 - Additional Assurance Services: Other Information

(2) ReviewA review involves performing limited procedures, such as inquiries and analytical
procedures. In performing a review, the CPAs gather sufficient evidence to drive attestation
risk to a moderate level.
(3) Agreed-upon proceduresAn agreed-upon procedures engagement involves performing
procedures that were agreed-upon with specified users of the report. Reports on agreed-upon
procedures are restricted use reports in that they are intended only for those specified users.
20-6

Agreed-upon procedures engagements result in restricted use reports, whereas examinations and
reviews ordinarily result in general use reports. (However, nothing in the attestation standards
prohibits CPAs from restricting either an examination or a review report.)

20-7

In an attestation engagement the practitioners report either directly on the subject matter or on an
assertion about the subject matter. The subject matter of an attestation engagement may take many
forms, including:

Historical or prospective performance or condition.

Physical characteristics.
Historical events.
Analyses.
Systems or processes.
Behavior.

If the practitioner is reporting on an assertion about the subject matter, that written assertion is
presented with the subject matter or in the practitioner's report.
20-8

Suitable criteria are criteria used in preparing information that are objective and permit reasonably
consistent measurement. Criteria are ordinarily suitable when they are developed by regulatory
agencies or other bodies composed of experts that se due process, including exposing the proposed
criteria for public comment. For example, in the case of a financial forecast, the AICPA has
developed such suitable criteria. In financial reporting, GAAP are in essence a set of suitable
criteria but are referred to as a financial reporting framework.

20-9

Attestation risk is the risk that the practitioner will unknowingly fail to appropriately modify their
report on subject matter that is materially misstated. Attestation risk consists of three components
inherent risk, control risk, and detection risk. Inherent risk is the risk that the subject matter is
materially misstated before considering internal control. Control risk is the risk that internal
control will fail to prevent or detect a material misstatement of the subject matter, and detection
risk is the risk that the practitioners procedures will fail to detect a material misstatement of the
subject matter. In an attestation engagement, the practitioners assess inherent and control risks and
design procedures to restrict detection risk to the appropriate level.

20-2

Chapter 20 - Additional Assurance Services: Other Information

20-10 The statement is correct. A material departure from the suitable criteria during an examination will
result in a qualified or adverse opinion.
20-11 XBRL (eXtensible Business Reporting Language), is an international information format designed
specifically for business information. It assigns all individual disclosure items within business
reports unique electronically readable tags that are mapped to taxonomies. The AICPAs XBRL
Assurance Task Force is in the process of developing guidance that will assist CPAs in public
practice who are requested to provide assurance on XBRL-related documents. The task force is
currently focusing on:

Developing practice guidance that will assist CPAs in applying existing standards to
information reported in XBRL format;
Recommending, where deemed necessary and appropriate, to the appropriate standard
setting bodies changes to existing standards and/or the development of new standards;
and
Collaborating with key stakeholders, including the SEC, PCAOB, various AICPA
groups, and others.

20-12 The statement is not valid. A financial projection presents expected results, given one or more
hypothetical assumptions and its use is restricted to the party with whom the company is
negotiatingfor example, a bank that is considering loaning funds to the company to acquire
additional inventory. A financial forecast presents the entity's expected financial position, results of
operations, and cash flows, and is more appropriate than is a financial projection for inclusion in
an annual report.
20-13 A report on an examination of a financial forecast includes:

An identification of the forecasted financial statements.

A statement that the examination was made in accordance with AICPA standards and a brief
description of the nature of such an examination.
The CPA's opinion on whether the forecasted financial statements are presented in conformity
with AICPA presentation guidelines and that the underlying assumptions provide a reasonable
basis for the forecast.
A warning that the prospective results may not be achieved.
A statement that the CPA has no responsibility to update the report for events and
circumstances occurring after the date of the report.

20-14 The two types of compliance services are:

(1)
(2)

Attesting to an entity's compliance with specified requirements of laws, regulations, rules,

contracts, or grants, and
Attesting to the effectiveness of an entity's internal control over compliance with specified
requirements.

20-3

Chapter 20 - Additional Assurance Services: Other Information

20-15 CPAs may examine Management's Discussion and Analysis (MD&A) when they have (1) audited
the most recent financial statement period to which the MD&A applies, and (2) the other financial
statement periods have also been audited by them or by other auditors.
20-16 The practitioners' objectives in an examination of Managements Discussion and Analysis are to
provide assurance about whether:
(1)
(2)
(3)

The presentation includes, in all material respects, the required elements of the rules and
regulations adopted by the SEC.
The historical financial amounts included in the presentation have been accurately derived,
in all material respects, from the entity's financial statements.
The underlying information, determinations, estimates, and assumptions provide a
reasonable basis for the disclosures contained in the presentation.

20-17 The principles that may be included in a Trust Services engagement are:
(1)
(2)
(3)
(4)
(5)

Security. The system (infrastructure, software, people, procedures, and data) is protected
against unauthorized physical and logical access in conformity with the entitys security
processes.
Availability. The system is available for operation and use in conformity with the entitys
availability policies.
Processing Integrity. System processing is complete, accurate, timely, and authorized.
Online Privacy. Private information obtained as a result of electronic commerce is
collected, used, disclosed, and retained in conformity with entitys policies.
Confidentiality. Information designated as confidential is protected in conformity with the
entitys confidentiality policies.

20-18 The purpose of a WebTrust engagement is essentially to provide assurance on electronic commerce
systems. A WebTrust engagement is designed to provide assurance to individuals or organizations
about the practices and controls of an entity that they are contracted with over the Internet.
SysTrust engagements involve providing assurance on system controls. A SysTrust report assures
individuals inside and outside of the company that a system is reliable when evaluated against the
principles.
20-19 Several organizations provide services competing with WebTrust. The Better Business Bureau
provides a BBBOnLine program with two different logos-a privacy seal and a reliability seal.
Another program offered by TRUSTe provides assurance that customer information will be
protected and not used for other purposes. Finally, the International Computer Security
Association offers a program with certification of Websites as using technology that protects
customer data.

20-4

Chapter 20 - Additional Assurance Services: Other Information

20-20 CPAs may provide examination or agreed-upon procedures engagements for SysTrust or WebTrust.
A review level service is not allowed.
20-21 PrimePlus/ElderCare Services include financial services include goal setting, funding analysis, cost
management and needs assessment and nonfinancial services such as interpersonal and relationship
management, as well as interaction of service providers with the client. Figure 20.1 provides more
detailed examples.
20-22 Assurance services that are currently under development by the AICPA include (only two required):

XBRL, eXtensible Business Reporting Language, is an international information format

designed specifically for business information. The AICPAs XBRL Assurance Task Force is
in the process of developing guidance that will assist CPAs in public practice who are
requested to provide assurance on XBRL-related documents.

Health care performance measurementproviding assurance about the effectiveness of

health care services provided by health maintenance organizations (HMOs), hospitals, doctors,
and other providers.

Continuous auditingproviding assurance using a series of reports provided simultaneously

or shortly after the related information is released.

Questions Requiring Analysis

20-23

(a)
Assurance services are independent professional services that improve the quality
of information or its context for decision makers.
(b)

Assurance services are currently developing as a natural extension of the audit function.
Management has recognized that contracting costs may be reduced in many situations by
providing users access to information that is certified as to its reliability. In addition,
developments in information technology have fueled the demand for assurance services as
users can now have instantaneous access to a broad range of "on-line" information that is
customized to their needs.

(c)

The Statements of Standards for Attestation Engagements govern the nature of

attestation services performed by CPAs. Attestation services are restricted to those that
involve issuing an examination, review, or agreed-upon procedures report on subject
matter, or on an assertion about subject matter that is the responsibility of another party.
Also, in an attestation engagement, the CPAs must evaluate the subject matter of the
engagement against suitable criteria.

20-5

Chapter 20 - Additional Assurance Services: Other Information

20-24

(a)
Examinations (referred to as audits for historical financial statements), reviews,
and agreed-upon procedures engagements.
(b)

ExaminationsThe practitioners select from all available procedures to gather sufficient

evidence to reduce attestation risk to a low level.
ReviewThe practitioners perform limited procedures, such as inquires and analytical
procedures. If the results of those procedures indicate that information may be misstated,
additional procedures are performed.
Agreed-upon procedures engagementsThe practitioner performs those procedures that
were agreed-upon with the specified users of the report. Those procedures may range from
being very limited to being very comprehensive.

(c)

ExaminationsA positive opinion on whether the information follows the established

or stated criteria.
ReviewsLimited, also referred to as negative, assurance is provided. The report includes
a statement such as "we are not aware of any material modifications that should be made
in order for the information to be in conformity with the appropriate criteria.
Agreed-upon proceduresThese reports result in a statement of findings.

(d)

20-25

Agreed-upon procedures engagements are never considered appropriate for general

use; they are restricted for use only by the specified users who participated in determining
the procedures followed in the engagement. Examinations and reviews are ordinarily
appropriate for general use, although nothing in the attestation standards prohibits
restricting their use.
(a)
The standards for an examination of a financial forecast are contained in the
AICPA's Guide for Prospective Financial Statements. The practitioners must gather
information that provides a basis for reporting whether (1) the forecast is presented in
accordance with AICPA guidelines, and (2) the underlying assumptions provide a
reasonable basis for the forecast.
In examining the forecast, the practitioners gather evidence relating to the client's
procedures for preparation of the information, evaluate the underlying assumptions, test
the mathematical accuracy of translating the assumptions into the forecast, and obtain a
written representation letter from the client.

20-6

Chapter 20 - Additional Assurance Services: Other Information

(b)

An examination report should include the following:

(1)
(2)
(3)
(4)
(5)

20-26

An identification of the forecasted statements.

A statement that the examination was in accordance with AICPA standards and
a brief description of such an examination.
The practitioner's opinion on whether the statements follow AICPA
presentation guidelines and whether the underlying assumptions are reasonable.
A warning that prospective results may not be achieved.
A statement that the practitioner has no responsibility to update the report.

(a)
During a Trust Services Engagement the CPAs report on one or more of the
following principles:
1. Security. The system is protected against unauthorized access (both physical and
logical).
2. Availability. The system is available for operation and use as committed or agreed.
3. Processing integrity. System processing is complete, accurate, timely, and authorized.
4. Confidentiality. Information designated as confidential is protected as committed or
agreed
upon.
5. Privacy. Personal information is collected, used, retained, disclosed and destroyed in
conformity with the commitments in the entitys privacy notice and with criteria set

forth
in generally accepted privacy principles issued by the AICPA and CICA.
(b)

20-27

Several organizations provide services competing with WebTrust. The Better Business
Bureau provides a BBBOnLine program with two different logosa privacy seal and a
reliability seal. Another program offered by TRUSTe provides assurance that customer
information will be protected and not used for other purposes. TRUSTe tests information
confidentiality by seeding phony information into its clients' databases to determine
whether it turns up in another database. Finally, the International Computer Security
Association (ICSA) offers a program with certification of Websites as using technology
that protects customer data. ICSA's process includes a combination of self-reporting, onsite evaluation, remote testing, and spot testing.
(a)
Criteria are needed for an attestation engagement because it is the criteria which
serve as the standards or benchmarks that are used to evaluate the subject matter of the
engagement. The client's information is measured against these standards. Without such
standards there would be no basis for comparison.

(b)

Suitable criteria are objective and permit reasonably consistent measurements. Also,
suitable criteria must be sufficiently complete such that no relevant factors are omitted that
would affect a conclusion about the subject matter. Finally, suitable criteria should
measure some characteristic of the subject matter that is relevant to a user's decision.
(c)
Criteria may be available to users in a variety of manners. If a regulatory agency
or an expert body using due process developed the criteria, they are likely to be publicly
available to users. Alternatively, the criteria may be made available to the users in the
presentation of the subject matter, in the assertion, or in the practitioners' report.

20-7

Chapter 20 - Additional Assurance Services: Other Information

Multiple Choice Questions

20-28

(a) (2) The second standard of reporting for attestation engagements requires that the
report state the practitioner's conclusion about the subject matter, or an assertion about the
subject matter, based on the criteria against which the subject matter was measured.
(b)

(4) The attestation standards relating to financial forecasts require that when several
significant assumptions are not listed that an adverse opinion be issued.

(c)

(2) While an attestation report on MD&A does state that the presentation includes the
required elements of the rules and regulations adopted by the SEC, it does not include an
opinion that the presentation is in conformity with rules and regulations adopted by the
SEC.

(d)

(2) A SysTrust report includes an opinion on management's assertion that the Website
meets one or more of the SysTrust principles.

(e)
(f)

(1) Unreasonable significant assumptions for a forecast result in an adverse

opinion.
(4) The accounting profession is developing assurance services relating to XBRL
(eXtensible Business Reporting Language), an international information format designed
specifically for business information. XBRL assigns all individual disclosure items within
business reports unique electronically readable tags that are mapped to taxonomies that are
currently being developed by.

(g)

(1) PrimePlus/ElderCare services may be either financial or nonfinancial in

nature.

(h)

(1) CPAs may report on compliance, effectiveness of internal control over

compliance, or both.

(i)

(2) All attest services are also assurance services. Thus answer (2) is impossiblea
service that is not an assurance service, but is an attest service.

(j)

(3) Suitable criteria are the criteria followed in the preparation of the subject matter.
Accordingly, suitable criteria are not the subject matter.

(k)

(2) A compilation is not an attest engagement. No explicit assurance is provided in this

type of engagement.

(l)

(4) Trust services deal with the issues of security, availability, processing integrity,
confidentiality and privacy.

20-8

Chapter 20 - Additional Assurance Services: Other Information

20-29
Client Need

Type of Service

a.

A computer manufacturing company wants to

provide assurance about estimated future results to
be included in the companys annual report.

b.

A record retailer wants to provide assurance about

its security and business practices to provide to
potential Internet customers.
A financial institution wants to provide assurance
to banking regulators that its internal control over
financial reporting is adequate.
A company that maintains a business-to-business
electronic commerce portal wants to provide
assurance about the reliability of its system to
potential customers.
The relative of an institutionalized uncle wants a
CPA firm to oversee the uncles financial affairs.
A public company wants to provide its
shareholders assurance about the narrative analysis
of financial results provided in the companys
Form 10-K.
A grocery store wants to provide the highest level
of assurance that its prices are less than the prices
of its competitors.
A bank wants a CPA firm to confirm account
receivables of a company that has pledged the
receivables as collateral for a loan.
A golf ball manufacturer wants to provide
moderate assurance that its golf balls travel further
than those of its competitors.
Management of a technology company wants a
CPA firm to provide assurance that its risk
assessment process has identified all major
business risks.

c.
d.

e.
f.

g.
h.
i.
j.

20-30
(a)
(b)
(c)
(d)
(e)

May provide; independence is not required.

May not provide.
May not provide.
May provide; independence is required.
May provide; independence is not required.

(a)
(b)
(c)
(d)
(e)
(f)

6
2
7
9
8
1

20-31

20-9

Attestation
Service?

Level of Service

Attestation to
prospective
information

Yes

Examination

WebTrust

Yes

Examination

Audit of internal
control

Yes

Audit
(Examination)

SysTrust

Yes

Examination

PrimePlus/Elder
Care Services
Attestation to
MD&A

No

Other

Yes

Examination

Attestation to
prices

Yes

Examination

Agreed-upon
procedures
engagement
Attestation to
distance

Yes

Other (statement of
findings)

Yes

Review

Other assurance

No

Other

Chapter 20 - Additional Assurance Services: Other Information

20-32
(a)
(b)
(c)
(d)
(e)
(f)

10
12
13
11
2
3

(g) 5
(h) 4
Problems
20-33

(a)

The Trust Service principles include:

(1)

Security. The system (infrastructure, software, people, procedures, and data) is

protected against unauthorized physical and logical access in conformity with the
entitys security processes.
Availability. The system is available for operation and use in conformity with the
entitys availability policies.
Processing Integrity. System processing is complete, accurate, timely, and
authorized.
Confidentiality. Information designated as confidential is protected as committed
or agreed to.
Online Privacy. Personal information is collected, used, retained, disclosed and
destroyed in conformity with the commitments in the entitys privacy notice and
with criteria set forth in generally accepted privacy principles issued by the AICPA
and CICA.

(2)
(3)
(4)
(5)

(b)

The Trust Service criteria include:

(1)
Policies. The entity has defined and documented its polices relevant
to the particular principle.
(2)
Communications. The entity has communicated its defined policies to
responsible parties and authorized users of the system.
(3)
Procedures. The entity placed in operation procedures to achieve the
objectives in accordance with its defined policies.
(4)
Monitoring. The entity monitors the system and takes action to
maintain compliance with its defined policies.

(c)

The criteria are used by the CPAs to evaluate whether the principle is being achieved.

(d)

The CPAs may be engaged to report on one or more of the principles.

20-10

Chapter 20 - Additional Assurance Services: Other Information

20-34

(a)
The Attestation Standards provide guidance for an engagement such as one on
customer satisfaction. They provide two types of general use services--examinations and
reviews.
(b)

Suitable criteria are those that are objective and permit reasonably consistent
measurements. In addition, the criteria must be sufficiently complete such that no relevant
factors are omitted that would affect a conclusion about the subject matter. Finally, the
criteria must measure some characteristic of the subject matter that is relevant to a users
decision.

(c)

INDEPENDENT ACCOUNTANTS REPORT

We have examined the accompanying Schedule of Customer Satisfaction Measures for the
three years ended December 31, 20X4. This schedule is the responsibility of Grayson,
Inc.'s management. Our responsibility is to express an opinion on this schedule based on
our examination.
Our examination was conducted in accordance with attestation standards established by
the American Institute of Certified Public Accountants and, accordingly, included
examining, on a test basis, evidence supporting the schedule and performing such other
procedures as we considered necessary in the circumstances. We believe that our
examination provides a reasonable basis for our opinion.
In our opinion, the Schedule of Customer Satisfaction Measures referred to above presents
fairly, in all material respects, the levels of customer satisfaction for the three years ended
December 31, 20X4, in conformity with the measurement and disclosure criteria set forth
in Note 1.
Webster & Lowe, LLP

March 1, 20X5

NOTE TO INSTRUCTOR: If the CPAs believe that the criteria are not
understandable by users other than management a paragraph must be added to the report
restricting its use.
20-35 (a)
(b)

The subject matter of the engagement is the set of prices of the various items sold by Food
Queen.
In an area in which no suitable criteria have been developed, the management of Food
Queen, with concurrence of the practitioners, will need to attempt to develop them.
Suitable criteria are those that are objective and permit reasonably consistent
measurement. The criteria must be sufficiently complete such that no relevant factors are
omitted that would affect a conclusion about he subject matter. Also, the criteria must
measure some characteristics of the subject matter that is relevant to a user's decision.

20-11

Chapter 20 - Additional Assurance Services: Other Information

Various approaches are possible--we will describe two. First, one approach would be to
take a random sample of food prices and match that sample against the prices of
competitor stores. Second, an effort could be made to describe a "reasonable customer,"
and to identify the nature of that customer's purchases. Using this second approach, a
sample of prices would be taken of various categories of food (fruits, vegetables, meat,
etc.) and the results would be weighted by that reasonable customer's average purchases of
each type of food.
(c)

An assertion is a declaration about whether the subject matter is presented in accordance

with certain criteria. In this situation the assertion would be that Food Queen had the
lowest prices based on the suitable criteria that were used.

(d)

There are at least two issues, including: (1) whether the results of attestation engagements
may be included in advertising claims, and (2) whether the criteria developed in this
question are appropriate for "general use" rather than only for "restricted use."
Concerning the first issue, nothing in the professional standards prohibits using such
information for advertising purposes. Because of difficulties such as those presented in the
problem (e.g., simply not using the report if Food Queen's prices aren't the lowest) some
CPA firms have not accepted attestation engagements that involve advertising claims.
Whether the criteria developed in response to this question would be appropriate for
"general use" is a significant question. Criteria developed by specified parties such as
management often will result in a restricted use attestation report. The text provides the
example of criteria from a contract between two parties as one that might be restricted and
therefore not appropriate for general use. In this case, however, it would seem quite
possible to develop criteria that could be presented with the presentation in an
understandable manner.

(e)

INDEPENDENT ACCOUNTANTS REPORT

We have examined the accompanying Schedule of Grocery Prices as of December 31,

20X1. This schedule is the responsibility of Grayson, Inc.'s management. Our
responsibility is to express an opinion on this schedule based on our examination.
Our examination was conducted in accordance with attestation standards established by
the American Institute of Certified Public Accountants and, accordingly, included
examining, on a test basis, evidence supporting the schedule and performing such other
procedures as we considered necessary in the circumstances. We believe that our
examination provides a reasonable basis for our opinion.
In our opinion, the Schedule of Grocery Prices referred to above presents fairly, in all
material respects, the levels of grocery prices as of December 31, 20X1, in conformity
with the measurement and disclosure criteria set forth in Note 1.
Webster & Lowe, LLP
January 15, 20X2

20-12

Chapter 20 - Additional Assurance Services: Other Information

NOTE 1 TO INSTRUCTOR: If the CPAs believe that the criteria are not understandable
by users other than management a paragraph must be added to the report restricting its
use.
NOTE 2 TO INSTRUCTOR: This case is loosely constructed on the strategy used by
a major grocery chain to move into the Phoenix market. In that case, a general use report
was issued based on suitable criteria developed based on a weighted average of a
reasonable family's purchases.
20-36

The answer to this question will vary depending upon when the website is accessed. As we
go to press the following represent some of the guidance available:
Trust Services Principles and CriteriaThe principles and criteria for trust services.
Getting Started with Trust ServicesDetails on how to begin offering the service.
The Need for Reliable SystemsGeneral guidance on systems.
Also, as we go to press, the only way we are able to access this information at
www.aicpa.org is through use of the search term SysTrust. It turns up a number of
irrelevant documents in addition to the above.

20-13