SSAE 18: The Clarified Attestation Standards

Effective May 1, 2017

SSAE 18 is effective on May 1, 2017, and changes the Attestation Standards.

Do you issue any attestation reports such as agreed upon procedures? If yes, then be aware of the recent changes from the Auditing Standards Board (ASB). The ASB has clarified the Attestation Standards. The ASB did the same with the audit standards a few years ago; that change resulted in the AU-C (clarity) designations for audit standards.

SSAE 18

Picture from AdobeStock.com

The re-write of the Attestation Standards culminated in the April 2016 issuance of SSAE 18.

SSAE 18 supersedes all Attestation Standards other than:

  • AT section 701, Management’s Discussion and Analysis (MD&A). AT section 701 will not be clarified because practitioners rarely perform attestation engagements to report on MD&A; it will be retained in the attestation standards in its current form. AT section 701 has been renumbered as AT-C section 395.

Also be aware that AT section 501 An Examination of an Entity’s Internal Control Over Financial Reporting That is Integrated With An Audit of Financial Statements was moved to the auditing standards as Statement on Auditing Standards (SAS) No. 130, as An Audit of Internal Control Over Financial Reporting That is Integrated With An Audit of Financial Statements.

Just as the ASB did with the audit clarity standards, a “-C” is added to the clarified Attestation Standards. So the clarified attestation standards are identified as AT-C. The clarified standards are written using ASB’s clarity conventions, including:

  • Objectives for each chapter
  • Definitions in each chapter
  • Separating requirements from application and explanatory material
  • Using various formatting techniques such as bulleted lists to enhance readability
  • When applicable, including additional considerations for governmental entities or smaller less complex entities

Attestation Levels of Service

The clarified standards provide for the following types of attestation services:

ServiceAT-C SectionReport Type
Examination205Opinion
Review210Conclusion
Agreed Upon Procedures215Findings

Sample report excerpts follow:

Examination Report on Subject Matter; Unmodified Opinion

In our opinion, the schedule of investment returns of ABC Company for the year ended December 31, 2020, is presented in accordance with the ABC criteria set forth in Note 1 in all material respects.

Review Report on Subject Matter; Unmodified Conclusion

Based on our review, we are not aware of any material modifications that should be made to the accompanying schedule of investment returns of ABC Company for the year ended December 31, 2020, in order for it to be in accordance with XYZ criteria set forth in Note 1.

Agreed-Upon Procedures Report

We obtained the accounts receivable subsidiary ledger as of June 30, 2017, from Topaz, Inc. We compared all customer account balances in the aged trial balance (exhibit B) as of June 30, 2017, to the balances shown in the accounts receivable subsidiary ledger.

We found no exceptions as a result of the procedure.

New SSAE 18 Requirements

In addition to clarifying (restructuring) the attestation standards, SSAE 18 also:

  • Separates the review engagement procedures and reporting requirements from those of examination engagements (and highlights the similarities of reviews performed under the SSAEs and those performed under Statements on Standards for Accounting and Review Services [SSARS])
  • Requires the practitioner to request a written representation letter in all attestation engagements (the pre-clarity standards only required representation letters for certain engagements)
  • Changes the existing requirements related to scope limitations, indicating that based on the practitioner’s assessment of the effect of the scope limitation, the practitioner should express a qualified opinion, disclaim an opinion, or withdraw from the engagement
  • Eliminated compilations of prospective financial information from the attestation standards (the Accounting and Review Services Committee issued SSARS 23 to cover this service)

Effective Date

The guidance in SSAE No. 18 is effective for practitioners’ reports dated on or after May 1, 2017.

For a full copy of SSAE No. 18, click here.

Consulting or Agreed Upon Procedures Engagement: Which is Best?

Which should I use? Consulting or AUP

Consulting or agreed upon procedures–which should a CPA use?

Consulting or agreed upon procedures

Picture from AdobeStock.com

I am often asked, “should this be an agreed-upon-procedures (AUP) engagement or a consulting engagement?” (The question usually comes just after a client says, “I don’t need an audit. They cost too much.”)

So what’s the difference in an AUP and a consulting engagement?

Agreed Upon Procedures Engagement

The AUP option is more precise and is mainly composed of:

  1. Procedures
  2. Findings

An example follows:

Procedure – Agreed all January 2012 disbursements greater than $20,000 to checks that cleared the bank statement; compared the payee on each check to the payee per the check register.

Finding – All check payees agreed with the exception of check # 2394 for $45,000; the payee for this check was I. Cheatum,  and the check register reflected a payment to King’s Supply Company.

Consulting Engagement

A consulting engagement–based on the AICPA Consulting Standards–is less precise and does not necessarily need to follow the procedure-finding format. There are no specific reporting standards for a consulting engagement, so a CPA can more easily design the engagement to meet various needs. The consulting standards are more flexible than the attestation standards (and the requirements for agreed-upon-procedures engagements).

A consulting report might address the following:

  1. Reading of minutes
  2. Interviews of individual employees
  3. Flowcharting of internal controls
  4. Summary of production statistics
  5. Narrative of business goals and enterprise risks

As you can tell, there are no procedures and findings.

Which is Best?

It all depends on the purpose of the report. Consider the following:

  1. Will there be external parties (e.g. creditors) placing reliance on the report?
  2. Is the purpose of the report to add credibility to the information (by having the CPA attest to procedures and findings)?

If the answer to these questions is yes, then use the AUP option.

If there is no third party relying on the information, then a consulting engagement may be better. But always ask, “Who will receive the report?” The CPA needs to know who will read and potentially place reliance upon the report.

AUP Procedures (Not Appropriate and Appropriate)

The key consideration in performing an AUP is specificity.

Procedures that would not be appropriate include:

  • General review of inventory internal controls
  • Reading the minutes
  • Testing accounts payable

Procedures that would be appropriate include:

  • Examine every fifth journal entry in the month of May 2017 to determine if each is signed by the CFO.
  • Agree each balance on the May 2017 balance sheet to the general ledger.

Clarified AUP Guidance

For the new AICPA AUP guidance (including sample reports), click here. These standards are effective for reports dated on or after May 1, 2017.

CPA Comfort Letters to Mortgage Companies

Issuing comfort letters may create unknown risks for CPAs

Have you ever had a bank or mortgage company ask you for a “comfort letter” to verify a client’s income?

Responding to such a request can create unknown risks for the CPA. (The AICPA provides guidance on this issue in TIS Section 9110, Special Reports .19 Lender Comfort Letters.)

CPA comfort letters to mortgage companies

Picture from AdobeStock.com

CPA Comfort Letters to Mortgage Companies

Today the LinkedIn AICPA group had this post from a CPA in Boston:

Yesterday I received a phone call from a mortgage company looking for a “CPA Letter”. When I asked,  “what is that?”, the person thought I was joking.

Maybe I was pretending since I have heard of comfort letter requests. Some of the content requested was how long has my client been “self-employed”. 

Is there a place where I can find what the AICPA says is proper to put on a comfort letter?

My response to the LinkedIn member follows.

George – I see this issue about once every two years.

The comfort letter at issue is usually associated with stated-income loans, which are mortgages that do not require borrowers to document their income. Such loans usually are sought by self-employed people.

Such a letter provides third-party verification of details in the loan application and could transfer some of the potential liability to the CPA in the event of default on the loan.

According to Auditing Standards Board Statement on Standards for Attestation Engagements No. 10, Attest Engagements, an attestation engagement is called for if the client wants a written report providing assurance about a specific subject. Of course, performing an attestation engagement is not prohibited in the case of a lender’s comfort letter request, but you (the CPA) must follow the procedures required in an attestation engagement.

The client will likely not want to incur the expense of a formal attestation engagement.

AT Section 9101, Attest Engagements: Attest Engagements Interpretations of Section 101, No. 2, Paragraph 25 states that practitioners should not provide any form of assurance that an entity is not insolvent or would not be rendered insolvent upon a proposed condition, or that an entity has the ability to pay debts as they mature.

As an alternative, you may want to offer to send a copy (with the client’s written authorization) of the client’s tax forms directly to the lender with a simple cover page stating, “Please find attached the tax forms I prepared for Client for the past three years.”

Shifting the Risk

George – The bottom line: the mortgage company is trying to find a way to document the loan cheaply. Such a letter can transfer risks from the mortgage company to you. It’s a bit of a jam for you because your client probably wants you to “simply write a short letter”; the client may not understand the risk it creates for you.

Another Option – AUP

You can perform an attest service (e.g. agreed upon procedures report), but it will take time and you will need to perform certain procedures and issue a report using standard agreed upon procedures language. This could take a few hours, but it will mitigate your risk.