The assurance ladder
| Engagement | Assurance provided | Independence required? | Report issued? |
|---|---|---|---|
| Preparation (SSARS) | None | No | No report — but each page marked "no assurance is provided" |
| Compilation (SSARS) | None | No (disclose if not independent) | Yes — compilation report |
| Review (SSARS) | Limited (negative assurance) | Yes | Yes — review report |
| Audit (GAAS) | Reasonable (positive assurance) | Yes | Yes — audit report |
What a review actually involves
A review consists primarily of inquiry and analytical procedures ("I and A"). It does not include obtaining an understanding of internal control, assessing fraud risk, testing controls, confirming balances, or physically inspecting assets — those are audit procedures.
IMPORTANT — the negative assurance wording: "Based on our review, we are not aware of any material modifications that should be made to the accompanying financial statements in order for them to be in accordance with accounting principles generally accepted in the United States of America." Memorize the shape of this sentence — it is the defining feature of a review report.
Agreed-upon procedures (AUP)
Under the attestation standards, the practitioner performs specific procedures agreed with the engaging party and reports findings — no opinion, no conclusion, no assurance. The report is restricted to specified parties in most cases, and the engaging party must acknowledge the appropriateness of the procedures for its purposes.
EXAM TIP: All SSARS engagements require an engagement letter signed by both the accountant and management. And a review engagement always requires a written management representation letter — a compilation does not.