In September 2020, the AICPA issued a new Statement on Standards for Attestation Engagements (SSAE) labeled as SSAE No. 21, Direct Examination Engagements. You might ask, “Why do we care about it now?” We care about it now because it is effective for all practitioners’ reports dated on or after June 15, 2022. A date that has already passed.
SSAE No. 21 has several key points that a practitioner should be aware of:
- AT-C section 206, Direct Examination Engagements, is new. It focuses on examination engagements where the practitioner can perform an examination engagement in which the practitioner obtains reasonable assurance by measuring or evaluating underlying subject matter against criteria and expressing an opinion that provides the results of that measurement or evaluation. The responsible party is not required to provide a written assertion.
- Statement on Standard for Attestation Engagements (SSAE) No. 18 AT-C section 105, Concepts Common to All Attestation Engagements is amended through various additions, changes, and clarifications.
- SSAE No. 18 AT-C Section 205, Examination Engagements is superseded and a new AT-C Section 205, labeled Assertion-Based Examination Engagements, is introduced and effective for all practitioners’ reports dated on or after June 15, 2022.
Why Are These Changes to SSAE No. 21 Important Now?
SSAE No. 21 takes effect for practitioners’ reports dated on or after June 15, 2022. Early implementation was permitted.
As was in place, under SSAE No. 18, only assertion-based engagements were allowed where an assertion was required to be provided by the responsible party. This is defined with AT-C section 205, assertion-based examination engagements. The critical distinction with SSAE No. 21, a direct examination engagement, is that the responsible party (usually the client) is not required to:
- Measure or evaluate the underlying subject matter against the criteria.
- Provide a written assertion to the practitioner.
The responsible party will, though, be required to acknowledge responsibility for the underlying subject matter.
The responsible party must provide a written assertion about the measurement or evaluation of the underlying subject matter against the criteria identified for the engagement. It is the practitioner’s responsibility to use professional judgment and determine whether management has a reasonable basis for making its assertion. This is no different from assertion-based engagements.
Amendments to AT-C Section 105
The amendments to AT-C section 105 mainly relate to minor changes and clarifications in definitions or additional wording that has little impact on content. Clarifications are also provided that the term examination is inclusive of both assertion-based and direct examination engagements and that examination and review engagements include the following:
- Assertion-based examination engagements
- Direct examination engagements
- Review engagements
Definitions of each type of engagement are provided within the document.
As a reminder, objectives for AT-C section 105 are:
“a. Obtain reasonable assurance about whether the subject matter as measured or evaluated against the criteria is free from material misstatement
b. Express an opinion in a written report about whether
i. the subject matter is in accordance with (or based on) the criteria, in all material respects, or
ii. the responsible party’s assertion is fairly stated, in all material respects.
c. Communicate further as required by relevant AT-C sections.”
Amendments to AT-C Section 205
AT-C Section 205 was revised to be effective for practitioners’ assertion-based examination reports dated on or after June 15, 2022. AT-C Section 205, under SSAE-18, was called Examination Engagements. With the release of SSAE No. 21, AT-C Section 205 is now labeled Assertion-Based Examination Engagements and focuses on those engagements where an assertion from the responsible party is required as part of the engagement. The practitioner must assess this assertion as part of the examination procedures. AT-C Section 206, takes on the engagements where, as previously mentioned, an assertion from the responsible party is not required. That, in a nutshell, is the main difference between AT-C Section 205 and 206.
Amendments to AT-C Section 206 – Direct Examination Engagements
Practitioners should be following the concepts stated in AT-C Section 205 for direct examination engagements unless differences in the engagement cause the practitioners to need to adhere to concepts stated in AT-C Section 206. The following sections refer to several considerations and requirements regarding AT-C Section 206.
General Concepts
Practitioners performing attest engagements are familiar with the requirements of AT-C section 105. This, this portion of the blog will focus on the requirements of AT-C section 206. As with AT-C section 205, compliance must be achieved with AT-C section 105, Concepts Common to All Attestation Engagements. This article will not go into the detail behind AT-C section 105. As a reminder, though, objectives for AT-C section 105 are:
“a. obtain reasonable assurance by measuring or evaluating the underlying subject matter against the criteria and performing other procedures to obtain sufficient appropriate evidence,
b. express an opinion in a written report that conveys the results of the practitioner’s measurement or evaluation, and
c. communicate as required by this AT-C section, in accordance with the results of the practitioner’s procedures.”
Although the practitioner is not required to request a written assertion from the responsible party when performing a direct examination, the practitioner is required to apply all other requirements in AT-C section 205 unless, as stated by SSAE-21:
a. “the requirement cannot be applied as written because of the nature of a direct examination engagement, in which case, the practitioner should adapt and apply” the requirement of obtaining a written assertion”
b. “specified requirements in this section differ from and replace the related requirements in AT-C section 205.”
Guidance for Client Acceptance/Continuance
Since the responsible party is not providing a written assertion, it is important for the practitioner to consider it as part of the client acceptance/continuance procedures:
- What is the objective and planned usage of the procedures.
- Why a direct examination is being requested versus an assertion-based engagement.
- Reasons for the responsible party not evaluating the subject matter against the defined criteria. For example, the responsible party does not have the technical expertise to perform the evaluation.
- Reasons why the responsible party is not providing an assertion even though the responsible party has evaluated the subject matter against the defined criteria.
- What other factors regarding the responsible party or the requested engagement are there that may raise an element of concern in accepting the engagement as a direct examination where a written assertion is not being provided.
Responses received to the points above may lead the practitioner to consider not accepting the engagement. Since the act of the responsible party or management providing an assertion or appropriate actions and involvement by the responsible party or management can provide some level of comfort to the engagement, these items not being exhibited can raise serious concerns for the practitioner.
Guidance for Concluding the Engagement
The practitioner obtains reasonable assurance by measuring or evaluating the subject matter and related evidence against identified criteria so as to express an opinion regarding the measurement or evaluation. As previously stated, the responsible party does not provide an assertion as is required with AT-C section 105. Reasonable assurance is the same measure applied to assertion-based engagements as well.
As with assertion-based engagements, a written representation is requested for an examination engagement. The representation should come from the responsible party and the engaging party in cases where the engaging party is not the responsible party.
Conclusion
In conclusion, the issuance of SSAE-21, effective for practitioners’ reports dated on or after June 15, 2022, has the greatest impact with the introduction of ACT-C section 206, Direct Examination Engagements. Requirements for a direct examination are based on AT-C section 205, Assertion-Based Examination Engagements. AT-C Section 206 would be relied upon in those cases where the requirement in AT-C section 205 cannot be applied as written because of the nature of a direct examination engagement. In this case, the applicable portions of AT-C section 206 would replace the related requirements in AT-C section 205.
The main differences are as follows:
- An assertion over the criteria being performed by the engagement is not required with a direct examination.
- The responsible party is not required to make the effort to measure or evaluate the subject matter against criteria.
The responsible party is required to acknowledge its responsibility for the underlying subject matter that is the subject of the direct examination.
Please reach out if you would like to learn more about engagements that Linford & Co perform, such as SOC 1 audits and SOC 2 assertion-based engagements. Additionally, if you would like to learn more about any of our other audit services please don’t hesitate to contact us.
Lois started with Linford & Co., LLP in 2020. She began her career in 1990 and has spent her career working in public accounting at Ernst & Young and in the industry focusing on SOC 1 and SOC 2 and other audit activities, ethics & compliance, governance, and privacy. At Linford, Lois specializes in SOC 1, SOC 2, HIPAA, ISO, and CMMC audits. Lois’ goal is to collaboratively serve her clients to provide a valuable and accurate product that meets the needs of her clients and their customers all while adhering to professional standards.