Back

North America > American Institute of Certified Public Accountants

SSAE No. 18, Attestation Standards: Clarification and Recodification



AD ID

0002978

AD STATUS

SSAE No. 18, Attestation Standards: Clarification and Recodification

ORIGINATOR

American Institute of Certified Public Accountants

TYPE

Safe Harbor

AVAILABILITY

Free

SYNONYMS

SSAE 18

SSAE No. 18, Attestation Standards: Clarification and Recodification

EFFECTIVE

2016-04-01

ADDED

The document as a whole was last reviewed and released on 2019-07-22T00:00:00+0000.

AD ID

0002978

AD STATUS

Free

ORIGINATOR

American Institute of Certified Public Accountants

TYPE

Safe Harbor

AVAILABILITY

SYNONYMS

SSAE 18

SSAE No. 18, Attestation Standards: Clarification and Recodification

EFFECTIVE

2016-04-01

ADDED

The document as a whole was last reviewed and released on 2019-07-22T00:00:00+0000.


Important Notice

This Authority Document In Depth Report is copyrighted - © 2020 - Network Frontiers LLC. All rights reserved. Copyright in the Authority Document analyzed herein is held by its authors. Network Frontiers makes no claims of copyright in this Authority Document.

This Authority Document In Depth Report is provided for informational purposes only and does not constitute, and should not be construed as, legal advice. The reader is encouraged to consult with an attorney experienced in these areas for further explanation and advice.

This Authority Document In Depth Report provides analysis and guidance for use and implementation of the Authority Document but it is not a substitute for the original authority document itself. Readers should refer to the original authority document as the definitive resource on obligations and compliance requirements.

The process we used to tag and map this document

This document has been mapped into the Unified Compliance Framework using a patented methodology and patented tools (you can research our patents HERE). The mapping team has taken every effort to ensure the quality of mapping is of the highest degree. To learn more about the process we use to map Authority Documents, or to become involved in that process, click HERE.

Controls and asociated Citations breakdown

When the UCF Mapping Teams tag Citations and their associated mandates within an Authority Document, those Citations and Mandates are tied to Common Controls. In addition, and by virtue of those Citations and mandates being tied to Common Controls, there are three sets of meta data that are associated with each Citation; Controls by Impact Zone, Controls by Type, and Controls by Classification.

The online version of the mapping analysis you see here is just a fraction of the work the UCF Mapping Team has done. The downloadable version of this document, available within the Common Controls Hub (available HERE) contains the following:

Document implementation analysis – statistics about the document’s alignment with Common Controls as compared to other Authority Documents and statistics on usage of key terms and non-standard terms.

Citation and Mandate Tagging and Mapping – A complete listing of each and every Citation we found within SSAE No. 18, Attestation Standards: Clarification and Recodification that have been tagged with their primary and secondary nouns and primary and secondary verbs in three column format. The first column shows the Citation (the marker within the Authority Document that points to where we found the guidance). The second column shows the Citation guidance per se, along with the tagging for the mandate we found within the Citation. The third column shows the Common Control ID that the mandate is linked to, and the final column gives us the Common Control itself.

Dictionary Terms – The dictionary terms listed for SSAE No. 18, Attestation Standards: Clarification and Recodification are based upon terms either found within the Authority Document’s defined terms section(which most legal documents have), its glossary, and for the most part, as tagged within each mandate. The terms with links are terms that are the standardized version of the term.



Common Controls and
mandates by Impact Zone
244 Mandated Controls - bold    
47 Implied Controls - italic     217 Implementation

An Impact Zone is a hierarchical way of organizing our suite of Common Controls — it is a taxonomy. The top levels of the UCF hierarchy are called Impact Zones. Common Controls are mapped within the UCF’s Impact Zones and are maintained in a legal hierarchy within that Impact Zone. Each Impact Zone deals with a separate area of policies, standards, and procedures: technology acquisition, physical security, continuity, records management, etc.


The UCF created its taxonomy by looking at the corpus of standards and regulations through the lens of unification and a view toward how the controls impact the organization. Thus, we created a hierarchical structure for each impact zone that takes into account regulatory and standards bodies, doctrines, and language.

Number of Controls
508 Total
  • Audits and risk management
    345
    KEY:    Primary Verb     Primary Noun     Secondary Verb     Secondary Noun     Limiting Term
    Mandated - bold    Implied - italic    Implementation - regular TYPE CLASS
    Audits and risk management CC ID 00677 IT Impact Zone IT Impact Zone
    Define the roles and responsibilities for personnel assigned to tasks in the Audit function. CC ID 00678
    [{examination engagement} {audit terms} The agreed-upon terms of the engagement should include the following: The responsibilities of the responsible party and the responsibilities of the engaging party, if different AT-C Section 205.08 d.
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Agree with the practitioner's specialist regarding the respective roles and responsibilities of the practitioner and that specialist; AT-C Section 205.36 c.ii.
    The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: AT-C Section 105.33
    {is not} In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The responsible party is a party other than the practitioner and takes responsibility for the subject matter. AT-C Section 105.25 a.
    {review engagement} The agreed-upon terms of the engagement should include the following: The responsibilities of the practitioner AT-C Section 210.09 b.
    {review engagement} The agreed-upon terms of the engagement should include the following: The responsibilities of the responsible party and the responsibilities of the engaging party, if different AT-C Section 210.09 d.
    In order to establish that the preconditions for an agreed-upon procedures engagement are present, the practitioner should determine that the following conditions, in addition to the preconditions identified in section 105, are present: The specified parties take responsibility for the sufficiency of the agreed-upon procedures for their purposes. AT-C Section 215.10 b.
    {agreed-upon procedures} The agreed-upon terms of the engagement should include the following: Acknowledgment by the specified parties of their responsibility for the sufficiency of the procedures AT-C Section 215.14 d.
    If the service organization has an internal audit function, part of the service auditor's understanding of the service organization's system should include the following: The nature of the internal audit function's responsibilities and how the internal audit function fits in the service organization's organizational structure AT-C Section 320.21 a.]
    Establish Roles Preventive
    Manage supply chain audits. CC ID 01203 Audits and Risk Management Preventive
    Review the external auditors involvement in assessing Information Technology controls. CC ID 01204 Audits and Risk Management Preventive
    Assign the roles and responsibilities for the Board of Directors and senior management in the Audit function. CC ID 00679 Establish Roles Preventive
    Assign the Board of Directors to address audit findings. CC ID 12396 Human Resources Management Corrective
    Assign the internal Information Technology audit staff to be independent from the Information Technology group reporting to the Board of Directors. CC ID 01184 Establish Roles Preventive
    Define and assign the internal audit manager's roles and responsibilities. CC ID 00680 Establish Roles Preventive
    Report audit findings by the internal audit manager directly to senior management. CC ID 01152 Testing Detective
    Assign the internal audit manager's compensation and performance review to the Board of Directors or audit committee. CC ID 01186 Establish Roles Preventive
    Define and assign the internal Information Technology audit staff's roles and responsibilities. CC ID 00681
    [{examination engagement} {audit terms} The agreed-upon terms of the engagement should include the following: The responsibilities of the practitioner AT-C Section 205.08 b.
    The agreed-upon terms of the engagement should include the following: The responsibilities of the practitioner AT-C Section 215.14 e.
    If the service organization has an internal audit function, part of the service auditor's understanding of the service organization's system should include the following: The nature of the internal audit function's responsibilities and how the internal audit function fits in the service organization's organizational structure AT-C Section 320.21 a.]
    Establish Roles Preventive
    Assign the responsibility for operating an internal control system to the internal Information Technology audit staff. CC ID 01187 Establish Roles Preventive
    Define and assign the external auditor's roles and responsibilities. CC ID 00683
    [{examination engagement} {audit terms} The agreed-upon terms of the engagement should include the following: The responsibilities of the responsible party and the responsibilities of the engaging party, if different AT-C Section 205.08 d.
    {audit report} The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: Reviews being performed in accordance with the firm's review policies and procedures and reviewing the engagement documentation on or before the date of the practitioner's report AT-C Section 105.33 c.
    {audit report} The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: Reviews being performed in accordance with the firm's review policies and procedures and reviewing the engagement documentation on or before the date of the practitioner's report AT-C Section 105.33 c.
    {review engagement} The agreed-upon terms of the engagement should include the following: The responsibilities of the responsible party and the responsibilities of the engaging party, if different AT-C Section 210.09 d.]
    Establish Roles Preventive
    Engage auditors who have adequate knowledge of the subject matter. CC ID 07102
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Obtain a sufficient understanding of the field of expertise of a practitioner's specialist to enable the practitioner to AT-C Section 205.36 b.
    The nature, timing, and extent of the procedures a practitioner performs when the practitioner expects to use the work of a practitioner's specialist will vary depending on the circumstances. In determining the nature, timing, and extent of those procedures, the practitioner should consider the following: The practitioner's knowledge of, and experience with, previous work performed by that specialist AT-C Section 205.38 d.
    The practitioner should accept an attestation engagement only when the practitioner is satisfied that those persons who are to perform the engagement collectively have the appropriate competence and capabilities (see also paragraph .32); AT-C Section 105.27 b.
    The engagement partner should be satisfied that the engagement team, and any practitioner's external specialists, collectively, have the appropriate competence, including knowledge of the subject matter, and capabilities to AT-C Section 105.32 a.
    {review engagement} The practitioner should obtain an understanding of the subject matter and other engagement circumstances sufficient to provide a basis for designing and performing procedures in order to achieve the objectives of the engagement. That understanding should include the practices used to measure, recognize, and record the subject matter. AT-C Section 210.13
    The practitioner should possess or obtain a level of knowledge of the industry and the accounting principles and practices of the industry in which the entity operates, or will operate, that will enable the practitioner to examine prospective financial information that is appropriate for an entity operating in that industry. AT-C Section 305.16
    The practitioner should obtain knowledge of the key factors on which the entity's prospective financial information is based. AT-C Section 305.17
    The agreed-upon terms of the engagement should include the following: Involvement of a practitioner's external specialist, if applicable AT-C Section 215.14 k.
    The practitioner and the specified parties should explicitly agree to the involvement of a practitioner's external specialist if assisting a practitioner in the performance of an agreed-upon procedures engagement. AT-C Section 215.21
    The practitioner should understand the guidelines for the preparation and presentation of prospective financial statements contained in the guide. AT-C Section 305.15
    The examination procedures should be based on the practitioner's consideration of the following: The responsible party's competence with respect to prospective financial information AT-C Section 305.20 d.
    The practitioner who is reporting on the pro forma financial information should have or obtain an appropriate level of knowledge of the accounting and financial reporting practices of the entity (or, in the case of a business combination, each significant constituent part of the combined entity). AT-C Section 310.12
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Obtain an understanding of the underlying transaction (or event). AT-C Section 310.13 a.
    The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Obtain an understanding of the accounting and financial reporting practices of each significant constituent part of the combined entity in a business combination that will enable the practitioner to perform the required procedures. If another practitioner has performed an audit or a review of the most recent annual or interim period for which the pro forma financial information is presented (or the most recent annual or interim period of a significant constituent part of the combined entity), the need, by a practitioner reporting on the pro forma financial information, for an understanding of such entity's accounting and financial reporting practices is not diminished. In such circumstances, the practitioner should consider whether the practitioner can acquire sufficient knowledge of these matters to perform the procedures necessary to report on the pro forma financial information. AT-C Section 310.13 b.
    The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Obtain an understanding of the accounting and financial reporting practices of each significant constituent part of the combined entity in a business combination that will enable the practitioner to perform the required procedures. If another practitioner has performed an audit or a review of the most recent annual or interim period for which the pro forma financial information is presented (or the most recent annual or interim period of a significant constituent part of the combined entity), the need, by a practitioner reporting on the pro forma financial information, for an understanding of such entity's accounting and financial reporting practices is not diminished. In such circumstances, the practitioner should consider whether the practitioner can acquire sufficient knowledge of these matters to perform the procedures necessary to report on the pro forma financial information. AT-C Section 310.13 b.
    The practitioner should obtain an understanding of the specified requirements. The practitioner's procedures to obtain that understanding should include the following: AT-C Section 315.13
    The service auditor should obtain an understanding of the service organization's system, including controls that are included in the scope of the engagement. That understanding should include service organization processes used to AT-C Section 320.20]
    Audits and Risk Management Preventive
    Retain copies of external auditor outsourcing contracts and engagement letters. CC ID 01188 Establish/Maintain Documentation Preventive
    Review external auditor outsourcing contracts and engagement letters. CC ID 01189
    [{attestation engagements} The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: Appropriate procedures being performed regarding the acceptance and continuance of client relationships and engagements AT-C Section 105.33 a.]
    Establish/Maintain Documentation Preventive
    Include a Change Control clause in external auditor outsourcing contracts. CC ID 01192 Establish/Maintain Documentation Preventive
    Include procedures for resolving problems in external auditor outsourcing contracts. CC ID 01196 Establish/Maintain Documentation Preventive
    Include procedures for controlling the use of restricted information in external auditor outsourcing contracts. CC ID 01194
    [The practitioner should inquire of the responsible party about the following: The practices used by the responsible party to measure, recognize, and record the subject matter AT-C Section 210.21 b.]
    Establish/Maintain Documentation Preventive
    Include reports and work paper Records Management practices in external auditor outsourcing contracts. CC ID 01195 Establish/Maintain Documentation Preventive
    Include communication protocols in external auditor outsourcing contracts. CC ID 01201
    [{examination engagement} In establishing the overall engagement strategy, the practitioner should identify the characteristics of the engagement that define its scope and ascertain the reporting objectives of the engagement in order to plan the timing of the engagement and the nature of the communications required; AT-C Section 205.12 a.]
    Establish/Maintain Documentation Preventive
    Review the audit scope when the Risk Profile is updated. CC ID 01202 Audits and Risk Management Preventive
    Review the audit assertion furnished by the organization for accuracy. CC ID 06977
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Evaluate the adequacy of the work of the practitioner's specialist for the practitioner's purposes, including if the work of the practitioner's specialist involves the use of source data that are significant to the work of the practitioner's specialist, the relevance, completeness, and accuracy of that source data. AT-C Section 205.36 d.iii.
    When designing and performing analytical procedures, the practitioner should evaluate the reliability of data from which the practitioner's expectation is developed, taking into account the source, comparability, nature, and relevance of information available; and AT-C Section 210.19 b.
    {financial forecast} In an examination of a forecast, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that if the forecast contains a range, the item or items subject to the assumptions are reasonably expected to fall within the range and that the range was not selected in a biased or misleading manner. AT-C Section 305.28 c.
    {financial projection} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that the assumptions other than the hypothetical assumptions are reasonable, given the hypothetical assumptions, and are suitably supported; and AT-C Section 305.29 e.]
    Testing Detective
    Review the risk assessments as compared to the in scope controls. CC ID 06978
    [The service auditor should assess whether the controls that management identified in its description of the service organization's system as the controls that achieve the control objectives were suitably designed to achieve those control objectives by obtaining an understanding of management's process for identifying and evaluating the risks that threaten the achievement of the control objectives and assessing the completeness and accuracy of management's identification of those risks, AT-C Section 320.27 a.]
    Testing Detective
    Include nondisclosure agreements in external auditor outsourcing contracts. CC ID 10014 Audits and Risk Management Detective
    Include the scope and work to be performed in external auditor outsourcing contracts. CC ID 01190
    [The nature, timing, and extent of the procedures a practitioner performs when the practitioner expects to use the work of a practitioner's specialist will vary depending on the circumstances. In determining the nature, timing, and extent of those procedures, the practitioner should consider the following: The nature of the matter to which that specialist's work relates AT-C Section 205.38 b.
    When the practitioner expects to use the work of an other practitioner, the practitioner should communicate clearly with the other practitioner about the scope and timing of the other practitioner's work and findings. AT-C Section 105.31 c.
    When the practitioner expects to use the work of an other practitioner, the practitioner should if assuming responsibility for the work of the other practitioner, be involved in the work of the other practitioner. AT-C Section 105.31 d.]
    Establish/Maintain Documentation Preventive
    Include work status reporting requirements in the external auditor outsourcing contracts. CC ID 01191 Establish/Maintain Documentation Preventive
    Include access to work papers in external auditor outsourcing contracts. CC ID 01193 Establish/Maintain Documentation Preventive
    Review the external auditor's qualifications. CC ID 01197 Audits and Risk Management Preventive
    Conduct a performance review of the external auditor's performance during the audit process. CC ID 01198
    [Before the conclusion of the engagement, the practitioner should evaluate whether the use of the work of the internal audit function or the use of internal auditors to provide direct assistance results in the practitioner still being sufficiently involved in the examination given the practitioner's sole responsibility for the opinion expressed. AT-C Section 205.44]
    Audits and Risk Management Preventive
    Review the adequacy of the external auditor's work papers and audit reports. CC ID 01199
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Obtain a sufficient understanding of the field of expertise of a practitioner's specialist to enable the practitioner to evaluate the adequacy of that work for the practitioner's purposes. AT-C Section 205.36 b.ii.
    {examination engagement} The nature, timing, and extent of the procedures a practitioner performs when the practitioner expects to use the work of a practitioner's specialist will vary depending on the circumstances. In determining the nature, timing, and extent of those procedures, the practitioner should consider the following: The significance of that specialist's work in the context of the engagement. AT-C Section 205.38 a.
    When the practitioner expects to use the work of an other practitioner, the practitioner should evaluate whether the other practitioner's work is adequate for the practitioner's purposes. AT-C Section 105.31 e.
    {evaluate} For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement quality control reviewer should perform an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. This evaluation should include the following: Evaluation of the conclusions reached in formulating the report and consideration of whether the proposed report is appropriate AT-C Section 105.42 b.iv.
    In order to accept an attestation engagement to examine or review pro forma financial information, in addition to the preconditions for an attestation engagement included in sections 105 and 205, the practitioner should determine that the historical financial statements of the entity (or in the case of a business combination, of each significant constituent part of the combined entity) on which the pro forma financial information is based, in the case of an examination of pro forma financial information, have been audited, or AT-C Section 310.08 b.i.
    In order to accept an attestation engagement to examine or review pro forma financial information, in addition to the preconditions for an attestation engagement included in sections 105 and 205, the practitioner should determine that the historical financial statements of the entity (or in the case of a business combination, of each significant constituent part of the combined entity) on which the pro forma financial information is based, in the case of a review of pro forma financial information, have been audited or reviewed, AT-C Section 310.08 b.ii.
    In order to accept an attestation engagement to examine or review pro forma financial information, in addition to the preconditions for an attestation engagement included in sections 105 and 205, the practitioner should determine that the historical financial statements of the entity (or in the case of a business combination, of each significant constituent part of the combined entity) on which the pro forma financial information is based, in the case of i. an examination of pro forma financial information, have been audited, or ii. a review of pro forma financial information, have been audited or reviewed, and the audit report (or the review report, if issued) is included in the document containing the pro forma financial information (or is readily available) to the extent that the historical financial information is included in the document pursuant to paragraph .08a AT-C Section 310.08 b. ¶ 2]
    Establish/Maintain Documentation Preventive
    Review the conclusions of the external auditor's work papers and audit reports. CC ID 01200
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Evaluate the adequacy of the work of the practitioner's specialist for the practitioner's purposes, including the relevance and reasonableness of the findings and conclusions of the practitioner's specialist and their consistency with other evidence; AT-C Section 205.36 d.i.
    The engagement partner should be satisfied that appropriate procedures regarding the acceptance and continuance of client relationships and attestation engagements have been followed and should determine that conclusions reached in this regard are appropriate. AT-C Section 105.23
    {evaluate} For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement quality control reviewer should perform an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. This evaluation should include the following: Evaluation of the conclusions reached in formulating the report and consideration of whether the proposed report is appropriate AT-C Section 105.42 b.iv.
    For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement quality control reviewer should perform an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. This evaluation should include the following: AT-C Section 105.42 b.
    {sufficiency of review evidence} {appropriateness of review evidence} The practitioner should form a conclusion about whether the practitioner is aware of any material modifications that should be made to the subject matter in order for it to be in accordance with (or based on) the criteria or to the responsible party's assertion in order for it to be fairly stated. In forming that conclusion, the practitioner should evaluate the practitioner's conclusion regarding the sufficiency and appropriateness of the review evidence obtained and AT-C Section 210.42 a.
    A practitioner who is engaged to perform a review engagement may become aware that the subject matter is misstated. If the misstatement is not corrected, the practitioner should consider whether qualification of the conclusion in the standard practitioner's report is adequate to disclose the misstatement of the subject matter. AT-C Section 210.51
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should reevaluate the integrity of those from whom the representations were requested or received and evaluate the effect, if any, on the engagement; and AT-C Section 215.31 b.]
    Establish/Maintain Documentation Preventive
    Question external auditors about how audits were conducted and what is in the audit reports. CC ID 04587 Behavior Preventive
    Disseminate and communicate with the organization about any missing audit documentation. CC ID 06992
    [{refrain from providing} When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should discuss the matter with the appropriate party(ies); AT-C Section 205.55 a.
    {audit report} If upon reading the other information, in the practitioner's professional judgment a. a material inconsistency between that other information and the subject matter, assertion, or the report exists or b. a material misstatement of fact exists in the other information, the subject matter, assertion, or the report the practitioner should discuss the matter with the responsible party and take further action as appropriate. AT-C Section 205.57 ¶ 2
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should discuss the matter with the appropriate party(ies);or AT-C Section 215.31 a.
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should discuss the matter with the appropriate party(ies), AT-C Section 210.38 a.
    If prior to or after the release of the practitioner's report on subject matter or an assertion, the practitioner is willing to permit the inclusion of the practitioner's report in a document that contains the subject matter or assertion and other information, the practitioner should read the other information to identify material inconsistencies, if any, with the subject matter, assertion, or the practitioner's report. If on reading the other information, in the practitioner's professional judgment a. a material inconsistency between that other information and the subject matter, assertion, or the practitioner's report exists, or b. a material misstatement of fact exists in the other information, the subject matter, assertion, or the practitioner's report the practitioner should discuss the matter with the responsible party and take further action as appropriate. AT-C Section 210.40 ¶ 2
    {not provided} If the engaging party is not the responsible party, and the practitioner is aware that the responsible party refuses to provide the practitioner with a written assertion, the written agreement required by paragraph .12 should make clear that no such assertion will be provided to the practitioner. AT-C Section 215.16
    When the responsible party refuses to provide the practitioner with a written assertion, the practitioner should disclose in the practitioner's report the responsible party's refusal to provide a written assertion. AT-C Section 215.36]
    Behavior Preventive
    Evaluate any refusal by the organization to provide missing audit documentation. CC ID 06993 Establish/Maintain Documentation Preventive
    Take appropriate action if missing audit documentation compromises the audit. CC ID 06994
    [{refrain from providing} When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should if any of the matters are not resolved to the practitioner's satisfaction, take appropriate action. AT-C Section 205.55 c.
    If the preconditions in paragraphs .24–.25 are not present, the practitioner should discuss the matter with the engaging party to attempt to resolve the issue. AT-C Section 105.26
    {written representations} When the engaging party is not the responsible party, and the responsible party refuses to provide the representations in paragraph .33 in writing, the practitioner should make inquiries of the responsible party about, and seek oral responses to, the matters in paragraph .33. AT-C Section 210.34
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should if any of the matters are not resolved to the practitioner's satisfaction, withdraw from the engagement. AT-C Section 210.38 c.
    {written representations} {not provided} {review engagement} When the engaging party is not the responsible party if one or more of the requested representations are provided neither in writing nor orally from the responsible party in accordance with paragraph .34, a scope limitation exists, and the practitioner should withdraw from the engagement. AT-C Section 210.39 b.
    If prior to or after the release of the practitioner's report on subject matter or an assertion, the practitioner is willing to permit the inclusion of the practitioner's report in a document that contains the subject matter or assertion and other information, the practitioner should read the other information to identify material inconsistencies, if any, with the subject matter, assertion, or the practitioner's report. If on reading the other information, in the practitioner's professional judgment a. a material inconsistency between that other information and the subject matter, assertion, or the practitioner's report exists, or b. a material misstatement of fact exists in the other information, the subject matter, assertion, or the practitioner's report the practitioner should discuss the matter with the responsible party and take further action as appropriate. AT-C Section 210.40 ¶ 2
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should if any of the matters are not resolved to the practitioner's satisfaction, take appropriate action. AT-C Section 215.31 c.
    {written representations} When the engaging party is not the responsible party if one or more of the requested representations are not provided in writing or orally from the responsible party, the practitioner should take appropriate action. AT-C Section 215.32 b.
    {examination engagement} {review engagement} The practitioner should request from management a written assertion. If management refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation AT-C Section 310.10
    In addition to the communication responsibilities in section 205, if the service auditor becomes aware of the matters identified in paragraph .34, the service auditor should determine whether this information has been communicated appropriately to affected user entities. If the information has not been so communicated, and management of the service organization refuses to do so, the service auditor should take appropriate action. AT-Section 320.45]
    Establish/Maintain Documentation Preventive
    Establish and maintain an audit program. CC ID 00684 Establish/Maintain Documentation Preventive
    Assign the audit to impartial auditors. CC ID 07118
    [The practitioner must be independent when performing an attestation engagement in accordance with the attestation standards unless the practitioner is required by law or regulation to accept the engagement and report on the subject matter or assertion. AT-C Section 105.24
    When the practitioner expects to use the work of an other practitioner, the practitioner should obtain an understanding of whether the other practitioner understands and will comply with the ethical requirements that are relevant to the engagement and, in particular, is independent. AT-C Section 105.31 a.]
    Establish Roles Preventive
    Exercise due professional care during the planning and performance of the audit. CC ID 07119
    [In establishing the overall engagement strategy, the practitioner should consider the factors that, in the practitioner's professional judgment, are significant in directing the engagement team's efforts; AT-C Section 205.12 b.
    When using the work of the internal audit function, the practitioner should perform sufficient procedures on the body of work of the internal audit function as a whole that the practitioner plans to use to determine its adequacy for the purpose of the examination engagement, including reperforming some of the body of work of the internal audit function that the practitioner intends to use in obtaining evidence. AT-C Section 205.40
    In applying the attestation guidance included in an other attestation publication, the practitioner should, exercising professional judgment, assess the relevance and appropriateness of such guidance to the circumstances of the attestation engagement. AT-C Section 105.22
    The practitioner should plan and perform an attestation engagement with professional skepticism. AT-C Section 105.43
    The practitioner should exercise professional judgment in planning and performing an attestation engagement. AT-C Section 105.45
    The practitioner should apply professional judgment in determining the specific nature, timing, and extent of review procedures. Based on AT-C Section 210.16
    {examination engagement} The practitioner should obtain an understanding of relevant portions of internal control over compliance sufficient to plan the engagement and to assess control risk for compliance with specified requirements. In planning the examination, such knowledge should be used to identify types of potential noncompliance, to consider factors that affect the risk of material noncompliance, and to design appropriate tests of compliance. AT-C Section 315.15
    If the service organization has an internal audit function, part of the service auditor's understanding of the service organization's system should include the following: The activities performed, or to be performed, by the internal audit function as it relates to the service organization AT-C Section 320.21 b.]
    Behavior Preventive
    Include provisions for legislative plurality and legislative domain in the audit program. CC ID 06959
    [The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: Appropriate engagement documentation being maintained to provide evidence of achievement of the practitioner's objectives and that the engagement was performed in accordance with the attestation standards and relevant legal and regulatory requirements AT-C Section 105.33 d.]
    Audits and Risk Management Preventive
    Establish and maintain audit terms. CC ID 13880
    [If it is discovered after the engagement has been accepted that one or more of the preconditions for an attestation engagement is not present, the practitioner should discuss the matter with the appropriate party(ies) and should determine whether it is appropriate to continue with the engagement; and AT-C Section 105.28 b.
    {agreed-upon procedures engagement} The agreed-upon terms of the engagement should include the following: The nature of the engagement AT-C Section 215.14 a.]
    Establish/Maintain Documentation Preventive
    Refrain from approving changes to the audit terms absent reasonable justification. CC ID 13973
    [{does not exist} {attestation engagement} The practitioner should not agree to a change in the terms of the engagement when no reasonable justification for doing so exists. If a change in the terms of the engagement is made, the practitioner should not disregard evidence that was obtained prior to the change. AT-C Section 105.29]
    Process or Activity Preventive
    Include a statement about the inherent limitations of the audit in the audit terms. CC ID 13883
    [{audit terms} The agreed-upon terms of the engagement should include the following: A statement about the inherent limitations of an examination engagement AT-C Section 205.08 e.
    The practitioner's report should include the following: A statement that describes significant inherent limitations, if any, associated with the measurement or evaluation of the subject matter against the criteria AT-C Section 210.46 g.
    {financial projection} {be useful} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that describe the limitations of the usefulness of the presentation; AT-C Section 305.29 c.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement indicating that the prospective results may not be achieved and describing other significant inherent limitations, if any. AT-C Section 305.39 l.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A statement that describes significant inherent limitations, if any, associated with the measurement or evaluation of the entity's compliance with specified requirements or its assertion thereon. AT-C Section 315.20 h.
    The practitioner's agreed-upon procedures report on compliance should include the following: A statement that had the practitioner performed additional procedures, other matters might have come to the practitioner's attention that would have been reported. AT-C Section 315.26 j.iv.
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that describes significant inherent limitations, if any, associated with the measurement or evaluation of the subject matter against the criteria. AT-C Section 205.63 h.
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Discuss with management their assumptions regarding the effects of the transaction (or event). AT-C Section 310.13 c.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that had the practitioner performed additional procedures, other matters might have come to the practitioner's attention that would have been reported. AT-C Section 305.39 j.iv.]
    Establish/Maintain Documentation Preventive
    Include a statement that the audit will be conducted in accordance with attestation standards in the audit terms. CC ID 13882
    [{examination engagement} {audit terms} {attestation standards} The agreed-upon terms of the engagement should include the following: A statement that the engagement will be conducted in accordance with attesttions standards established by the American Institute of Certified Public Accountants AT-C Section 205.08 c.
    {attestation standards} A service auditor's type 2 report should include the following: A statement that those standards require that the service auditor plan and perform the examination to obtain reasonable assurance about whether, in all material respects, based on the criteria in management's assertion, management's description of the service organization's system is fairly presented and the controls are suitably designed and operating effectively throughout the specified period to achieve the related control objectives. AT-C Section 320.40 h.ii.
    {agreed-upon procedures engagement} The agreed-upon terms of the engagement should include the following: A statement that the engagement will be conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants AT-C Section 215.14 f.]
    Establish/Maintain Documentation Preventive
    Include agreement to the audit scope and audit terms in the audit program. CC ID 06965
    [{examination engagement} {audit terms} The agreed-upon terms of the engagement should include the following: The objective and scope of the engagement AT-C Section 205.08 a.
    {examination engagement} {audit terms} The practitioner should agree upon the terms of the engagement with the engaging party. The agreed-upon terms of the engagement should be specified in sufficient detail in an engagement letter or other suitable form of written agreement. AT-C Section 205.07
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Agree with the practitioner's specialist regarding the nature, scope, and objectives of that practitioner's specialist's work; AT-C Section 205.36 c.i.
    {review engagement} The practitioner should agree upon the terms of the engagement with the engaging party. The agreed- upon terms of the engagement should be specified in sufficient detail in an engagement letter or other suitable form of written agreement. AT-C Section 210.08
    The engagement partner should be satisfied that appropriate procedures regarding the acceptance and continuance of client relationships and attestation engagements have been followed and should determine that conclusions reached in this regard are appropriate. AT-C Section 105.23
    The practitioner should accept an attestation engagement only when the practitioner has no reason to believe that relevant ethical requirements, including independence, will not be satisfied; AT-C Section 105.27 a.
    The practitioner should accept an attestation engagement only when the practitioner has reached a common understanding with the engaging party of the terms of the engagement, including the practitioner's reporting responsibilities. AT-C Section 105.27 d.
    When the practitioner expects to use the work of an other practitioner, the practitioner should obtain an understanding of whether the other practitioner understands and will comply with the ethical requirements that are relevant to the engagement and, in particular, is independent. AT-C Section 105.31 a.
    {review engagement} The agreed-upon terms of the engagement should include the following: The objective and scope of the engagement AT-C Section 210.09 a.
    When the practitioner expects to use the work of a practitioner's specialist or internal auditors, the practitioner should apply the requirements in section 205, Examination Engagements, and the related application guidance, as appropriate, for a review engagement. AT-C Section 210.27
    In order to establish that the preconditions for an agreed-upon procedures engagement are present, the practitioner should determine that the following conditions, in addition to the preconditions identified in section 105, are present: The specified parties agree on the procedures performed, or to be performed, by the practitioner. AT-C Section 215.10 a.
    {agreed-upon procedures} In order to establish that the preconditions for an agreed-upon procedures engagement are present, the practitioner should determine that the following conditions, in addition to the preconditions identified in section 105, are present: The practitioner determines that the procedures can be performed and reported on in accordance with this section. AT-C Section 215.10 c.
    {agreed-upon procedures engagement} The practitioner should agree upon the terms of the engagement with the engaging party. The agreed-upon terms of the engagement should be specified in sufficient detail in an engagement letter or other suitable form of written agreement. AT-C Section 215.12
    When circumstances impose restrictions on the performance of the agreed-upon procedures, the practitioner should attempt to obtain agreement from the specified parties for modification of the agreed-upon procedures. When such agreement cannot be obtained (for example, when the agreed-upon procedures are published by a regulatory agency that will not modify the procedures), the practitioner should describe any restrictions on the performance of procedures in the practitioner's report or withdraw from the engagement. AT-C Section 215.37
    {agreed-upon procedures} The agreed-upon terms of the engagement should include the following: Agreement on procedures by enumerating (or referring to) the procedures AT-C Section 215.14 g.
    If the practitioner agrees to add a nonparticipant party, the practitioner should obtain affirmative acknowledgment, normally in writing, from the nonparticipant party agreeing to the procedures performed and of its taking responsibility for the sufficiency of the procedures. AT-C Section 215.38
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: The service auditor's preliminary knowledge of the engagement circumstances indicates that the scope of the engagement and management's description of the service organization's system will not be so limited that they are unlikely to be useful to user entities and their auditors. AT-C Section 320.10 a
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Preparing its description of the service organization's system and its assertion, including the completeness, accuracy, and method of presentation of the description and assertion AT-C Section 320.10 b.i.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Preparing its description of the service organization's system and its assertion, including the completeness, accuracy, and method of presentation of the description and assertion AT-C Section 320.10 b.i.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Having a reasonable basis for its assertion AT-C Section 320.10 b.ii.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Providing a written assertion that accompanies management's description of the service organization's system, both of which will be provided to user entities AT-C Section 320.10 b.vi.
    The agreed-upon terms of the engagement should include the following: Identification of the subject matter or assertion, the responsible party, and the criteria to be used AT-C Section 215.14 b.
    The agreed-upon terms of the engagement should include the following: Identification of the subject matter or assertion, the responsible party, and the criteria to be used AT-C Section 215.14 b.
    The agreed-upon terms of the engagement should include the following: Identification of the subject matter or assertion, the responsible party, and the criteria to be used AT-C Section 215.14 b.]
    Establish/Maintain Documentation Preventive
    Establish and maintain a bespoke audit scope for each audit being performed. CC ID 13077
    [When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should address other matters as the practitioner deems appropriate. AT-C Section 210.35 f.]
    Establish/Maintain Documentation Preventive
    Include audit subject matter in the audit program. CC ID 07103
    [{examination engagement} {audit terms} The agreed-upon terms of the engagement should include the following: Identification of the criteria for the measurement, evaluation, or disclosure of the subject matter AT-C Section 205.08 f.
    {examination engagement} The practitioner should establish an overall engagement strategy that sets the scope, timing, and direction of the engagement and guides the development of the engagement plan. AT-C Section 205.11
    The date of the written representations should be as of the date of the practitioner's report. The written representations should address the subject matter and periods covered by the practitioner's opinion. AT-C Section 205.54
    The practitioner should inquire of the responsible party about the following: Whether the subject matter has been prepared in accordance with (or based on) the criteria AT-C Section 210.21 a.
    {agreed-upon procedures engagement} The practitioner's agreed-upon procedures report on compliance should include the following: An indication that the subject matter of the engagement is the entity's compliance during a period or as of a point in time. AT-C Section 315.26 c.
    {examination engagement} In accordance with section 205, the practitioner should establish an overall engagement strategy that sets the scope, timing, and direction of the engagement and guides the development of the engagement plan. AT-C Section 305.19]
    Establish/Maintain Documentation Preventive
    Examine the objectivity of the audit criteria in the audit program. CC ID 07104 Establish/Maintain Documentation Preventive
    Examine the measurability of the audit criteria in the audit program. CC ID 07105
    [When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Develop a point estimate or a range to evaluate the responsible party's estimate. For this purpose, if the practitioner AT-C Section 205.30 d.
    As required by section 105, the practitioner should determine whether management has used suitable criteria in preparing and presenting the pro forma financial information. In assessing the suitability of the criteria, the practitioner should determine whether the criteria include, at a minimum, that the pro forma financial information be appropriately presented and include disclosures that enable intended users to understand the information conveyed. AT-C Section 310.11 c.]
    Establish/Maintain Documentation Preventive
    Examine the completeness of the audit criteria in the audit program. CC ID 07106
    [{examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Evaluate whether the pro forma adjustments are consistent with each other and with the data used to develop them. AT-C Section 310.13 g.]
    Establish/Maintain Documentation Preventive
    Examine the relevance of the audit criteria in the audit program. CC ID 07107
    [In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The subject matter is appropriate. AT-C Section 105.25 b.i.
    In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The criteria to be applied in the preparation and evaluation of the subject matter are suitable and will be available to the intended users. AT-C Section 105.25 b.ii.
    The practitioner should form an opinion about whether the subject matter is in accordance with (or based on) the criteria, in all material respects, or the assertion is fairly stated, in all material respects. In forming that opinion, the practitioner should evaluate AT-C Section 205.59
    As required by section 105, the practitioner should determine whether management has used suitable criteria in preparing and presenting the pro forma financial information. In assessing the suitability of the criteria, the practitioner should determine whether the criteria include, at a minimum, that the pro forma financial information be appropriately presented and include disclosures that enable intended users to understand the information conveyed. AT-C Section 310.11 c.
    As required by section 105, the practitioner should determine whether management has used suitable criteria in preparing and presenting the pro forma financial information. In assessing the suitability of the criteria, the practitioner should determine whether the criteria include, at a minimum, that the pro forma adjustments be consistent with the entity's applicable financial reporting framework and its accounting policies under that framework; and AT-C Section 310.11 b.iii.]
    Establish/Maintain Documentation Preventive
    Disseminate and communicate the audit program with the audit subject matter and audit criteria to all interested personnel and affected parties. CC ID 07116
    [In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The criteria to be applied in the preparation and evaluation of the subject matter are suitable and will be available to the intended users. AT-C Section 105.25 b.ii.]
    Establish/Maintain Documentation Preventive
    Include the in scope material or in scope products in the audit program. CC ID 08961
    [{examination engagement} The practitioner should establish an overall engagement strategy that sets the scope, timing, and direction of the engagement and guides the development of the engagement plan. AT-C Section 205.11
    {examination engagement} In establishing the overall engagement strategy, the practitioner should ascertain the nature, timing, and extent of resources necessary to perform the engagement. AT-C Section 205.12 d.
    {review engagement} The practitioner should set the scope, timing, and direction of the engagement and determine the nature, timing, and extent of the planned procedures that are required to be carried out in order to achieve the objectives of the engagement. AT-C Section 210.12
    {examination engagement} In accordance with section 205, the practitioner should establish an overall engagement strategy that sets the scope, timing, and direction of the engagement and guides the development of the engagement plan. AT-C Section 305.19]
    Audits and Risk Management Preventive
    Include the out of scope material or out of scope products in the audit program. CC ID 08962 Establish/Maintain Documentation Preventive
    Provide a representation letter in support of the audit assertion. CC ID 07158
    [{examination engagement} {audit terms} The agreed-upon terms of the engagement should include the following: An acknowledgement that the engaging party agrees to provide the practitioner with a representation letter at the conclusion of the engagement AT-C Section 205.08 g.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should AT-C Section 205.50
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should AT-C Section 205.52
    {review engagement} The agreed-upon terms of the engagement should include the following: An acknowledgement that the engaging party agrees to provide the practitioner with a representation letter at the conclusion of the engagement AT-C Section 210.09 g.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should AT-C Section 210.33
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should AT-C Section 210.35
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should AT-C Section 215.28
    {examination engagement} The practitioner should request from the responsible party a written assertion. If the responsible party refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 305.18
    In an examination of prospective financial information, the practitioner should request from the responsible party the written representations required by section 205 and paragraphs .28 or .29 of this section, as applicable, even if the engaging party is not the responsible party. The alternative to obtaining the required written representations provided for in section 205 is not permitted in an engagement to examine prospectve financial information. The responsible party's refusal to furnish the written representations required by section 205 and paragraphs .28 or .29 of this section, as applicable, constitutes a limitation on the scope of the engagement sufficient to preclude an unmodified opinion and may be sufficient to cause the practitioner to withdraw from the examination engagement, when withdrawal is possible under applicable laws and regulations. AT-C Section 305.31
    In a type 1 or type 2 engagement, the practitioner should request from the responsible party (in this case, management of the service organization), the written representations required by section 205 and paragraph .36 of this section, even if the engaging party is not the responsible party. The alternative to obtaining the required written representations provided for in section 205 is not permitted in a type 1 or type 2 engagement. The refusal by management of the service organization (or by management of a subservice organization that is being presented using the inclusive method) to furnish the written representations required by section 205 and paragraph .36 of this section constitutes a limitation on the scope of the engagement sufficient to preclude an unmodified opinion and may be sufficient to cause the service auditor to withdraw from the examination engagement when withdrawal is possible under applicable law or regulation. AT-C Section 320.38]
    Establish/Maintain Documentation Preventive
    Include a statement that management has evaluated compliance with external requirements in the representation letter. CC ID 13942
    [In an agreed-upon procedures engagement, in addition to the written representations from management required by section 215, the practitioner should request written representations from management that state that management has performed an evaluation of (i) the entity's compliance with specified requirements or (ii) the entity's controls for establishing and maintaining internal control over compliance and detecting noncompliance with requirements, as applicable. AT-C Section 315.25 b.]
    Establish/Maintain Documentation Preventive
    Include a statement that the assumptions used for estimates are reasonable in the representation letter. CC ID 13934
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should if applicable, state that significant assumptions used in making any material estimates are reasonable. AT-C Section 205.50 h.
    In addition to the written representations from management required by section 205 for an examination engagement or by section 210 for a review engagement, the practitioner should request written representations from management that the assumptions are factually supportable; AT-C Section 310.14 b.
    In addition to the written representations from management required by section 205 for an examination engagement or by section 210 for a review engagement, the practitioner should request written representations from management that the pro forma adjustments are consistent with the entity's applicable financial reporting framework and its accounting policies under that framework; and AT-C Section 310.14 d.
    {attributed} In addition to the written representations from management required by section 205 for an examination engagement or by section 210 for a review engagement, the practitioner should request written representations from management that the pro forma financial information is appropriately presented and discloses the significant effects directly attributable to the transaction (or event). (See paragraph .11c.) AT-C Section 310.14 e.]
    Establish/Maintain Documentation Preventive
    Include a statement that uncorrected misstatements are believed to be immaterial in the representation letter. CC ID 13884
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should if applicable, state that the responsible party believes the effects of uncorrected misstatements are immaterial, individually and in the aggregate, to the subject matter. AT-C Section 205.50 g.]
    Establish/Maintain Documentation Preventive
    Include a statement of responsibility for the subject matter in the representation letter. CC ID 07159
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for the subject matter and the assertion; AT-C Section 205.50 d.i.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge that the responsible party is responsible for the subject matter and assertion. AT-C Section 205.52 a.
    {is not} In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The responsible party is a party other than the practitioner and takes responsibility for the subject matter. AT-C Section 105.25 a.
    The practitioner's report should include the following: A statement that identifies the practitioner's responsibility to express a conclusion on the subject matter or assertion, based on the practitioner's review. AT-C Section 210.46 e.ii.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for the subject matter and the assertion; AT-C Section 210.33 d.i.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should include the responsible party's assertion about the subject matter based on the criteria. AT-C Section 215.28 a.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for the subject matter and the assertion; AT-C Section 215.28 c.i.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge that the responsible party is responsible for the subject matter and assertion. AT-C Section 215.29 a.
    In addition to the written representations from management required by section 205 for an examination engagement or by section 210 for a review engagement, the practitioner should request written representations from management that it is responsible for the assumptions used in determining the pro forma adjustments; AT-C Section 310.14 a.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that the pro forma adjustments are based on management's assumptions. AT-C Section 310.17 h.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that identifies management and its responsibility for the pro forma financial information. AT-C Section 310.17 i.i.
    In an agreed-upon procedures engagement, in addition to the written representations from management required by section 215, the practitioner should request written representations from management that acknowledge management's responsibility for establishing and maintaining effective internal control over compliance. AT-C Section 315.25 a.
    In an examination engagement, in addition to the written representations from management required by section 205, the practitioner should request written representations from management that state management's interpretation of any compliance requirements that have varying interpretations. AT-C Section 315.17 c.]
    Establish/Maintain Documentation Preventive
    Include a statement of responsibility for selecting the audit criteria in the representation letter. CC ID 07160
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for selecting the criteria, when applicable; and AT-C Section 205.50 d.ii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge the engaging party's responsibility for selecting the criteria, when applicable. AT-C Section 205.52 b.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for selecting the criteria, when applicable; and AT-C Section 210.33 d.ii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge the engaging party's responsibility for selecting the criteria, when applicable. AT-C Section 210.35 b.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for selecting the criteria, when applicable; and AT-C Section 215.28 c.ii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge the engaging party's responsibility for selecting the criteria, when applicable. AT-C Section 215.29 b.]
    Establish/Maintain Documentation Preventive
    Include a statement of responsibility regarding the appropriateness of the audit criteria in the representation letter. CC ID 07161
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitionr. The representations should acknowledge responsibility for determining that such criteria are appropriate for the responsible party's purposes. AT-C Section 205.50 d.iii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge the engaging party's responsibility for determining that such criteria are appropriate for its purposes. AT-C Section 205.52 c.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for determining that such criteria are appropriate for the responsible party's purposes. AT-C Section 210.33 d.iii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge the engaging party's responsibility for determining that such criteria are appropriate for its purposes. AT-C Section 210.35 c.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should acknowledge responsibility for determining that such criteria are appropriate for the responsible party's purposes. AT-C Section 215.28 c.iii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge the engaging party's responsibility for determining that such criteria are appropriate for its purposes. AT-C Section 215.29 c.
    In an agreed-upon procedures engagement, in addition to the written representations from management required by section 215, the practitioner should request written representations from management that state that management has performed an evaluation of (i) the entity's compliance with specified requirements or (ii) the entity's controls for establishing and maintaining internal control over compliance and detecting noncompliance with requirements, as applicable. AT-C Section 315.25 b.
    In an agreed-upon procedures engagement, in addition to the written representations from management required by section 215, the practitioner should request written representations from management that state management's interpretation of any compliance requirements that have varying interpretations. AT-C Section 315.25 c.]
    Establish/Maintain Documentation Preventive
    Include an assertion about the subject matter based on the selected audit criteria in the representation letter. CC ID 07162
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should include the responsible party's assertion about the subject matter based on the criteria. AT-C Section 205.50 a.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that all relevant matters are reflected in the measurement or evaluation of the subject matter or assertion. AT-C Section 205.50 b.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should address other matters as the practitioner deems appropriate. AT-C Section 205.52 f.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should include the responsible party's assertion about the subject matter based on the criteria. AT-C Section 210.33 a.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that all relevant matters are reflected in the measurement or evaluation of the subject matter or assertion. AT-C Section 210.33 b.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner other matters as the practitioner deems appropriate. AT-C Section 210.33 i.iii.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should if applicable, state that significant assumptions used in making any material estimates are reasonable. AT-C Section 210.33 h.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner other matters as the practitioner deems appropriate. AT-C Section 215.28 e.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should address other matters as the practitioner deems appropriate. AT-C Section 215.29 f.
    The examination procedures should be based on the practitioner's consideration of the following: The support for the responsible party's assumptions AT-C Section 305.20 f.
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes whether the items tested represent all or a selection of the items in the population. AT-C Section 320.40 k.ii.
    A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves evaluating the overall presentation of management's description of the service organization's system, suitability of the control objectives stated in the description, and suitability of the criteria specified by the service organization in its assertion. AT-C Section 320.40 i.iv.]
    Establish/Maintain Documentation Preventive
    Include a statement that all known matters contradicting the audit assertion have been disclosed to the auditor in the representation letter. CC ID 07163
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that all known matters contradicting the subject matter or assertion and any communication from regulatory agencies or others affecting the subject matter or assertion have been disclosed to the practitioner, including communications received between the end of the period addressed in the written assertion and the date of the practitioner's report. AT-C Section 205.50 c.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner all deficiencies in internal control relevant to the engagement of which the responsible party is aware; AT-C Section 205.50 i.i.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner other matters as the practitioner deems appropriate. AT-C Section 205.50 i.iii.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should state that the engaging party is not aware of any material misstatements in the subject matter or assertion. AT-C Section 205.52 d.
    {be inaccurate} {be incomplete} {be unsatisfactory} During the performance of review procedures, if the practitioner becomes aware that information coming to the practitioner's attention is incorrect, incomplete, or otherwise unsatisfactory, the practitioner should request that the responsible party consider the effect of these matters on the subject matter and communicate the results of its consideration to the practitioner. The practitioner should consider the results communicated to the practitioner by the responsible party and the potential effect, if any, on the practitioner's report. AT-C Section 210.25
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that all known matters contradicting the subject matter or assertion and any communication from regulatory agencies or others affecting the subject matter or assertion have been disclosed to the practitioner, including communications received between the end of the period addressed in the written assertion and the date of the practitioner's report. AT-C Section 210.33 c.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that all known matters contradicting the subject matter or assertion and any communication from regulatory agencies or others affecting the subject matter or assertion have been disclosed to the practitioner, including communications received between the end of the period addressed in the written assertion and the date of the practitioner's report. AT-C Section 215.28 b.
    In an agreed-upon procedures engagement, in addition to the written representations from management required by section 215, the practitioner should request written representations from management that state that management has performed an evaluation of (i) the entity's compliance with specified requirements or (ii) the entity's controls for establishing and maintaining internal control over compliance and detecting noncompliance with requirements, as applicable. AT-C Section 315.25 b.]
    Establish/Maintain Documentation Preventive
    Include the availability of all in scope records relevant to the subject matter in the representation letter. CC ID 07164
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that it has provided the practitioner with all relevant information and access. AT-C Section 205.50 f.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that it has provided the practitioner with all relevant information and access. AT-C Section 210.33 f.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should state that the engaging party is not aware of any material misstatements in the subject matter or assertion. AT-C Section 215.29 d.]
    Establish/Maintain Documentation Preventive
    Include a statement that any known subsequent events have been disclosed to the auditor in the representation letter. CC ID 07165
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that any known events subsequent to the period (or point in time) of the subject matter being reported on that would have a material effect on the subject matter or assertion have been disclosed to the practitioner. AT-C Section 205.50 e.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should state that the engaging party has disclosed to the practitioner all known events subsequent to the period (or point in time) of the subject matter being reported on that would have a material effect on the subject matter or assertion. AT-C Section 205.52 e.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that any known events subsequent to the period (or point in time) of the subject matter being reported on that would have a material effect on the subject matter or assertion have been disclosed to the practitioner. AT-C Section 210.33 e.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should state that the engaging party is not aware of any material misstatements in the subject matter or assertion. AT-C Section 210.35 d.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should state that the engaging party has disclosed to the practitioner all known events subsequent to the period (or point in time) of the subject matter being reported on that would have a material effect on the subject matter or assertion. AT-C Section 215.29 e.
    In evaluating the preparation and presentation of the prospective financial information, the practitioner should perform procedures to obtain reasonable assurance about whether the assumptions have been adequately disclosed in accordance with the AICPA presentation guidelines. AT-C Section 305.26 f.]
    Establish/Maintain Documentation Preventive
    Include a statement that deficiencies in internal controls have been disclosed to the auditor in the representation letter. CC ID 13899
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner all deficiencies in internal control relevant to the engagement of which the responsible party is aware; AT-C Section 210.33 i.i.]
    Establish/Maintain Documentation Preventive
    Disseminate and communicate a written audit assertion of the audit scope and audit terms to interested personnel and affected parties. CC ID 06967
    [{examination engagement} {audit terms} Although an engagement may recur, each engagement is considered a separate engagement. The practitioner should assess whether circumstances require revision to the terms of a preceding engagement. If the practitioner concludes that the terms of the preceding engagement need not be revised for the current engagement, the practitioner should remind the engaging party of the terms of the current engagement, and the reminder should be documented. AT-C Section 205.09
    {examination engagement} {audit terms} The practitioner should agree upon the terms of the engagement with the engaging party. The agreed-upon terms of the engagement should be specified in sufficient detail in an engagement letter or other suitable form of written agreement. AT-C Section 205.07
    The practitioner should request from the responsible party a written assertion about the measurement or evaluation of the subject matter against the criteria. When the engaging party is the responsible party and refuses to provide a written assertion, paragraph .82 requires the practitioner to withdraw from the engagement when withdrawal is possible under applicable law or regulation. When the engaging party is not the responsible party, and the responsible party refuses to provide a written assertion, the practitioner need not withdraw from the engagement. In that case, paragraph .84 requires the practitioner to disclose that refusal in the practitioner's report and restrict the use of the report to the engaging party. AT-C Section 205.10
    {review engagement} The practitioner should agree upon the terms of the engagement with the engaging party. The agreed- upon terms of the engagement should be specified in sufficient detail in an engagement letter or other suitable form of written agreement. AT-C Section 210.08
    Although an engagement may recur, each engagement is considered a separate engagement. The practitioner should assess whether circumstances require revision to the terms of a preceding engagement. If the practitioner concludes that the terms of the preceding engagement need not be revised for the current engagement, the practitioner should remind the engaging party of the terms of the current engagement, and the reminder should be documented. AT-C Section 210.10
    For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement quality control reviewer should perform an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. This evaluation should include the following: Reading the written subject matter or assertion and the proposed report AT-C Section 105.42 b.ii.
    {agreed-upon procedures engagement} The practitioner should agree upon the terms of the engagement with the engaging party. The agreed-upon terms of the engagement should be specified in sufficient detail in an engagement letter or other suitable form of written agreement. AT-C Section 215.12
    {examination engagement} {review engagement} The practitioner should request from management a written assertion. If management refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation AT-C Section 310.10
    {examination engagement} In performing an examination under this section, the practitioner should request from management a written assertion. If management refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 315.10
    In an examination engagement, in addition to the written representations from management required by section 205, the practitioner should request written representations from management that state that management has performed an evaluation of the entity's compliance with specified requirements. AT-C Section 315.17 b.
    {attestation engagement} The practitioner should request from management of the service organization a written assertion. If management refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 320.13
    {audit criteria} The practitioner should request from the responsible party a written assertion about the measurement or evaluation of the subject matter against the criteria. AT-C Section 215.15
    In addition to the written representations from management required by section 205 for an examination engagement or by section 210 for a review engagement, the practitioner should request written representations from management that the assumptions provide a reasonable basis for presenting the significant effects directly attributable to the underlying transaction (or event), the related pro forma adjustments give appropriate effect to those assumptions, and the pro forma amounts reflect the proper application of those adjustments to the historical financial statement amounts; AT-C Section 310.14 c.]
    Establish/Maintain Documentation Preventive
    Include any assumptions that are improbable in the audit assertion. CC ID 13950
    [{financial projection} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that identify which of the hypothetical assumptions, if any, are improbable; AT-C Section 305.29 b.
    {attributed} The practitioner's review report on pro forma financial information should include the following: A statement that those standards require that the practitioner plan and perform the review to obtain limited assurance about whether, in accordance with (or based on) the criteria, any material modifications should be made to management's assumptions in order for them to provide a reasonable basis for presenting the significant effects directly attributable to the underlying transaction (or event), AT-C Section 310.18 j.ii.(1)]
    Establish/Maintain Documentation Preventive
    Include how the audit scope matches in scope controls in the audit assertion. CC ID 06969
    [{examination engagement} In establishing the overall engagement strategy, the practitioner should identify the characteristics of the engagement that define its scope and ascertain the reporting objectives of the engagement in order to plan the timing of the engagement and the nature of the communications required; AT-C Section 205.12 a.]
    Establish/Maintain Documentation Preventive
    Include why specific criteria are ignored by in scope controls in the audit assertion. CC ID 07027 Establish/Maintain Documentation Preventive
    Include how the in scope system is designed and implemented in the audit assertion. CC ID 06970
    [{financial projection} {be expected} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that if the projection contains a range, given the hypothetical assumptions, the item or items subject to the assumption are reasonably expected to actually fall within the range and that the range was not selected in a biased or misleading manner. AT-C Section 305.29 f.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: AT-C Section 320.15 a.]
    Establish/Maintain Documentation Preventive
    Include the responsible party's opinion of the quality of the evidence in the audit assertion. CC ID 13949
    [{financial projection} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that the projection presents the expected financial position, results of operations, and cash flows for the projection period given the hypothetical assumptions, and that the projection reflects the responsible party's judgment, based on present circumstances, of expected conditions and its expected course of action given the occurrence of the hypothetical events; AT-C Section 305.29 d.
    {is appropriate} A service auditor's type 2 report should include the following: A statement that the service auditor believes the evidence obtained is sufficient and appropriate to provide a reasonable basis for the service auditor's opinion. AT-C Section 320.40 h.iii.
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should reevaluate the integrity of those from whom the representations were requested or received and evaluate the effect that this may have on the reliability of representations and evidence in general; and AT-C Section 205.55 b.]
    Establish/Maintain Documentation Preventive
    Include the end users and affected parties of the in scope system in the audit assertion. CC ID 07028
    [The practitioner's agreed-upon procedures report on compliance should include the following: An identification of the specified parties. AT-C Section 315.26 f.]
    Establish/Maintain Documentation Preventive
    Include the in scope services offered or in scope transactions processed in the audit assertion. CC ID 06971
    [{financial projection} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that the projection presents the expected financial position, results of operations, and cash flows for the projection period given the hypothetical assumptions, and that the projection reflects the responsible party's judgment, based on present circumstances, of expected conditions and its expected course of action given the occurrence of the hypothetical events; AT-C Section 305.29 d.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: The types of services provided, including, as appropriate, the classes of transactions processed. AT-C Section 320.15 a.i.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: Other aspects of the service organization's control environment, risk assessment process, information and communications (including the related business processes), control activities, and monitoring activities that are relevant to the services provided. AT-C Section 320.15 a.viii.]
    Establish/Maintain Documentation Preventive
    Include the in scope procedures in the audit assertion. CC ID 06972
    [{agreed-upon procedures} The procedures agreed upon pursuant to paragraph .14g should specify the nature, timing, and extent of the procedures. AT-C Section 215.17
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: The procedures, within both automated and manual systems, by which services are provided, including, as appropriate, procedures by which transactions are initiated, authorized, recorded, processed, corrected as necessary, and transferred to the reports and other information prepared for user entities. AT-C Section 320.15 a.ii.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: The information used in the performance of the procedures, including, if applicable, related accounting records, whether electronic or manual, and supporting information involved in initiating, authorizing, recording, processing, and reporting transactions.This includes the correction of incorrect information and how information is transferred to the reports and other information prepared for user entities. AT-C Section 320.15 a.iii.]
    Establish/Maintain Documentation Preventive
    Include the in scope records produced in the audit assertion. CC ID 06968
    [In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: The process used to prepare reports and other information for user entities. AT-C Section 320.15 a.v.]
    Establish/Maintain Documentation Preventive
    Include how in scope material events are monitored and logged in the audit assertion. CC ID 06973
    [In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: How the service organization's system captures and addresses significant events and conditions other than transactions. AT-C Section 320.15 a.iv.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: Other aspects of the service organization's control environment, risk assessment process, information and communications (including the related business processes), control activities, and monitoring activities that are relevant to the services provided. AT-C Section 320.15 a.viii.]
    Establish/Maintain Documentation Preventive
    Include any in scope material events that might affect the assertion in the audit assertion. CC ID 06991
    [The practitioner should inquire whether the responsible party, and if different, the engaging party, is aware of any events subsequent to the period (or point in time) covered by the review engagement up to the date of the practitioner's report that could have a significant effect on the subject matter or assertion. If the practitioner becomes aware, through inquiry or otherwise, of such an event, or any other event that is of such a nature and significance that its disclosure is necessary to prevent users of the report from being misled, and information about that event is not adequately disclosed by the responsible party in the subject matter or in its assertion, the practitioner should take appropriate action. AT-C Section 210.31
    {financial forecast} In an examination of a forecast, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that the forecast presents the expected financial position, results of operations, and cash flows for the forecast period and that the forecast reflects the responsible party's judgment, based on present circumstances, of the expected conditions and its expected course of action; AT-C Section 305.28 a.
    {give effect} The practitioner's review report on pro forma financial information should include the following: the practitioner's conclusion about whether, in accordance with (or based on) the review and based on the criteria, the practitioner is aware of any material modifications that should be made to the related pro forma adjustments in order for them to give appropriate effect to those assumptions, or AT-C Section 310.18 l.ii.]
    Establish/Maintain Documentation Preventive
    Include the in scope controls and compliance documents in the audit assertion. CC ID 06974
    [In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: The specified control objectives and controls designed to achieve those objectives, including, as applicable, complementary user entity controls and complementary subservice organization controls assumed in the design of the service organization's controls. AT-C Section 320.15 a.vii.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: Other aspects of the service organization's control environment, risk assessment process, information and communications (including the related business processes), control activities, and monitoring activities that are relevant to the services provided. AT-C Section 320.15 a.viii.]
    Establish/Maintain Documentation Preventive
    Include the in scope risk assessment processes in the audit assertion. CC ID 06975
    [{engagement plan} The practitioner should develop a plan that includes a description of the following items: The nature, timing, and extent of planned risk assessment procedures AT-C Section 205.13 a.
    The practitioner should obtain an understanding of the subject matter and other engagement circumstances sufficient to provide a basis for designing and performing procedures to respond to the assessed risks and to obtain reasonable assurance to support the practitioner's opinion. AT-C Section 205.14 b.
    In assessing the suitability of the criteria to evaluate whether the controls are suitably designed, the service auditor should determine if the criteria include, at a minimum, whether the risks that threaten the achievement of the control objectives stated in management's description of the service organization's system have been identified by management. AT-C Section 320.16 a.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: Other aspects of the service organization's control environment, risk assessment process, information and communications (including the related business processes), control activities, and monitoring activities that are relevant to the services provided. AT-C Section 320.15 a.viii.]
    Establish/Maintain Documentation Preventive
    Include in scope change controls in the audit assertion. CC ID 06976 Establish/Maintain Documentation Preventive
    Include any in scope uncorrected errors or non-compliance issues in the audit assertion. CC ID 06989
    [The practitioner should evaluate whether other information obtained indicates risk of material misstatement due to fraud or noncompliance with laws or regulations. AT-C Section 205.32 d.
    The practitioner should evaluate whether there are unusual or unexpected relationships within the subject matter, or between the subject matter and other related information, that indicate risks of material misstatement due to fraud or noncompliance with laws or regulations. AT-C Section 205.32 c.
    {examination engagement} The practitioner should respond appropriately to fraud or suspected fraud and noncompliance or suspected noncompliance with laws or regulations affecting the subject matter that is identified during the engagement. AT-C Section 205.33
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner its knowledge of any actual, suspected, or alleged fraud or noncompliance with laws or regulations affecting the subject matter; and AT-C Section 205.50 i.ii.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that the responsible party has disclosed to the practitioner its knowledge of any actual, suspected, or alleged fraud or noncompliance with laws or regulations affecting the subject matter; and AT-C Section 210.33 i.ii.
    The practitioner should communicate to the responsible party known and suspected fraud and noncompliance with laws or regulations, as well as uncorrected misstatements. When the engaging party is not the responsible party, the practitioner should also communicate this information to the engaging party. AT-C Section 210.61
    The practitioner should communicate to the responsible party known and suspected fraud and noncompliance with laws or regulations, as well as uncorrected misstatements. When the engaging party is not the responsible party, the practitioner should also communicate this information to the engaging party. AT-C Section 210.61
    The practitioner should communicate to the responsible party known and suspected fraud and noncompliance with laws or regulations. When the engaging party is not the responsible party, the practitioner should also communicate this information to the engaging party. AT-C Section 215.42
    The practitioner should communicate to the responsible party known and suspected fraud and noncompliance with laws or regulations. When the engaging party is not the responsible party, the practitioner should also communicate this information to the engaging party. AT-C Section 215.42
    {examination engagement} The practitioner should obtain an understanding of relevant portions of internal control over compliance sufficient to plan the engagement and to assess control risk for compliance with specified requirements. In planning the examination, such knowledge should be used to identify types of potential noncompliance, to consider factors that affect the risk of material noncompliance, and to design appropriate tests of compliance. AT-C Section 315.15
    In an agreed-upon procedures engagement, in addition to the written representations from management required by section 215, the practitioner should request written representations from management that state that management has disclosed any known noncompliance occurring subsequent to the period covered by the practitioner's report. AT-C Section 315.25 d.
    In addition to the written representations from management required by section 205, the service auditor should request written representations indicating that it has disclosed to the service auditor any of the following of which it is aware: Instances of noncompliance with laws and regulations or uncorrected misstatements attributable to the service organization that may affect one or more user entities AT-C Section 320.36 a.
    In addition to the written representations from management required by section 205, the service auditor should request written representations indicating that it has disclosed to the service auditor any of the following of which it is aware: Knowledge of any actual, suspected, or alleged fraud by management or the service organization's employees that could adversely affect the fairness of the presentation of management's description of the service organization's system or the completeness or achievement of the control objectives stated in the description AT-C Section 320.36 b.]
    Establish/Maintain Documentation Preventive
    Include the scope for the desired level of assurance in the audit program. CC ID 12793 Communicate Preventive
    Include conditions that might require modification of the audit program in the audit terms. CC ID 07149
    [{examination engagement} {audit terms} Although an engagement may recur, each engagement is considered a separate engagement. The practitioner should assess whether circumstances require revision to the terms of a preceding engagement. If the practitioner concludes that the terms of the preceding engagement need not be revised for the current engagement, the practitioner should remind the engaging party of the terms of the current engagement, and the reminder should be documented. AT-C Section 205.09
    {examination engagement} the practitioner should determine what modifications or additions to procedures are necessary to resolve the matter and should consider the effect of the matter, if any, on other aspects of the engagement. AT-C Section 205.23 ¶ 2]
    Establish/Maintain Documentation Preventive
    Include how access to in scope systems, personnel and in scope records are provided to the auditor in the audit terms. CC ID 06988
    [The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should state that it has provided the practitioner with access to all records relevant to the subject matter and the agreed-upon procedures. AT-C Section 215.28 d.
    The agreed-upon terms of the engagement should include the following: Assistance to be provided to the practitioner AT-C Section 215.14 j.]
    Establish/Maintain Documentation Preventive
    Include the criteria for determining the desired level of assurance in the audit program. CC ID 12795
    [Based on the assessed risks of material misstatement, the practitioner should evaluate whether the responsible party has appropriately applied the requirements of the criteria relevant to any estimated amounts and AT-C Section 205.29 a.
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: An identification of the criteria against which the subject matter was measured or evaluated. AT-C Section 205.63 d.
    {review engagement} The agreed-upon terms of the engagement should include the following: Identification of the criteria for the measurement, evaluation, or disclosure of the subject matter AT-C Section 210.09 f.
    The practitioner's report should include the following: An identification of the criteria against which the subject matter was measured or evaluated. AT-C Section 210.46 d.
    As required by section 105, the practitioner should determine whether management has used suitable criteria in preparing and presenting the pro forma financial information. In assessing the suitability of the criteria, the practitioner should determine whether the criteria include, at a minimum, that the pro forma adjustments be factually supportable, AT-C Section 310.11 b.ii.
    Section 205 requires a practitioner to request from the responsible party a written assertion about the measurement or evaluation of the subject matter against the criteria.5 The practitioner should determine that management's assertion addresses all the criteria management used to evaluate the fairness of the presentation of the description, the suitability of the design of the controls, and in a type 2 engagement, the operating effectiveness of the controls. AT-C Section 320.18]
    Audits and Risk Management Preventive
    Establish and maintain procedures for determining the desired level of assurance in the audit program. CC ID 12794
    [When designing and performing analytical procedures in response to assessed risks, the practitioner should determine the suitability of particular analytical procedures for the subject matter, taking into account the assessed risks of material misstatement and any related tests of details; AT-C Section 205.27 a.
    When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test how the responsible party made the estimate and the data on which it is based. In doing so, the practitioner should evaluate whether the method of measurement used is appropriate in the circumstances, AT-C Section 205.30 b.i.
    Based on the assessed risks of material misstatement, the practitioner should evaluate whether the methods for making estimates are appropriate and have been applied consistently and whether changes, if any, in reported estimates or in the method for making them from the prior period, if applicable, are appropriate in the circumstances. AT-C Section 205.29 b.
    Based on the assessed risks of material misstatement, the practitioner should evaluate whether the methods for making estimates are appropriate and have been applied consistently and whether changes, if any, in reported estimates or in the method for making them from the prior period, if applicable, are appropriate in the circumstances. AT-C Section 205.29 b.]
    Establish/Maintain Documentation Preventive
    Include the expectations for the audit report in the audit terms. CC ID 07148
    [The practitioner should obtain an understanding of the subject matter and other engagement circumstances sufficient to provide a basis for designing and performing procedures to respond to the assessed risks and to obtain reasonable assurance to support the practitioner's opinion. AT-C Section 205.14 b.
    The agreed-upon terms of the engagement should include the following: Disclaimers expected to be included in the practitioner's report AT-C Section 215.14 h.
    {financial forecast} The practitioner should evaluate whether the responsible party has a reasonably objective basis for the forecast and should consider whether sufficiently objective assumptions can be developed for each key factor. AT-C Section 305.21]
    Establish/Maintain Documentation Preventive
    Establish and maintain a practitioner’s report on management’s assertions, as necessary. CC ID 13888 Establish/Maintain Documentation Preventive
    Refrain from changing the date of the practitioner's report on agreed-upon procedures when reissuing it. CC ID 13896
    [If the practitioner's report is reissued to acknowledge the nonparticipant party, the date of the report should not be changed. AT-C Section 215.39]
    Establish/Maintain Documentation Corrective
    Include materiality levels in the audit terms. CC ID 01238
    [When establishing the overall engagement strategy, the practitioner should consider materiality for the subject matter. AT-C Section 205.16
    The practitioner should reconsider materiality for the subject matter if the practitioner becomes aware of information during the engagement that would have caused the practitioner to have initially determined a different materiality. AT-C Section 205.17
    In order to establish that the preconditions for an agreed-upon procedures engagement are present, the practitioner should determine that the following conditions, in addition to the preconditions identified in section 105, are present: When applicable, the practitioner agrees to apply any materiality limits established by the specified parties for reporting purposes. AT-C Section 215.10 e.
    The agreed-upon terms of the engagement should include the following: Agreed-upon materiality limits specified by the specified parties, if applicable AT-C Section 215.14 l.
    The practitioner should report all findings from application of the agreed-upon procedures. Any agreed-upon materiality limits should be described in the practitioner's report. AT-C Section 215.26
    The examination procedures should be based on the practitioner's consideration of the following: The nature and materiality of the information to the prospective financial information taken as a whole AT-C Section 305.20 a.
    The practitioner's agreed-upon procedures report should include the following: When applicable, a description of any agreed-upon materiality limits. AT-C Section 215.35 i.
    The practitioner's agreed-upon procedures report on compliance should include the following: When applicable, a description of any agreed-upon materiality limits. AT-C Section 315.26 i.]
    Establish/Maintain Documentation Preventive
    Include material changes in information processes, Information Systems, and assets that could affect audits in the audit terms. CC ID 01239
    [Based on the assessed risks of material misstatement, the practitioner should evaluate whether the methods for making estimates are appropriate and have been applied consistently and whether changes, if any, in reported estimates or in the method for making them from the prior period, if applicable, are appropriate in the circumstances. AT-C Section 205.29 b.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum in the case of a type 2 report, whether management's description of the service organization's system includes relevant details of changes to the service organization's system during the period covered by the description AT-C Section 320.15 b.
    {type 2 report} {significant change} When performing a type 2 engagement, the service auditor should obtain an understanding of changes in the service organization's system that were implemented during the period covered by the service auditor's report. If the service auditor believes the changes would be considered significant by user entities and their auditors, the service auditor should determine whether those changes are included in management's description of the service organization's system. If such changes are not included in the description, the service auditor should describe the changes in the report and determine the effect on the report. If superseded controls are relevant to the achievement of the control objectives stated in the description, the service auditor should, if possible, test the superseded controls before the change. If the service auditor cannot test superseded controls relevant to the achievement of the control objectives stated in the description, the service auditor should determine the effect on the report. AT-C Section 320.29
    {type 2 report} {significant change} When performing a type 2 engagement, the service auditor should obtain an understanding of changes in the service organization's system that were implemented during the period covered by the service auditor's report. If the service auditor believes the changes would be considered significant by user entities and their auditors, the service auditor should determine whether those changes are included in management's description of the service organization's system. If such changes are not included in the description, the service auditor should describe the changes in the report and determine the effect on the report. If superseded controls are relevant to the achievement of the control objectives stated in the description, the service auditor should, if possible, test the superseded controls before the change. If the service auditor cannot test superseded controls relevant to the achievement of the control objectives stated in the description, the service auditor should determine the effect on the report. AT-C Section 320.29
    {type 2 report} {significant change} When performing a type 2 engagement, the service auditor should obtain an understanding of changes in the service organization's system that were implemented during the period covered by the service auditor's report. If the service auditor believes the changes would be considered significant by user entities and their auditors, the service auditor should determine whether those changes are included in management's description of the service organization's system. If such changes are not included in the description, the service auditor should describe the changes in the report and determine the effect on the report. If superseded controls are relevant to the achievement of the control objectives stated in the description, the service auditor should, if possible, test the superseded controls before the change. If the service auditor cannot test superseded controls relevant to the achievement of the control objectives stated in the description, the service auditor should determine the effect on the report. AT-C Section 320.29
    {give effect} The practitioner's review report on pro forma financial information should include the following: A statement that those standards require that the practitioner plan and perform the review to obtain limited assurance about whether, in accordance with (or based on) the criteria, any material modifications should be made to the related pro forma adjustments in order for them to give appropriate effect to those assumptions, or AT-C Section 310.18 j.ii.(2)
    {attributed} The practitioner's review report on pro forma financial information should include the following: the practitioner's conclusion about whether, in accordance with (or based on) the review and based on the criteria, the practitioner is aware of any material modifications that should be made to management's assumptions in order for them to provide a reasonable basis for presenting the significant effects directly attributable to the underlying transaction (or event), AT-C Section 310.18 l.i.]
    Establish/Maintain Documentation Preventive
    Include material weaknesses, material failures, and material errors in information processes, Information Systems, and assets that could affect audits in the audit terms. CC ID 01240
    [{examination engagement} The practitioner should accumulate misstatements identified during the engagement other than those that are clearly trivial. AT-C Section 205.45
    The nature, timing, and extent of the procedures a practitioner performs when the practitioner expects to use the work of a practitioner's specialist will vary depending on the circumstances. In determining the nature, timing, and extent of those procedures, the practitioner should consider the following: The risks of material misstatement in the matter to which that specialist's work relates AT-C Section 205.38 c.
    {be inaccurate} {be incomplete} {be unsatisfactory} During the performance of review procedures, if the practitioner becomes aware that information coming to the practitioner's attention is incorrect, incomplete, or otherwise unsatisfactory, the practitioner should request that the responsible party consider the effect of these matters on the subject matter and communicate the results of its consideration to the practitioner. The practitioner should consider the results communicated to the practitioner by the responsible party and the potential effect, if any, on the practitioner's report. AT-C Section 210.25
    {be inaccurate} {be incomplete} {be unsatisfactory} During the performance of review procedures, if the practitioner becomes aware that information coming to the practitioner's attention is incorrect, incomplete, or otherwise unsatisfactory, the practitioner should request that the responsible party consider the effect of these matters on the subject matter and communicate the results of its consideration to the practitioner. The practitioner should consider the results communicated to the practitioner by the responsible party and the potential effect, if any, on the practitioner's report. AT-C Section 210.25]
    Establish/Maintain Documentation Preventive
    Refrain from performing an attestation engagement under defined conditions. CC ID 13952 Audits and Risk Management Detective
    Refrain from accepting an attestation engagement unless the prospective financial information includes a summary of significant assumptions. CC ID 13954
    [{financial forecast} {financial projection} In addition to determining that the preconditions for accepting or continuing an agreed-upon procedures engagement enumerated in section 105 and section 215 are met, the practitioner should not perform an agreed-upon procedures engagement on a forecast or projection unless the prospective financial information includes a summary of significant assumptions. AT-C Section 305.38]
    Behavior Preventive
    Accept the attestation engagement when all preconditions are met. CC ID 13933
    [The practitioner should accept an attestation engagement only when the practitioner has determined that the engagement to be performed meets all the preconditions for an attestation engagement (see also paragraphs .24–.25); and AT-C Section 105.27 c.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Selecting the criteria to be used and stating them in the assertion AT-C Section 320.10 b.iii.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Selecting the criteria to be used and stating them in the assertion AT-C Section 320.10 b.iii.]
    Business Processes Preventive
    Refrain from accepting an attestation engagement when all parties disagree on the procedures. CC ID 13951
    [The practitioner should not accept an agreed-upon procedures engagement when the specified parties do not agree upon the procedures performed, or to be performed, or do not take responsibility for the sufficiency of the procedures for their purposes. (See paragraphs .38–.40 for the requirements and related application guidance on satisfying these requirements when the practitioner is requested to add a nonparticipant party.) AT-C Section 215.11]
    Audits and Risk Management Preventive
    Audit in scope audit items and compliance documents as defined in the audit scope. CC ID 06730
    [{attestation engagement} The engagement partner should be satisfied that the engagement team, and any practitioner's external specialists, collectively, have the appropriate competence, including knowledge of the subject matter, and capabilities to perform the engagement in accordance with professional standards and applicable legal and regulatory requirements and AT-C Section 105.32 a.i.]
    Audits and Risk Management Preventive
    Identify hypothetical assumptions in forecasts and projections during an audit. CC ID 13946
    [{financial projection} In an examination of a projection, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that identify the hypothetical assumptions; AT-C Section 305.29 a.]
    Audits and Risk Management Detective
    Refrain from examining forecasts and projections which refrain from disclosing assumptions during an audit. CC ID 13932
    [{examination engagement} {financial forecast} {financial projection} A practitioner should not examine a forecast or projection that discloses none of the significant assumptions. If after accepting the engagement the practitioner determines that the forecast or projection discloses none of the significant assumptions, the practitioner should withdraw from the engagement, unless required by law or regulation to report on the financial forecast or projection, in which case, the practitioner should express an adverse opinion in the practitioner's report. AT-C Section 305.12
    Unless required by law or regulation to do so, a practitioner should not accept an engagement to examine a forecast or projection, unless the responsible party has agreed to disclose the significant assumptions AT-C Section 305.11 a.
    Unless required by law or regulation to do so, a practitioner should not accept an engagement to examine a financial projection, unless the responsible party has agreed to identify in the presentation which of the assumptions are hypothetical and to describe the limitations on the usefulness of the projection. AT-C Section 305.11 b.]
    Audits and Risk Management Detective
    Audit policies, standards, and procedures. CC ID 12927 Audits and Risk Management Preventive
    Audit cybersecurity risk management within the policies, standards, and procedures of the organization. CC ID 13011 Investigate Detective
    Audit information systems, as necessary. CC ID 13010 Investigate Detective
    Audit the potential costs of compromise to information systems. CC ID 13012 Investigate Detective
    Determine the accurateness of the audit assertion's in scope system description. CC ID 06979
    [The practitioner should evaluate whether the written description of the subject matter or assertion adequately refers to or describes the criteria. AT-C Section 205.58
    {examination engagement} The practitioner should evaluate, based on the evidence obtained, whether the presentation of the subject matter or assertion is misleading within the context of the engagement. AT-C Section 205.60
    The practitioner should evaluate whether the written description of the subject matter or assertion adequately refers to or describes the criteria. AT-C Section 210.41
    {review engagement} The practitioner should evaluate, based on the review evidence obtained, whether the presentation of the subject matter or assertion is misleading within the context of the engagement. AT-C Section 210.43
    {financial forecast} In an examination of a forecast, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that the forecast presents the expected financial position, results of operations, and cash flows for the forecast period and that the forecast reflects the responsible party's judgment, based on present circumstances, of the expected conditions and its expected course of action; AT-C Section 305.28 a.
    {be accurate} In evaluating the preparation and presentation of the prospective financial information, the practitioner should perform procedures to obtain reasonable assurance about whether the computations made to translate the assumptions into prospective amounts are mathematically accurate, AT-C Section 305.26 b.
    As required by section 105, the service auditor should assess whether management has used suitable criteria in preparing its description of the service organization's system, AT-C Section 320.14 a.
    {do not distort} {not include} In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system does not omit or distort information relevant to the service organization's system, while acknowledging that management's description of the service organization's system is prepared to meet the common needs of a broad range of user entities and their user auditors, and may not, therefore, include every aspect of the service organization's system that each individual user entity and its user auditor may consider important in its own particular environment. AT-C Section 320.15 c.
    The service auditor's consideration of materiality should include the fair presentation of management's description of the service organization's system, the suitability of the design of controls to achieve the related control objectives stated in the description and, in the case of a type 2 report, the operating effectiveness of the controls to achieve the related control objectives stated in the description. AT-C Section 320.19
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Read the pro forma financial information and evaluate whether the source of the historical financial information on which the pro forma financial information is based has been appropriately identified. AT-C Section 310.13 i.ii.]
    Testing Detective
    Determine if the in scope system has been implemented as described in the audit assertion. CC ID 06983 Testing Detective
    Determine the effect of fraud and non-compliance on the description of the system in the audit assertion, as necessary. CC ID 13977
    [If the service auditor becomes aware of incidents of noncompliance with laws or regulations, fraud or uncorrected misstatements attributable to management or other service organization personnel that are not clearly trivial and that may affect one or more user entities, the service auditor should determine the effect of such incidents on management's assertion, management's description of the service organization's system, the achievement of the control objectives, and the service auditor's report. AT-C Section 320.34
    If the service auditor becomes aware of incidents of noncompliance with laws or regulations, fraud or uncorrected misstatements attributable to management or other service organization personnel that are not clearly trivial and that may affect one or more user entities, the service auditor should determine the effect of such incidents on management's assertion, management's description of the service organization's system, the achievement of the control objectives, and the service auditor's report. AT-C Section 320.34]
    Process or Activity Detective
    Edit the audit assertion for accuracy. CC ID 07030
    [{agreed-upon procedures} In some circumstances, the procedures agreed upon evolve or are modified over the course of the engagement. In such circumstances, the practitioner should amend the engagement letter or other suitable form of written agreement, as applicable, to reflect the modified procedures. AT-C Section 215.18]
    Establish/Maintain Documentation Preventive
    Determine if the audit assertion's in scope procedures are accurately documented. CC ID 06982
    [{examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Read the pro forma financial information and evaluate whether the underlying transaction (or event), the pro forma adjustments, the significant assumptions, and the significant uncertainties, if any, about those assumptions have been appropriately described. AT-C Section 310.13 i.i.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether management's assertion about compliance with the specified requirements is fairly stated, in all material respects. AT-C Section 315.20 f.ii.(2)
    If, as a result of performing the procedures in paragraph .32, the service auditor becomes aware that any identified deviations have resulted from fraud by service organization personnel, the service auditor should assess the risk that management's description of the service organization's system is not fairly presented, the controls are not suitably designed and, in a type 2 engagement, the controls are not operating effectively. AT-C Section 320.33]
    Establish/Maintain Documentation Preventive
    Determine if the audit assertion's in scope controls are reasonable. CC ID 06980
    [If the practitioner designed and performed tests of controls to rely on their operating effectiveness and identified deviations in those controls, the practitioner should make specific inquiries and perform other procedures as necessary to understand these matters and their potential consequences. The practitioner also should determine whether the tests of controls that have been performed provide an appropriate basis for reliance on the controls, AT-C Section 205.25 a.
    When written representations are directly related to matters that are material to the subject matter, the practitioner should evaluate their reasonableness and consistency with other evidence obtained, including other representations (oral or written) and AT-C Section 205.53 a.
    When written representations are directly related to matters that are material to the subject matter, the practitioner should evaluate their reasonableness and consistency with other review evidence obtained, including other representations (oral or written) and AT-C Section 210.36 a.
    As required by section 105, the service auditor should assess whether management has used suitable criteria in evaluating whether controls were suitably designed to achieve the control objectives stated in the description, and AT-C Section 320.14 b.
    In assessing the suitability of the criteria to evaluate whether the controls are suitably designed, the service auditor should determine if the criteria include, at a minimum, whether the controls identified in management's description of the service organization's system would, if operating effectively, provide reasonable assurance that those risks would not prevent the control objectives stated in the description from being achieved. AT-C Section 320.16 b.
    The service auditor should obtain an understanding of the service organization's system, including controls that are included in the scope of the engagement. That understanding should include service organization processes used to assess the suitability of the design of the controls, and AT-C Section 320.20 c.
    When designing and performing tests of controls, the service auditor should determine whether the controls to be tested depend on other controls, and if so, whether it is necessary to obtain evidence supporting the operating effectiveness of those other controls. AT-C Section 320.31 b.
    The service auditor's consideration of materiality should include the fair presentation of management's description of the service organization's system, the suitability of the design of controls to achieve the related control objectives stated in the description and, in the case of a type 2 report, the operating effectiveness of the controls to achieve the related control objectives stated in the description. AT-C Section 320.19
    The service auditor should obtain and read management's description of the service organization's system and should evaluate whether those aspects of the description that are included in the scope of the engagement are presented fairly, in all material respects, based on the criteria in management's assertion, including whether the control objectives stated in management's description of the service organization's system are reasonable in the circumstances; AT-C Section 320.25 a.
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Evaluate whether management's assumptions that underlie the pro forma adjustments are presented in a sufficiently clear and comprehensive manner. AT-C Section 310.13 f.]
    Testing Detective
    Determine the effect of fraud and non-compliance on the achievement of in scope controls in the audit assertion, as necessary. CC ID 13978
    [If the service auditor becomes aware of incidents of noncompliance with laws or regulations, fraud or uncorrected misstatements attributable to management or other service organization personnel that are not clearly trivial and that may affect one or more user entities, the service auditor should determine the effect of such incidents on management's assertion, management's description of the service organization's system, the achievement of the control objectives, and the service auditor's report. AT-C Section 320.34]
    Process or Activity Detective
    Document test plans for auditing in scope controls. CC ID 06985
    [If the practitioner designed and performed tests of controls to rely on their operating effectiveness and identified deviations in those controls, the practitioner should make specific inquiries and perform other procedures as necessary to understand these matters and their potential consequences. The practitioner also should determine whether AT-C Section 205.25
    When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test how the responsible party made the estimate and the data on which it is based. In doing so, the practitioner should evaluate whether the method of measurement used is appropriate in the circumstances, AT-C Section 205.30 b.i.
    When designing and performing analytical procedures, the practitioner should develop an expectation with respect to recorded amounts or ratios. AT-C Section 210.19 c.
    {agreed-upon procedures} In order to establish that the preconditions for an agreed-upon procedures engagement are present, the practitioner should determine that the following conditions, in addition to the preconditions identified in section 105, are present: The procedures to be applied to the subject matter are expected to result in reasonably consistent findings using the criteria. AT-C Section 215.10 d.]
    Testing Detective
    Determine the implementation status of the audit assertion's in scope controls. CC ID 06981
    [In assessing the suitability of the criteria to evaluate whether controls operated effectively to provide reasonable assurance that the control objectives stated in management's description of the service organization's system were achieved, the service auditor should determine if the criteria include, at a minimum, whether the controls were consistently applied as designed throughout the specified period, including whether manual controls were applied by individuals who have the appropriate competence and authority. AT-C Section 320.17
    The service auditor should obtain and read management's description of the service organization's system and should evaluate whether those aspects of the description that are included in the scope of the engagement are presented fairly, in all material respects, based on the criteria in management's assertion, including whether controls identified in management's description of the service organization's system were implemented; AT-C Section 320.25 b.
    If analytical procedures identify fluctuations or relationships that are inconsistent with other relevant information or that differ significantly from expected amounts or ratios, the practitioner should investigate such differences by inquiring of the responsible party and obtaining additional evidence relevant to its responses and AT-C Section 205.28.a.
    The service auditor should assess whether the controls that management identified in its description of the service organization's system as the controls that achieve the control objectives were suitably designed to achieve those control objectives by determining that the controls have been implemented. AT-C Section 320.27 c.]
    Testing Detective
    Determine the effectiveness of in scope controls. CC ID 06984
    [The practitioner should design and perform tests of controls to obtain sufficient appropriate evidence about the operating effectiveness of relevant controls if AT-C Section 205.24
    The service auditor should obtain an understanding of the service organization's system, including controls that are included in the scope of the engagement. That understanding should include service organization processes used to in a type 2 report, assess the operating effectiveness of controls. AT-C Section 320.20 d.
    The service auditor's consideration of materiality should include the fair presentation of management's description of the service organization's system, the suitability of the design of controls to achieve the related control objectives stated in the description and, in the case of a type 2 report, the operating effectiveness of the controls to achieve the related control objectives stated in the description. AT-C Section 320.19
    When performing a type 2 engagement, the service auditor should test those controls that management has identified in its description of the service organization's system as the controls that achieve the control objectives and should assess the operating effectiveness of those controls throughout the period. Evidence obtained in prior engagements about the satisfactory operation of controls in prior periods does not provide a basis for a reduction in testing, even if it is supplemented with evidence obtained during the current period. AT-C Section 320.28
    If, as a result of performing the procedures in paragraph .32, the service auditor becomes aware that any identified deviations have resulted from fraud by service organization personnel, the service auditor should assess the risk that management's description of the service organization's system is not fairly presented, the controls are not suitably designed and, in a type 2 engagement, the controls are not operating effectively. AT-C Section 320.33]
    Testing Detective
    Review incident management audit logs to determine the effectiveness of in scope controls. CC ID 12157 Audits and Risk Management Detective
    Review audit reports to determine the effectiveness of in scope controls. CC ID 12156
    [{type 2 report} {significant change} When performing a type 2 engagement, the service auditor should obtain an understanding of changes in the service organization's system that were implemented during the period covered by the service auditor's report. If the service auditor believes the changes would be considered significant by user entities and their auditors, the service auditor should determine whether those changes are included in management's description of the service organization's system. If such changes are not included in the description, the service auditor should describe the changes in the report and determine the effect on the report. If superseded controls are relevant to the achievement of the control objectives stated in the description, the service auditor should, if possible, test the superseded controls before the change. If the service auditor cannot test superseded controls relevant to the achievement of the control objectives stated in the description, the service auditor should determine the effect on the report. AT-C Section 320.29
    {type 2 report} {significant change} When performing a type 2 engagement, the service auditor should obtain an understanding of changes in the service organization's system that were implemented during the period covered by the service auditor's report. If the service auditor believes the changes would be considered significant by user entities and their auditors, the service auditor should determine whether those changes are included in management's description of the service organization's system. If such changes are not included in the description, the service auditor should describe the changes in the report and determine the effect on the report. If superseded controls are relevant to the achievement of the control objectives stated in the description, the service auditor should, if possible, test the superseded controls before the change. If the service auditor cannot test superseded controls relevant to the achievement of the control objectives stated in the description, the service auditor should determine the effect on the report. AT-C Section 320.29]
    Audits and Risk Management Detective
    Observe processes to determine the effectiveness of in scope controls. CC ID 12155
    [In obtaining an understanding of the subject matter in accordance with paragraph .14, the practitioner should obtain an understanding of internal control over the preparation of the subject matter relevant to the engagement. This includes evaluating the design of those controls relevant to the subject matter and determining whether they have been implemented by performing procedures in addition to inquiry of the personnel responsible for the subject matter. AT-C Section 205.15
    The service auditor should obtain an understanding of the service organization's system, including controls that are included in the scope of the engagement. That understanding should include service organization processes used to identify controls designed to achieve the control objectives, AT-C Section 320.20 b.
    The service auditor should obtain an understanding of the service organization's system, including controls that are included in the scope of the engagement. That understanding should include service organization processes used to prepare the description of the service organization's system, including the determination of control objectives, AT-C Section 320.20 a.]
    Audits and Risk Management Detective
    Interview stakeholders to determine the effectiveness of in scope controls. CC ID 12154 Audits and Risk Management Detective
    Review policies and procedures to determine the effectiveness of in scope controls. CC ID 12144
    [In obtaining an understanding of the subject matter in accordance with paragraph .14, the practitioner should obtain an understanding of internal control over the preparation of the subject matter relevant to the engagement. This includes evaluating the design of those controls relevant to the subject matter and determining whether they have been implemented by performing procedures in addition to inquiry of the personnel responsible for the subject matter. AT-C Section 205.15
    In designing and performing further procedures in accordance with paragraph .21, the practitioner should consider the reasons for the assessment given to the risk of material misstatement, including whether the practitioner intends to rely on the operating effectiveness of controls in determining the nature, timing, and extent of other procedures, and AT-C Section 205.22 a.ii.
    The service auditor should investigate the nature and cause of any deviations identified and should determine whether the testing that has been performed provides an appropriate basis for concluding that the control did not operate effectively throughout the specified period. AT-C Section 320.32 c.]
    Audits and Risk Management Detective
    Determine any errors or material omissions in the audit assertion that affect in scope control implementations. CC ID 06990
    [If the practitioner designed and performed tests of controls to rely on their operating effectiveness and identified deviations in those controls, the practitioner should make specific inquiries and perform other procedures as necessary to understand these matters and their potential consequences. The practitioner also should determine whether the potential risks of misstatement need to be addressed using other procedures. AT-C Section 205.25 c.
    {practitioner's opinion} The practitioner should form an opinion about whether the subject matter is in accordance with (or based on) the criteria, in all material respects, or the assertion is fairly stated, in all material respects. In forming that opinion, the practitioner should evaluate whether uncorrected misstatements are material, individually or in the aggregate. AT-C Section 205.59 b.
    The practitioner should form a conclusion about whether the practitioner is aware of any material modifications that should be made to the subject matter in order for it to be in accordance with (or based on) the criteria or to the responsible party's assertion in order for it to be fairly stated. In forming that conclusion, the practitioner should evaluate whether uncorrected misstatements are material, individually or in the aggregate. AT-C Section 210.42 b.
    The practitioner should request from the responsible party written representations in the form of a letter addressed to the practitioner. The representations should if applicable, state that the responsible party believes the effects of uncorrected misstatements are immaterial, individually and in the aggregate, to the subject matter. AT-C Section 210.33 g.
    The examination procedures should be based on the practitioner's consideration of the following: The likelihood of material misstatements AT-C Section 305.20 b.]
    Testing Detective
    Include the process of using evidential matter to test in scope controls in the test plan. CC ID 06996
    [When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test how the responsible party made the estimate and the data on which it is based. In doing so, the practitioner should evaluate whether the method of measurement used is appropriate in the circumstances, AT-C Section 205.30 b.i.
    The examination procedures should be based on the practitioner's consideration of the following: The extent to which the prospective financial information is affected by the responsible party's judgment, for example, its judgment in selecting the significant assumptions used to prepare the prospective financial information AT-C Section 305.20 e.
    {be consistent} In evaluating the preparation and presentation of the prospective financial information, the practitioner should perform procedures to obtain reasonable assurance about whether the assumptions are internally consistent, AT-C Section 305.26 c.
    As required by section 105, the service auditor should assess whether management has used suitable criteria in evaluating whether controls operated effectively throughout the specified period to achieve the control objectives stated in the description of the service organization's system, in the case of a type 2 report. AT-C Section 320.14 c.
    When designing and performing tests of controls, the service auditor should perform other procedures such as inspection, observation, or reperformance in combination with inquiry to obtain evidence about the following: The consistency with which the control was applied AT-C Section 320.31 a.ii.
    When designing and performing tests of controls, the service auditor should determine whether the controls to be tested depend on other controls, and if so, whether it is necessary to obtain evidence supporting the operating effectiveness of those other controls. AT-C Section 320.31 b.
    When designing and performing tests of controls, the service auditor should determine an effective method for selecting the items to be tested to meet the objectives of the procedure. AT-C Section 320.31 c.
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes AT-C Section 320.40 k.
    A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves testing the operating effectiveness of those controls that management considers necessary to provide reasonable assurance that the related control objectives stated in management's description of the service organization's system were achieved. AT-C Section 320.40 i.iii.
    When performing a type 2 engagement, the service auditor should test those controls that management has identified in its description of the service organization's system as the controls that achieve the control objectives and should assess the operating effectiveness of those controls throughout the period. Evidence obtained in prior engagements about the satisfactory operation of controls in prior periods does not provide a basis for a reduction in testing, even if it is supplemented with evidence obtained during the current period. AT-C Section 320.28
    {personnel} When designing and performing tests of controls, the service auditor should perform other procedures such as inspection, observation, or reperformance in combination with inquiry to obtain evidence about the following: By whom or by what means the control was applied AT-C Section 320.31 a.iii.]
    Establish/Maintain Documentation Preventive
    Audit the in scope system according to the test plan using relevant evidence. CC ID 07112 Testing Preventive
    Implement procedures that collect sufficient audit evidence. CC ID 07153
    [{engagement plan} {alternative procedures} {examination engagement} The practitioner should develop a plan that includes a description of the following items: Other planned procedures that are required to be carried out so that the engagement complies with the attestation standards AT-C Section 205.13 c.
    In designing and performing further procedures in accordance with paragraph .21, the practitioner should obtain more persuasive evidence the higher the practitioner's assessment of risk. AT-C Section 205.22 b.
    When using information produced by the entity, the practitioner should evaluate whether the information is sufficiently reliable for the practitioner's purposes, including, as necessary, the following: AT-C Section 205.35
    If the practitioner determines that the work of the practitioner's specialist is not adequate for the practitioner's purposes, the practitioner should agree with the practitioner's specialist on the nature and extent of further work to be performed by the practitioner's specialist or AT-C Section 205.37 a.
    When using the work of the internal audit function, the practitioner should perform sufficient procedures on the body of work of the internal audit function as a whole that the practitioner plans to use to determine its adequacy for the purpose of the examination engagement, including reperforming some of the body of work of the internal audit function that the practitioner intends to use in obtaining evidence. AT-C Section 205.40
    {examination engagement} The practitioner should evaluate the sufficiency and appropriateness of the evidence obtained in the context of the engagement and, if necessary, attempt to obtain further evidence. The practitioner should consider all relevant evidence, regardless of whether it appears to corroborate or contradict the measurement or evaluation of the subject matter against the criteria. AT-C Section 205.46
    If the practitioner determines that the work of the practitioner's specialist is not adequate for the practitioner's purposes, the practitioner should perform additional procedures appropriate to the circumstances. AT-C Section 205.37 b.
    When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test how the responsible party made the estimate and the data on which it is based. In doing so, the practitioner should evaluate whether the AT-C Section 205.30 b.
    When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test the operating effectiveness of the controls over how the responsible party made the estimate, together with other appropriate further procedures. AT-C Section 205.30 c.
    When designing and performing analytical procedures, the practitioner should determine the suitability of particular analytical procedures for the subject matter, taking into account the practitioner's awareness of risks; AT-C Section 210.19 a.
    {review engagement} {sufficiency of review evidence} {appropriateness of review evidence} The practitioner should evaluate the sufficiency and appropriateness of the review evidence obtained in the context of the engagement and, if necessary, attempt to obtain further review evidence. The practitioner should consider all relevant review evidence, regardless of whether it appears to corroborate or contradict the measurement or evaluation of the subject matter against the criteria. AT-C Section 210.29
    In evaluating the preparation and presentation of the prospective financial information, the practitioner should perform procedures to obtain reasonable assurance about whether the presentation reflects the identified assumptions, AT-C Section 305.26 a.
    {financial forecasts} {financial projections} In evaluating the preparation and presentation of the prospective financial information, the practitioner should perform procedures to obtain reasonable assurance about whether the accounting principles used in the forecast or projection are appropriate, AT-C Section 305.26 d.
    In evaluating the preparation and presentation of the prospective financial information, the practitioner should perform procedures to obtain reasonable assurance about whether the prospective financial information is presented in accordance with the AICPA presentation guidelines, and AT-C Section 305.26 e.
    {is appropriate} The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement that the practitioner believes the evidence obtained is sufficient and appropriate to provide a reasonable basis for the practitioner's opinion. AT-C Section 305.32 f.iii.
    If analytical procedures identify fluctuations or relationships that are inconsistent with other relevant information or that differ significantly from expected amounts or ratios, the practitioner should investigate such differences by inquiring of the responsible party and obtaining additional evidence relevant to its responses and AT-C Section 205.28.a.
    A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves performing procedures to obtain evidence about the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description based on the criteria in management's assertion. AT-C Section 320.40 i.i.
    {is appropriate} The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that the practitioner believes that the evidence the practitioner obtained is sufficient and appropriate to provide a reasonable basis for the practitioner's opinion. AT-C Section 310.17 j.iv.
    The practitioner's review report on pro forma financial information should include the following: A reference to the financial statements from which the historical financial information is derived and a statement that such financial statements were audited or reviewed, as applicable. AT-C Section 310.18 g.i.]
    Audits and Risk Management Preventive
    Collect evidence about the in scope audit items of the audit assertion. CC ID 07154
    [When using information produced by the entity, the practitioner should evaluate whether the information is sufficiently reliable for the practitioner's purposes, including, as necessary, the following: Obtaining evidence about the accuracy and completeness of the information AT-C Section 205.35 a.
    The practitioner should form an opinion about whether the subject matter is in accordance with (or based on) the criteria, in all material respects, or the assertion is fairly stated, in all material respects. In forming that opinion, the practitioner should evaluate the practitioner's conclusion regarding the sufficiency and appropriateness of evidence obtained and AT-C Section 205.59 a.
    In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The practitioner expects to be able to obtain the evidence needed to arrive at the practitioner's opinion, conclusion, or findings, including AT-C Section 105.25 b.iii
    the practitioner should design and perform analytical procedures and make inquiries and perform other procedures, as appropriate, to accumulate review evidence in obtaining limited assurance about whether any material modifications should be made to the subject matter in order for it to be in accordance with (or based on) the criteria, or the assertion, in order for it to be fairly stated. AT-C Section 210.16 ¶ 2
    The practitioner should obtain evidence from applying the agreed-upon procedures to provide a reasonable basis for the finding or findings expressed in the practitioner's report but need not perform additional procedures outside the scope of the engagement to gather additional evidence. AT-C Section 215.20
    {financial projection} When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include a description of the special purpose for which the projection was prepared, and AT-C Section 305.33 b.
    When designing and performing tests of controls, the service auditor should perform other procedures such as inspection, observation, or reperformance in combination with inquiry to obtain evidence about the following: How the control was applied AT-C Section 320.31 a.i.
    {financial forecast} In an examination of a forecast, in addition to the written representations from the responsible party required by section 205, the practitioner should request from the responsible party written representations that the assumptions on which the forecast is based are reasonable and suitably supported; and AT-C Section 305.28 b.
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Obtain sufficient evidence in support of such adjustments. AT-C Section 310.13 e.
    A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves performing procedures to obtain evidence about the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description based on the criteria in management's assertion. AT-C Section 320.40 i.i.]
    Audits and Risk Management Preventive
    Collect audit evidence sufficient to avoid misstatements. CC ID 07155
    [To obtain limited assurance, the practitioner should obtain sufficient appropriate review evidence in order to express a conclusion about whether any material modifications should be made to the subject matter in order for it to be in accordance with (or based on) the criteria, or the assertion, in order for it to be fairly stated. AT-C Section 210.15
    As required by section 205, the service auditor should identify the risks of material misstatement. AT-C Section 320.22
    The practitioner should identify and assess risks of material misstatement as the basis for designing and _secondary-verb">performing further procedures whose nature, timing, and extent AT-C Section 205.18
    {does not exist} {attestation engagement} The practitioner should not agree to a change in the terms of the engagement when no reasonable justification for doing so exists. If a change in the terms of the engagement is made, the practitioner should not disregard evidence that was obtained prior to the change. AT-C Section 105.29]
    Audits and Risk Management Preventive
    Collect audit evidence at the level of the organization's competence in the subject matter. CC ID 07156
    [When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test how the responsible party made the estimate and the data on which it is based. In doing so, the practitioner should evaluate whether the assumptions used by the responsible party are reasonable, and AT-C Section 205.30 b.ii.
    When the prospective financial information contains a range, the practitioner's report should also include a separate paragraph that states that the responsible party has elected to portray the expected results of one or more assumptions as a range. AT-C Section 305.34
    In order to accept an attestation engagement to examine or review pro forma financial information, in addition to the preconditions for an attestation engagement included in sections 105 and 205, the practitioner will be able to obtain an appropriate level of knowledge of the accounting and financial reporting practices of the entity (or in the case of a business combination, of each significant constituent part of the combined entity) that will enable the practitioner to perform the procedures necessary to report on the pro forma financial information. AT-C Section 310.08 c.]
    Audits and Risk Management Preventive
    Collect audit evidence sufficient to overcome inadequacies in the organization's attestation. CC ID 07157
    [To obtain reasonable assurance, the practitioner should obtain sufficient appropriate evidence to reduce attestation risk to an acceptably low level and thereby enable the practitioner to draw reasonable conclusions on which to base the practitioner's opinion. AT-C Section 205.19
    {is accurate} When using information produced by the entity, the practitioner should evaluate whether the information is sufficiently reliable for the practitioner's purposes, including, as necessary, the following: Evaluating whether the information is sufficiently precise and detailed for the practitioner's purposes AT-C Section 205.35 b.
    When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Determine whether events occurring up to the date of the practitioner's report provide evidence regarding the estimate. AT-C Section 205.30 a.
    When responding to an assessed risk of material misstatement related to an estimate, the practitioner should undertake one or more of the following, taking into account the nature of the estimates: Test how the responsible party made the estimate and the data on which it is based. In doing so, the practitioner should evaluate whether the data on which the estimate is based are sufficiently reliable for the practitioner's purposes. AT-C Section 205.30 b.iii.]
    Audits and Risk Management Preventive
    Conduct interviews of auditees, as necessary. CC ID 07188
    [The practitioner should obtain an understanding of the specified requirements. The practitioner's procedures to obtain that understanding should include the following: Discussion with appropriate individuals within the entity (for example, the chief financial officer, internal auditors, legal counsel, compliance officer, or grant or contract administrators) AT-C Section 315.13 c.]
    Testing Detective
    Explain the goals of the interview to the auditee. CC ID 07189 Behavior Detective
    Withdraw from the audit, when defined conditions exist. CC ID 13885
    [{not provided} {review engagement} {audit report} When the engaging party is not the responsible party if one or more of the requested representations are provided neither in writing nor orally from the responsible party in accordance with paragraph .51, a scope limitation exists, and the practitioner should determine the effect on the report, or the practitioner should withdraw from the engagement. AT-C Section 205.56 b.
    {examination engagement} If the engaging party is the responsible party and refuses to provide the practitioner with a written assertion as required by paragraph .10, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 205.82
    {are pervasive} {not pervasive} The practitioner should express a qualified conclusion when the effects of a matter are material but not pervasive. A qualified conclusion is expressed as being "except for the effects" of the matter to which the qualification relates. When the effects of a matter are material and also pervasive, the practitioner should withdraw from the engagement, when withdrawal is possible under applicable laws and regulations. AT-C Section 210.53
    {review engagement} If the practitioner believes that qualification of the conclusion in the standard practitioner's report is not adequate to indicate the misstatements in the subject matter, the practitioner should withdraw from the engagement. AT-C Section 210.55
    {review engagement} If the practitioner is unable to obtain sufficient appropriate review evidence, a scope limitation exists. When a scope limitation exists, the practitioner should withdraw from the engagement, when withdrawal is possible under applicable laws and regulations. AT-C Section 210.58
    {review engagement} If the engaging party is the responsible party and refuses to provide the practitioner with a written assertion as required by paragraph .11, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 210.59
    When circumstances impose restrictions on the performance of the agreed-upon procedures, the practitioner should attempt to obtain agreement from the specified parties for modification of the agreed-upon procedures. When such agreement cannot be obtained (for example, when the agreed-upon procedures are published by a regulatory agency that will not modify the procedures), the practitioner should describe any restrictions on the performance of procedures in the practitioner's report or withdraw from the engagement. AT-C Section 215.37
    {examination engagement} {financial forecast} {financial projection} A practitioner should not examine a forecast or projection that discloses none of the significant assumptions. If after accepting the engagement the practitioner determines that the forecast or projection discloses none of the significant assumptions, the practitioner should withdraw from the engagement, unless required by law or regulation to report on the financial forecast or projection, in which case, the practitioner should express an adverse opinion in the practitioner's report. AT-C Section 305.12
    {examination engagement} {financial projection} {hypothetical assumptions} If after accepting the engagement the practitioner determines that a projection fails to identify which of the assumptions are hypothetical or describe the limitations on the usefulness of the projection, the practitioner should withdraw from the engagement, unless required by law or regulation to report on the projection, in which case, the practitioner should express an adverse opinion in the practitioner's report. AT-C Section 305.14
    {examination engagement} The practitioner should request from the responsible party a written assertion. If the responsible party refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 305.18
    In an examination of prospective financial information, the practitioner should request from the responsible party the written representations required by section 205 and paragraphs .28 or .29 of this section, as applicable, even if the engaging party is not the responsible party. The alternative to obtaining the required written representations provided for in section 205 is not permitted in an engagement to examine prospectve financial information. The responsible party's refusal to furnish the written representations required by section 205 and paragraphs .28 or .29 of this section, as applicable, constitutes a limitation on the scope of the engagement sufficient to preclude an unmodified opinion and may be sufficient to cause the practitioner to withdraw from the examination engagement, when withdrawal is possible under applicable laws and regulations. AT-C Section 305.31
    {examination engagement} In performing an examination under this section, the practitioner should request from management a written assertion. If management refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 315.10
    {attestation engagement} The practitioner should request from management of the service organization a written assertion. If management refuses to provide a written assertion, the practitioner should withdraw from the engagement when withdrawal is possible under applicable law or regulation. AT-C Section 320.13
    In a type 1 or type 2 engagement, the practitioner should request from the responsible party (in this case, management of the service organization), the written representations required by section 205 and paragraph .36 of this section, even if the engaging party is not the responsible party. The alternative to obtaining the required written representations provided for in section 205 is not permitted in a type 1 or type 2 engagement. The refusal by management of the service organization (or by management of a subservice organization that is being presented using the inclusive method) to furnish the written representations required by section 205 and paragraph .36 of this section constitutes a limitation on the scope of the engagement sufficient to preclude an unmodified opinion and may be sufficient to cause the service auditor to withdraw from the examination engagement when withdrawal is possible under applicable law or regulation. AT-C Section 320.38]
    Process or Activity Corrective
    Establish and maintain work papers, as necessary. CC ID 13891 Establish/Maintain Documentation Preventive
    Include justification for departing from mandatory requirements in the work papers. CC ID 13935
    [If, in rare circumstances, the practitioner judges it necessary to depart from a relevant, presumptively mandatory requirement, the practitioner should document the justification for the departure and how the alternative procedures performed in the circumstances were sufficient to achieve the intent of that requirement. (See paragraph .20.) AT-C Section 105.41
    {attestation engagement} {audit terms} {does not exist} As required by section 105, if management requests a change in the scope of the engagement before the completion of the engagement, the service auditor should not agree to a change in the terms of the engagement when no reasonable justification for doing so exists. AT-C Section 320.12]
    Establish/Maintain Documentation Preventive
    Include the reviewer, and dates, for using evidential matter to test in scope controls in the work papers. CC ID 06998
    [The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who reviewed the engagement work performed and the date and extent of such review. AT-C Section 205.87 a.vi.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who reviewed the engagement work performed and the date and extent of such review. AT-C Section 205.87 a.vi.
    {person} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who reviewed the engagement work performed and the date and extent of such review. AT-C Section 215.43 b.v.
    {person} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who reviewed the engagement work performed and the date and extent of such review. AT-C Section 215.43 b.v.]
    Establish/Maintain Documentation Preventive
    Include the tests, examinations, interviews and observations performed during the audit in the work papers. CC ID 07190
    [The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including AT-C Section 205.87 a.
    If, in circumstances such as those described in paragraph .49, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the new or additional procedures performed, evidence obtained, and conclusions reached and their effect on the report; and AT-C Section 205.89 b.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the identifying characteristics of the specific items or matters tested; AT-C Section 205.87 a.i.
    If, in rare circumstances, the practitioner judges it necessary to depart from a relevant, presumptively mandatory requirement, the practitioner should document the justification for the departure and how the alternative procedures performed in the circumstances were sufficient to achieve the intent of that requirement. (See paragraph .20.) AT-C Section 105.41
    If, in circumstances such as those described in paragraph .32, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the new or additional procedures performed, evidence obtained, and conclusions reached and their effect on the report; and AT-C Section 210.64 b.
    If, in circumstances such as those described in paragraph .32, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the new or additional procedures performed, evidence obtained, and conclusions reached and their effect on the report; and AT-C Section 210.64 b.
    If, in circumstances such as those described in paragraph .32, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the new or additional procedures performed, evidence obtained, and conclusions reached and their effect on the report; and AT-C Section 210.64 b.
    If, in circumstances such as those described in paragraph .32, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the new or additional procedures performed, evidence obtained, and conclusions reached and their effect on the report; and AT-C Section 210.64 b.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the identifying characteristics of the specific items or matters tested; AT-C Section 215.43 b.i.
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes an identification of the controls that were tested. AT-C Section 320.40 k.i.
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes the nature of the tests in sufficient detail to enable user auditors to determine the effect of such tests on their risk assessments. AT-C Section 320.40 k.iii.
    For engagements involving compliance with regulatory requirements, the practitioner's procedures should include reviewing reports of relevant examinations and related communications between regulatory agencies and the entity and, when appropriate, making inquiries of the regulatory agencies, including inquiries about examinations in progress. AT-C Section 315.16]
    Establish/Maintain Documentation Preventive
    Include if any subject matter experts or additional research had to be undertaken to test in scope controls in the work papers. CC ID 07026
    [If the practitioner believes the subject matter may be materially misstated, the practitioner should perform additional procedures sufficient to obtain limited assurance about whether any material modifications should be made to the subject matter in order for it to be in accordance with (or based on) the criteria or the assertion in order for it to be fairly stated. AT-C Section 210.26]
    Establish/Maintain Documentation Preventive
    Include the tester, and dates, for using evidential matter to test in scope controls in the work papers. CC ID 06997
    [The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who performed the engagement work and the date such work was completed; AT-C Section 205.87 a.ii.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who performed the engagement work and the date such work was completed; AT-C Section 205.87 a.ii.
    {person} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who reviewed the engagement work performed and the date and extent of such review. AT-C Section 210.62 a.vi.
    {person} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who reviewed the engagement work performed and the date and extent of such review. AT-C Section 210.62 a.vi.
    {auditor's name} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, ="term_primary-verb">including</span> who an style="background-color:#B7D8ED;" class="term_primary-verb">performed the engagement work and the date such work was completed; AT-C Section 215.43 b.ii.
    {auditor's name} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who performed the engagement work and the style="background-color:#F0BBBC;" class="term_primary-noun">date such work was completed; AT-C Section 215.43 b.ii.
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes if the work of the internal audit function has been used in tests of controls to obtain evidence, a description of the internal auditor's work and of the service auditor's procedures with respect to that work. AT-C Section 320.40 k.v.
    {personnel} When designing and performing tests of controls, the service auditor should perform other procedures such as inspection, observation, or reperformance in combination with inquiry to obtain evidence about the following: By whom or by what means the control was applied AT-C Section 320.31 a.iii.]
    Establish/Maintain Documentation Preventive
    Include if the audit evidence has identified in scope control deficiencies in the work papers. CC ID 07152 Audits and Risk Management Detective
    Include the causes of identified in scope control deficiencies in the work papers. CC ID 07000 Establish/Maintain Documentation Preventive
    Include discussions regarding the causes of identified in scope control deficiencies in the work papers. CC ID 06999
    [{examination engagement} For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement partner should take responsibility for discussing with the engagement quality control reviewer significant findings or issues arising during the engagement, including those identified during the engagement quality control review, and not release the practitioner's report until completion of the engagement quality control review and AT-C Section 105.42 a.
    For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement quality control reviewer should perform an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. This evaluation should include the following: Discussion of significant findings or issues with the engagement partner AT-C Section 105.42 b.i.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 205.87 a.iii.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 205.87 a.iii.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 205.87 a.iii.
    {participants} {date} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 210.62 a.iii.]
    Establish/Maintain Documentation Preventive
    Investigate the nature and causes of identified in scope control deviations. CC ID 06986
    [If analytical procedures identify fluctuations or relationships that are inconsistent with other relevant information or that differ significantly from expected amounts or ratios, the practitioner should inquire of the responsible party about such differences and AT-C Section 210.20 a.
    The service auditor should investigate the nature and cause of any deviations identified and should determine whether AT-C Section 320.32
    A service auditor's type 2 report should include the following: A description of the inherent limitations of controls, including that projecting to the future any evaluation of the fairness of the presentation of management's description of the service organization's system or conclusions about the suitability of the design or operating effectiveness of the controls to achieve the related control objectives is subject to the risk that controls at a service organization may become ineffective. AT-C Section 320.40 j.]
    Testing Detective
    Include if in scope control deviations allow in scope controls to be performed acceptably in the work papers. CC ID 06987
    [The service auditor should investigate the nature and cause of any deviations identified and should determine whether identified deviations are within the expected rate of deviation and are acceptable. If so, the testing that has been performed provides an appropriate basis for concluding that the control operated effectively throughout the specified period. AT-C Section 320.32 a.
    {examination engagement} the practitioner should determine what modifications or additions to procedures are necessary to resolve the matter and should consider the effect of the matter, if any, on other aspects of the engagement. AT-C Section 205.23 ¶ 2]
    Testing Detective
    Supervise interested personnel and affected parties participating in the audit. CC ID 07150
    [When using internal auditors to provide direct assistance to the practitioner, the practitioner should direct, supervise, and review the work of the internal auditors. AT-C Section 205.42
    The engagement partner should be satisfied that to an extent that is sufficient to accept responsibility for the opinion, conclusion, or findings on the subject matter or assertion, the engagement team will be able to be involved in the work of a practitioner's external specialist when the work of that specialist is to be used and AT-C Section 105.32 b.i.
    The engagement partner should be satisfied that to an extent that is sufficient to accept responsibility for the opinion, conclusion, or findings on the subject matter or assertion, the engagement team will be able to be involved in the work of an other practitioner, when the work of that practitioner is to be used. AT-C Section 105.32 b.ii.]
    Monitor and Evaluate Occurrences Preventive
    Notify interested personnel and affected parties participating in the audit of their roles and responsibilities during the audit. CC ID 07151
    [{attestation engagement} The engagement partner should be satisfied that those involved in the engagement have been informed of their responsibilities, including the objectives of the procedures they are to perform and matters that may affect the nature, timing, and extent of such procedures. AT-C Section 105.32 c.
    Prior to using internal auditors to provide direct assistance, the practitioner should obtain written acknowledgment from the responsible party that internal auditors providing direct assistance to the practitioner will be allowed to follow the practitioner's instructions, and that the responsible party will not intervene in the work the internal auditor performs for the practitioner. AT-C Section 205.41]
    Establish Roles Preventive
    Respond to questions or clarification requests regarding the audit. CC ID 08902
    [The engagement partner should be satisfied that engagement team members have been directed to bring to the engagement partner's attention significant questions raised during the engagement so that their significance may be assessed. AT-C Section 105.32 d.
    The practitioner should inquire of the responsible party about the following: Questions that have arisen in the course of applying the review procedures AT-C Section 210.21 c.
    The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: Appropriate consultation being undertaken by the engagement team on difficult or contentious matters AT-C Section 105.33 e.
    {written representations} When the engaging party is not the responsible party if one or more of the requested representations in paragraph .28 are not provided in writing by the responsible party, the practitioner should make inquiries of the responsible party about, and seek oral responses to, the matters in paragraph .28. AT-C Section 215.32 a.]
    Business Processes Preventive
    Track and measure the implementation of the organizational compliance framework. CC ID 06445
    [In an engagement to examine compliance with specified requirements, the practitioner should seek to obtain reasonable assurance that the entity complied with the specified requirements, in all material respects, including designing the examination to detect both intentional and unintentional material noncompliace. AT-C Section 315.11]
    Monitor and Evaluate Occurrences Preventive
    Review the need for organizational efficiency as balanced against the needs of compliance and security. CC ID 07111 Business Processes Preventive
    Establish and maintain a Statement on the Level of Compliance. CC ID 12499
    [The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. The practitioner's opinion about whether, in all material respects the entity complied with the specified requirements or AT-C Section 315.20 j.(1)]
    Establish/Maintain Documentation Preventive
    Review the Statement on the Level of Compliance. CC ID 12500
    [{examination engagement} The practitioner should obtain an understanding of relevant portions of internal control over compliance sufficient to plan the engagement and to assess control risk for compliance with specified requirements. In planning the examination, such knowledge should be used to identify types of potential noncompliance, to consider factors that affect the risk of material noncompliance, and to design appropriate tests of compliance. AT-C Section 315.15]
    Business Processes Detective
    Approve the Statement on the Level of Compliance. CC ID 12501 Business Processes Preventive
    Include a Statement on the Level of Compliance in the tactical Information Technology plan. CC ID 06842 Actionable Reports or Measurements Preventive
    Engage subject matter experts when the auditor requires additional expertise during an attestation engagement, as necessary. CC ID 13971
    [The practitioner and the specified parties should explicitly agree to the involvement of a oun">practitioner's external specialist if assisting a practitioner in the performance of an agreed-upon procedures engagement. AT-C Section 215.21
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Obtain a sufficient class="term_primary-noun">understandingpan> of the field of expertise of a practitioner's specialist to enable the practitioner to AT-C Section 205.36 b.]
    Process or Activity Preventive
    Provide auditors access to all in scope records, in scope assets, personnel and in scope procedures. CC ID 06966
    [In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The practitioner expects to be able to obtain the evidence needed to arrive at the practitioner's opinion, conclusion, or findings, including access to all information of which the responsible party is aware that is relevant to the measurement, evaluation, or disclosure of the subject matter; AT-C Section 105.25 b.iii(1)
    {is necessary} In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The practitioner expects to be able to obtain the evidence needed to arrive at the practitioner's opinion, conclusion, or findings, including unrestricted access to persons within the appropriate party(ies) from whom the practitioner determines it necessary to obtain evidence. AT-C Section 105.25 b.iii(3)
    In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The practitioner expects to be able to obtain the evidence needed to arrive at the practitioner's opinion, conclusion, or findings, including access to additional information that the practitioner may request from the responsible party for the purpose of the engagement; and AT-C Section 105.25 b.iii(2)]
    Audits and Risk Management Preventive
    Provide auditors access to affected parties during the audit, as necessary. CC ID 07187 Business Processes Preventive
    Solve any access problems auditors encounter during the audit. CC ID 08959 Audits and Risk Management Corrective
    Notify interested personnel and affected parties when an auditee refuses to provide access or participate in the audit. CC ID 08960
    [When the engaging party is not the responsible party and the responsible party refuses to provide the practitioner with a written assertion, the practitioner may report on the subject matter but should disclose in the practitioner's report the responsible party's refusal to provide a written assertion and should restrict the use of the practitioner's report to the engaging party. AT-C Section 210.60]
    Audits and Risk Management Preventive
    Establish and maintain a practitioner's examination report on pro forma financial information. CC ID 13968 Establish/Maintain Documentation Preventive
    Include references to where financial information was derived in the practitioner's review report on pro forma financial information. CC ID 13982
    [The practitioner's review report on pro forma financial information should include the following: A reference to the financial statements from which the historical financial information is derived and AT-C Section 310.18 g.]
    Establish/Maintain Documentation Preventive
    Include a statement that the financial statements used were audited by other practitioners in the practitioner's examination report on pro forma financial information, as necessary. CC ID 13981
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A reference to the financial statements from which the historical financial information is derived, a statement that such financial statements were audited, and, if applicable, whether the financial statements were audited by another auditor. (The report on pro forma financial information should refer to any modification in the auditor's report on the historical financial statements. In the case of a business combination, this paragraph applies to each significant constituent part of the combined entity.) AT-C Section 310.17 g.]
    Establish/Maintain Documentation Preventive
    Establish and maintain organizational audit reports. CC ID 06731
    [The practitioner's report should be in writing. AT-C Section 205.61
    {audit report} {attestation engagement} If the practitioner concludes, based on the practitioner's professional judgment, that there is reasonable justification to change the terms of the engagement from the original level of service that the practitioner was engaged to perform to a lower level of service, for example, from an examination to a review, and if the practitioner complies with the AT-C sections applicable to the lower level of service, the practitioner should issue an appropriate practitioner's report on the lower level of service. The report should not include reference to (a) the original engagement, (b) any procedures that may have been performed, or (c) scope limitations that resulted in the changed engagement. AT-C Section 105.30
    The practitioner should prepare engagement documentation on a timely basis. AT-C Section 105.34
    {examination engagement} For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement partner should take responsibility for discussing with the engagement quality control reviewer significant findings or issues arising during the engagement, including those identified during the engagement quality control review, and not release the practitioner's report until completion of the engagement quality control review and AT-C Section 105.42 a.
    The practitioner's report should be in writing. AT-C Section 210.44
    The practitioner's conclusion on the subject matter or assertion should be clearly separated from any paragraphs emphasizing matters related to the subject matter or any other reporting responsibilities. AT-C Section 210.56
    The practitioner should report all findings from application of the agreed-upon procedures. Any agreed-upon materiality limits should be described in the practitioner's report. AT-C Section 215.26
    The practitioner's report should be in writing. AT-C Section 215.33]
    Establish/Maintain Documentation Preventive
    Write the audit report using clear and conspicuous language. CC ID 13948
    [{use} {clear and conspicuous language} The practitioner should avoid vague or ambiguous language in reporting findings. AT-C Section 215.27]
    Establish/Maintain Documentation Preventive
    Include a statement that the sufficiency of the agreed upon procedures is the responsibility of the specified parties in the audit report. CC ID 13936
    [The practitioner's agreed-upon procedures report should include the following: A statement that the sufficiency of the procedures is solely the responsibility of the parties specified in the report. AT-C Section 215.35 g.i.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the practitioner makes no representation regarding the sufficiency of the procedures either for the purpose for which the report has been requested or for any other purpose. AT-C Section 305.39 g.ii.
    {refrain from making} The practitioner's agreed-upon procedures report should include the following: A statement that the practitioner makes no representation regarding the sufficiency of the procedures either for the purpose for which the report has been requested or for any other purpose. AT-C Section 215.35 g.ii.
    The practitioner's agreed-upon procedures report on compliance should include the following: A statement that the sufficiency of the procedures is solely the responsibility of the parties specified in the report. AT-C Section 315.26 g.i.
    The practitioner's agreed-upon procedures report on compliance should include the following: A statement that the practitioner makes no representation regarding the sufficiency of the procedures either for the purpose for which the report has been requested or for any other purpose. AT-C Section 315.26 g.ii.]
    Establish/Maintain Documentation Preventive
    Include a statement that the financial statements were audited in the audit report. CC ID 13963
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A reference to the financial statements from which the historical financial information is derived, a statement that such financial statements were audited, and, if applicable, whether the financial statements were audited by another auditor. (The report on pro forma financial information should refer to any modification in the auditor's report on the historical financial statements. In the case of a business combination, this paragraph applies to each significant constituent part of the combined entity.) AT-C Section 310.17 g.]
    Establish/Maintain Documentation Preventive
    Include the criteria that financial information was measured against in the audit report. CC ID 13966
    [The practitioner's review report on pro forma financial information should include the following: An identification of the criteria against which the pro forma financial information was measured or evaluated. AT-C Section 310.18 f.]
    Establish/Maintain Documentation Preventive
    Include a description of the financial information being reported on in the audit report. CC ID 13965
    [The practitioner's review report on pro forma financial information should include the following: An identification or description of the pro forma financial information being reported on, including the point in time or period of time to which the measurement or evaluation of the pro forma financial information relates. AT-C Section 310.18 e.
    The practitioner's review report on pro forma financial information should include the following: A reference to management's description of the transaction (or event) to which the pro forma adjustments give effect. (The description is included in the pro forma financial information.) AT-C Section 310.18 d.]
    Establish/Maintain Documentation Preventive
    Include references to any adjustments of financial information in the audit report. CC ID 13964
    [The practitioner's review report on pro forma financial information should include the following: A reference to the pro forma adjustments included in the pro forma financial information. AT-C Section 310.18 c.]
    Establish/Maintain Documentation Preventive
    Include in the audit report that audit opinions are not dependent on references to subject matter experts, as necessary. CC ID 13953
    [When the conclusion is qualified, reference to an external specialist is permitted when such reference is relevant to an understanding of the qualification to the practitioner's conclusion. The practitioner should indicate in the practitioner's report that such reference does not reduce the practitioner's responsibility for that conclusion. AT-C Section 210.57]
    Establish/Maintain Documentation Preventive
    Include references to historical financial information used in the audit report. CC ID 13961
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A reference to the financial statements from which the historical financial information is derived, a statement that such financial statements were audited, and, if applicable, whether the financial statements were audited by another auditor. (The report on pro forma financial information should refer to any modification in the auditor's report on the historical financial statements. In the case of a business combination, this paragraph applies to each significant constituent part of the combined entity.) AT-C Section 310.17 g.]
    Establish/Maintain Documentation Preventive
    Include a description of the limitations on the usefulness of hypothetical assumptions in the audit report. CC ID 13958
    [{audit report} Because partial presentations are generally appropriate only for limited use, practitioners' reports on partial presentations of both forecasted and projected financial information should include a description of any limitations on the usefulness of the presentation. AT-C Section 305.37
    {examination engagement} {be useful} Unless required by law or regulation to do so, a practitioner should not accept an engagement to examine a partial presentation that does not describe the limitations on the usefulness of the presentation. AT-C Section 305.11 c.]
    Establish/Maintain Documentation Preventive
    Include the word independent in the title of audit reports. CC ID 07003
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A title that includes the word independent. AT-C Section 205.63 a.
    The practitioner's report should include the following: A title that includes the word independent. AT-C Section 210.46 a.
    The practitioner's agreed-upon procedures report should include the following: A title that includes the word independent. AT-C Section 215.35 a.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A title that includes the word independent. AT-C Section 305.32 a.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A title that includes the word independent. AT-C Section 305.39 a.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A title that includes the word independent. AT-C Section 310.17 a.
    The practitioner's review report on pro forma financial information should include the following: A title that includes the word independent. AT-C Section 310.18 a.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A title that includes the word independent. AT-C Section 315.20 a.
    The practitioner's agreed-upon procedures report on compliance should include the following: A title that includes the word independent. AT-C Section 315.26 a.
    A service auditor's type 2 report should include the following: A title that includes the word independent. AT-C Section 320.40 a.
    A service auditor's type 1 report should include the following: A title that includes the word independent. AT-C Section 320.41 a.]
    Actionable Reports or Measurements Preventive
    Include the date of the audit in the audit report. CC ID 07024
    [The date of the written representations should be as of the date of the practitioner's report. The written representations should address the subject matter and periods covered by the practitioner's opinion. AT-C Section 205.54
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: The date of the report. (The report should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate evidence on which to base the practitioner's opinion, including evidence that AT-C Section 205.63 l.
    The practitioner's report should include the following: The date of the report. (The report should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate review evidence on which to base the practitioner's conclusion, including evidence that AT-C Section 210.46 k.
    {auditor} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who performed the engagement work and the date such work was completed; AT-C Section 210.62 a.ii.
    The practitioner's agreed-upon procedures report should include the following: The date of the report. (The report should be dated no earlier than the date on which the practitioner completed the procedures and determined the findings, including that AT-C Section 215.35 q.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: The date of the report. (The report should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate evidence on which to base the practitioner's opinion, including evidence that AT-C Section 305.32 m.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. The date of the report. (The report should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate evidence on which to base the practitioner's opinion, including evidence that AT-C Section 315.20 n.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: The date of the report. (The report should be dated no earlier than the date on which the practitioner completed the procedures and determined the findings, including that AT-C Section 305.39 s.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: The date of the report. (The report should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate evidence on which to base the practitioner's opinion, including evidence that AT-C Section 310.17 p.
    The practitioner's review report on pro forma financial information should include the following: The date of the report. (The report should be dated no earlier than the date on which the practitioner has obtained sufficient appropriate review evidence on which to base the practitioner's conclusion, including evidence that AT-C Section 310.18 p.
    The practitioner's agreed-upon procedures report on compliance should include the following: The date of the report. (The report should be dated no earlier than the date on which the practitioner completed the procedures and determined the findings, including that AT-C Section 315.26 q.
    The date of the written representations should be as of the date of the practitioner's report. The written representations should address the subject matter and periods covered by the practitioner's findings. AT-C Section 215.30
    A service auditor's type 2 report should include the following: The date of the report. (The report should be dated no earlier than the date on which the service auditor has obtained sufficient appropriate evidence on which to base the service auditor's opinion, including evidence that AT-C Section 320.40 p.
    A service auditor's type 1 report should include the following: The date of the report. (The report should be dated no earlier than the date on which the service auditor has obtained sufficient appropriate evidence on which to base the service auditor's opinion, including evidence that AT-C Section 320.41 p.]
    Actionable Reports or Measurements Preventive
    Structure the audit report to be in the form of procedures and findings. CC ID 13940
    [The practitioner's report should be in the form of procedures and findings. AT-C Section 215.34]
    Establish/Maintain Documentation Preventive
    Include information about the organization being audited and the auditor performing the audit in the audit report. CC ID 07004
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 205.63 b.
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: The city and state where the practitioner practices. AT-C Section 205.63 k.
    The practitioner's agreed-upon procedures report should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 215.35 b.
    When the practitioner expects to use the work of an other practitioner, the practitioner should determine whether to make reference to te other practitioner in the practitioner's report. AT-C Section 105.31 f.
    {review engagement} The practitioner's report should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 210.46 b.
    The practitioner's report should include the following: The city and state where the practitioner practices. AT-C Section 210.46 j.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: The city and state where the practitioner practices. AT-C Section 310.17 o.
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the identifying characteristics of the specific items or matters tested; AT-C Section 210.62 a.i.
    {auditor} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including who performed the engagement work and the date such work was completed; AT-C Section 210.62 a.ii.
    The practitioner's agreed-upon procedures report should include the following: An identification of the specified parties. AT-C Section 215.35 d.
    The practitioner's agreed-upon procedures report should include the following: The city and state where the practitioner practices. AT-C Section 215.35 p.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 305.32 b.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: The city and state where the practitioner practices. AT-C Section 305.32 l.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 305.39 b.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An identification of the specified parties. AT-C Section 305.39 d.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: The city and state where the practitioner practices. AT-C Section 305.39 r.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 310.17 b.
    The practitioner's review report on pro forma financial information should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 310.18 b.
    The practitioner's review report on pro forma financial information should include the following: The city and state where the practitioner practices. AT-C Section 310.18 o.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. An appropriate addressee as required by the circumstances of the engagement. AT-C Section 315.20 b.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. The city and state where the practitioner practices. AT-C Section 315.20 m.
    The practitioner's agreed-upon procedures report on compliance should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 315.26 b.
    The practitioner's agreed-upon procedures report on compliance should include the following: The city and state where the practitioner practices. AT-C Section 315.26 p.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Specifying the control objectives, stating them in the description of the service organization's system, and, if the control objectives are specified by law, regulation, or another party (for example, a user group or a professional body), identifying in the description the party specifying the control objectives AT-C Section 320.10 b.iv.
    A service auditor's type 2 report should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 320.40 b.
    A service auditor's type 1 report should include the following: An appropriate addressee as required by the circumstances of the engagement. AT-C Section 320.41 b.
    A service auditor's type 2 report should include the following: The city and state where the service auditor practices. AT-C Section 320.40 o.
    A service auditor's type 1 report should include the following: The city and state where the service auditor practices. AT-C Section 320.41 o.]
    Actionable Reports or Measurements Preventive
    Include any discussions of significant findings in the audit report, as necessary. CC ID 13955
    [{participants} {date} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 210.62 a.iii.]
    Establish/Maintain Documentation Preventive
    Include the date and with whom discussions about significant findings took place in the audit report. CC ID 13962
    [{participants} {date} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 210.62 a.iii.]
    Establish/Maintain Documentation Preventive
    Include the audit criteria in the audit report. CC ID 13945
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: An identification of the criteria against which the pro forma financial information was measured or evaluated. AT-C Section 310.17 f.]
    Establish/Maintain Documentation Preventive
    Include a statement in the audit report that the agreed upon procedures were potentially insufficient in identifying material risks, as necessary. CC ID 13957
    [The practitioner's agreed-upon procedures report should include the following: A statement that had the practitioner performed additional procedures, other matters might have come to the practitioner's attention that would have been reported. AT-C Section 215.35 j.iv.]
    Establish/Maintain Documentation Preventive
    Identify all hypothetical assumptions in the audit report. CC ID 13947
    [When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include an identification of the hypothetical assumptions, AT-C Section 305.33 a.]
    Establish/Maintain Documentation Preventive
    Include a statement that access to the report is restricted based on least privilege in the audit report. CC ID 07023
    [The alert should state that the practitioner's report is intended solely for the information and use of the specified parties, AT-C Section 205.65 a.
    When the engaging party is not the responsible party and the responsible party refuses to provide the practitioner with a written assertion, the practitioner may report on the subject matter but should disclose in the practitioner's report the responsible party's refusal to provide a written assertion and should restrict the use of the practitioner's report to the engaging party. AT-C Section 205.84
    {written representations} When the engaging party is not the responsible party if one or more of the requested representations are not provided in writing by the responsible party, but the practitioner receives satisfactory oral responses to the practitioner's inquiries performed in accordance with paragraph .51 sufficient to enable the practitioner to conclude that the practitioner has sufficient appropriate evidence to form an opinion about the subject matter, the practitioner's report should contain a separate paragraph that restricts the use of the report to the engaging party. (Paragraphs .65–.66 contain requirements for the contents of such a paragraph.) AT-C Section 205.56 a.
    In the following circumstances, the practitioner's report should include an alert, in a separate paragraph, that restricts the use of the report: The engaging party is not the responsible party, and the responsible party does not provide the written representations required by paragraph .33, but does provide oral responses to the practitioner's inquiries about the matters in paragraph .33, as provided for in paragraphs .34 and .39a. In this case, use of the report should be restricted to the engaging party. AT-C Section 210.47 c.
    {practitioner's report} {not be used} The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 210.48 c.
    When the engaging party is not the responsible party and the responsible party refuses to provide the practitioner with a written assertion, the practitioner may report on the subject matter but should disclose in the practitioner's report the responsible party's refusal to provide a written assertion and should restrict the use of the practitioner's report to the engaging party. AT-C Section 210.60
    The practitioner's agreed-upon procedures report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should AT-C Section 215.35 m.
    When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include an alert, in a separate paragraph, that restricts the use of the report. The alert should AT-C Section 305.33 c.
    In order to establish that the preconditions for an agreed-upon procedures engagement are present, the practitioner should determine that the following conditions, in addition to the preconditions identified in section 105, are present: Use of the practitioner's report is to be restricted to the specified parties. AT-C Section 215.10 f.
    The practitioner's agreed-upon procedures report on compliance should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is intended solely for the information and use of the specified parties, AT-C Section 315.26 m.i.
    {refrain from using} The practitioner's agreed-upon procedures report on compliance should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 315.26 m.iii.
    A service auditor's type 2 report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report, including the description of tests of controls and results thereof, is intended solely for the information and use of management of the service organization, user entities of the service organization's system during some or all of the period covered by the report, and the auditors who audit and report on such user entities' financial statements or internal control over financial reporting. AT-C Section 320.40 m.i.
    A service auditor's type 1 report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is intended solely for the information and use of management of the service organization, user entities of the service organization's system as of the specified date, and the auditors who audit and report on such user entities' financial statements or internal control over financial reporting. AT-C Section 320.41 m.i.]
    Actionable Reports or Measurements Preventive
    Include a statement that identifies the distribution list for the report in the audit report. CC ID 07172
    [The alert should identify the specified parties for whom use is intended, and AT-C Section 205.65 b.
    {audit report} {refrain from using} The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 205.65 c.
    The alert should identify the specified parties for whom use is intended, and AT-C Section 210.48 b.
    The agreed-upon terms of the engagement should include the following: Identification of specified parties AT-C Section 215.14 c.
    {refrain from using} When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include an alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 305.33 c.iii.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should identify the specified parties for whom use is intended, and AT-C Section 305.39 o.ii.
    The practitioner's agreed-upon procedures report on compliance should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should identify the specified parties for whom use is intended, and AT-C Section 315.26 m.ii.
    {refrain from using} A service auditor's type 2 report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 320.40 m.ii.
    {refrain from using} A service auditor's type 1 report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 320.41 m.ii.]
    Establish/Maintain Documentation Preventive
    Include a statement that identifies the use restrictions for the report in the audit report. CC ID 07173
    [In the following circumstances, the practitioner's report should include an alert, in a separate paragraph, that restricts the use of the report: The practitioner determines that the criteria used to evaluate the subject matter are appropriate only for a limited number of parties who either participated in their establishment or can be presumed to have an adequate understanding of the criteria. AT-C Section 205.64 a.
    In the following circumstances, the practitioner's report should include an alert, in a separate paragraph, that restricts the use of the report: The criteria used to evaluate the subject matter are available only to specified parties. AT-C Section 205.64 b.
    In the following circumstances, the practitioner's report should include an alert, in a separate paragraph, that restricts the use of the report: The engaging party is not the responsible party, and the responsible party does not provide the written representations required by paragraph .50, but does provide oral responses to the practitioner's inquiries about the matters in paragraph .50, as provided for in paragraph .51 and .56a. In this case, the use of the practitioner's report should be restricted to the engaging party. AT-C Section 205.64 c.
    When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the practitioner's report should include the following information, rather than the information required by paragraph .65: A statement that the report is not suitable for any other purpose AT-C Section 205.66 b.
    The alert should state that the practitioner's report is intended solely for the information and use of the specified parties, AT-C Section 210.48 a.
    {written representations} When the engaging party is not the responsible party if one or more of the requested representations are provided in writing by the responsible party, but the practitioner receives satisfactory oral responses to the practitioner's inquiries performed in accordance with paragraph .34 sufficient to enable the practitioner to conclude that the practitioner has sufficient appropriate review evidence to form a conclusion about the subject matter, the practitioner's report should contain a separate paragraph that restricts the use of the practitioner's report to the engaging party. (Paragraphs .48–.49 contain requirements for the contents of such a paragraph.) AT-C Section 210.39 a.
    In the following circumstances, the practitioner's report should include an alert, in a separate paragraph, that restricts the use of the report: The practitioner determines that the criteria used to evaluate the subject matter are appropriate only for a limited number of parties who either participated in their establishment or can be presumed to have an adequate understanding of the criteria. AT-C Section 210.47 a.
    {review engagement} When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the practitioner's report should include the following information, rather than the information required by paragraph .48: A description of the purpose of the report AT-C Section 210.49 a.
    {review engagement} When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the practitioner's report should include the following information, rather than the information required by paragraph .48: A statement that the report is not suitable for any other purpose AT-C Section 210.49 b.
    The agreed-upon terms of the engagement should include the following: Use restrictions AT-C Section 215.14 i.
    The practitioner's agreed-upon procedures report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the practitioner's report is intended solely for the information and use of the specified parties, AT-C Section 215.35 m.i.
    The practitioner's agreed-upon procedures report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should identify the specified parties for whom use is intended, and AT-C Section 215.35 m.ii.
    The practitioner's agreed-upon procedures report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 215.35 m.iii.
    The practitioner's agreed-upon procedures report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 215.35 m.iii.
    The practitioner's agreed-upon procedures report should include the following: When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .35m: A statement that the report is not suitable for any other purpose. AT-C Section 215.35 n.ii.
    When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include an alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is intended solely for the information and use of the specified parties, AT-C Section 305.33 c.i.
    When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .33c: a statement that the report is not suitable for any other purpose. AT-C Section 305.33 d.ii.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should AT-C Section 305.39 o.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is intended solely for the information and use of the specified parties, AT-C Section 305.39 o.i.
    {refrain from using} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should state that the report is not intended to be, and should not be, used by anyone other than the specified parties. AT-C Section 305.39 o.iii.
    {agreed-upon procedures engagement} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .39o. A statement indicating that the report is not suitable for any other purpose AT-C Section 305.39 p.ii.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: When the circumstances identified in section 205 are applicable, an alert, in a separate paragraph, that restricts the use of the report or describes the purpose of the report, as applicable. AT-C Section 310.17 m.
    The practitioner's review report on pro forma financial information should include the following: When the circumstances identified in section 210 are applicable, an alert, in a separate paragraph, that restricts the use of the report or describes the purpose of the report, as applicable. AT-C Section 310.18 m.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. When the circumstances identified in section 205 are applicable, an alert in a separate paragraph that restricts the use of the report or describes the purpose of the report, as applicable. AT-C Section 315.20 k.
    The practitioner's agreed-upon procedures report on compliance should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should AT-C Section 315.26 m.
    The practitioner's agreed-upon procedures report on compliance should include the following: When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .26m: A statement indicating that the report is not suitable for any other purpose AT-C Section 315.26 n.ii.
    When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include an alert, in a separate paragraph, that restricts the use of the report. The alert should identify the specified parties for whom use is intended, and AT-C Section 305.33 c.ii.
    A service auditor's type 2 report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should AT-C Section 320.40 m.
    A service auditor's type 1 report should include the following: An alert, in a separate paragraph, that restricts the use of the report. The alert should AT-C Section 320.41 m.]
    Establish/Maintain Documentation Preventive
    Include a statement that the agreed upon procedures involves collecting evidence in the audit report. CC ID 13956
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that an examination involves performing procedures to obtain evidence about the pro forma amounts. AT-C Section 310.17 j.iii.(3)]
    Establish/Maintain Documentation Preventive
    Include all of the facts and demonstrated plausibility in the audit report. CC ID 08929
    [{examination engagement} {financial forecast} {financial projection} If after accepting the engagement, the practitioner determines that the forecast or projection fails to disclose one or more of the significant assumptions, the practitioner should describe the assumption(s) in the practitioner's report and express an adverse opinion. AT-C Section 305.13]
    Establish/Maintain Documentation Preventive
    Include a statement that the agreed upon procedures were performed by all parties in the audit report. CC ID 13931
    [The practitioner's agreed-upon procedures report should include the following: A statement that the procedures performed were those agreed to by the specified parties identified in the report. AT-C Section 215.35 e.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the procedures performed were those agreed to by the specified parties identified in the report. AT-C Section 305.39 e.]
    Establish/Maintain Documentation Preventive
    Include references to Subject Matter Expert in the audit report when citing qualified opinions. CC ID 13929
    [When the conclusion is qualified, reference to an external specialist is permitted when such reference is relevant to an understanding of the qualification to the practitioner's conclusion. The practitioner should indicate in the practitioner's report that such reference does not reduce the practitioner's responsibility for that conclusion. AT-C Section 210.57
    When the opinion is modified, reference to an external specialist is permitted when such reference is relevant to an understanding of the modification to the practitioner's opinion. The practitioner should indicate in the practitioner's report that such reference does not reduce the practitioner's responsibility for that opinion. AT-C Section 205.81]
    Establish/Maintain Documentation Preventive
    Include a description of the assistance provided by Subject Matter Experts in the audit report. CC ID 13939
    [The practitioner's report should describe the nature of the assistance provided by the practitioner's external specialist. AT-C Section 215.22
    The practitioner's agreed-upon procedures report on compliance should include the following: When applicable, a description of the nature of the assistance provided by a practitioner's external specialist. AT-C Section 315.26 k.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: When applicable, a description of the nature of the assistance provided by a practitioner's external specialist. AT-C Section 305.39 k.]
    Establish/Maintain Documentation Preventive
    Include a review of the subject matter expert's findings in the audit report, as necessary. CC ID 13972
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Evaluate the adequacy of the work of the practitioner's specialist for the practitioner's purposes, including the relevance and n style="background-color:#F0BBBC;" class="term_primary-noun">reasonableness of style="background-color:#CBD0E5;" class="term_secondary-verb">the n style="background-color:#F0BBBC;" class="term_primary-noun">findings and conclusions of the practitioner's specialist and their consistency with other evidence; AT-C Section 205.36 d.i.
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Evaluate the "term_primary-noun">adequacy of the work of the practitioner's specialist for the practitioner's purposes, including AT-C Section 205.36 d.
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Evaluate the adequacy of the work of the practitioner's specialist for the practitioner's purposes, including if the work of the practitioner's specialist m_primary-verb">involves the termstyle="background-color:#CBD0E5;" class="term_secondary-verb">_primary-verb">use of significant assumptions and methods AT-C Section 205.36 d.ii.
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Obtain a sufficient understanding of the field of expertise of a practitioner's specialist to enable the practitioner to ="background-color:#B7D8ED;" class="term_primary-verb">evaluate the adequacy of that work for the practitioner's purposes. AT-C Section 205.36 b.ii.]
    Establish/Maintain Documentation Preventive
    Include a statement of the character of the engagement in the audit report. CC ID 07166
    [When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should reevaluate the integrity of those from whom the representations were requested or received and evaluate the effect that this may have on the reliability of representations and review evidence in general, and AT-C Section 210.38 b.]
    Establish/Maintain Documentation Preventive
    Include the nature and scope of the audit performed in the statement of the character of the engagement in the audit report. CC ID 07167
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A description of the nature of an examination engagement. AT-C Section 205.63 g.
    {be less than} {review engagement} The agreed-upon terms of the engagement should include the following: A statement that a review is substantially less in scope than an examination, the objective of which is to obtain reasonable assurance about whether the subject matter is in accordance with (or based on) the criteria, in all material respects, or the assertion is fairly stated, in all material respects, in order to express an opinion, and that, accordingly, the practitioner will not express such an opinion AT-C Section 210.09 e.
    The practitioner's agreed-upon procedures report should include the following: An identification of the subject matter or assertion and the nature of an agreed-upon procedures engagement. AT-C Section 215.35 c.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A description of the nature of an examination engagement. AT-C Section 305.32 g.
    The practitioner's agreed-upon procedures report should include the following: When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .35m: A description of the purpose of the report, and AT-C Section 215.35 n.i.
    {agreed-upon procedures engagement} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An identification of the prospective financial information and the nature of an agreed- upon procedures engagement. AT-C Section 305.39 c.
    {agreed-upon procedures engagement} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: An identification of the prospective financial information and the nature of an agreed- upon procedures engagement. AT-C Section 305.39 c.
    The practitioner's review report on pro forma financial information should include the following: a description of the objectives and limitations of pro forma financial information. AT-C Section 310.18 k.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A description of the nature of an examination engagement. AT-C Section 315.20 g.]
    Establish/Maintain Documentation Preventive
    Include the professional standards governing the audit in the statement of the character of the engagement in the audit report. CC ID 07168
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that the practitioner's examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 205.63 f.i.
    The practitioner's report should include the following: A statement that the practitioner's review was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 210.46 f.i.
    The practitioner's agreed-upon procedures report on compliance should include the following: An identification of the specified requirements against which the entity's compliance was measured or evaluated. AT-C Section 315.26 d.
    {financial forecast} {financial projection} The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: An indication that the criteria against which the prospective financial information was measured or evaluated are the guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants. AT-C Section 305.32 d.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement that identifies the responsible party and its responsibility for preparing and presenting the prospective financial information in accordance with the guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants. AT-C Section 305.32 e.i.]
    Establish/Maintain Documentation Preventive
    Include all restrictions on the audit in the audit report. CC ID 13930
    [When circumstances impose restrictions on the performance of the agreed-upon procedures, the practitioner should attempt to obtain agreement from the specified parties for modification of the agreed-upon procedures. When such agreement cannot be obtained (for example, when the agreed-upon procedures are published by a regulatory agency that will not modify the procedures), the practitioner should describe any restrictions on the performance of procedures in the practitioner's report or withdraw from the engagement. AT-C Section 215.37]
    Establish/Maintain Documentation Preventive
    Include a statement that the auditor has no responsibility to update the audit report after its submission. CC ID 13943
    [The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the practitioner has no responsibility to update the report for events and circumstances occurring after the date of the report. AT-C Section 305.39 m.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement that the practitioner has no responsibility to update the report for events and circumstances occurring after the date of the report. AT-C Section 305.32 j.]
    Establish/Maintain Documentation Preventive
    Include a statement that the responsible party refused to provide a written assertion in the audit report. CC ID 13887
    [When the engaging party is not the responsible party and the responsible party refuses to provide the practitioner with a written assertion, the practitioner may report on the subject matter but should disclose in the practitioner's report the responsible party's refusal to provide a written assertion and should restrict the use of the practitioner's report to the engaging party. AT-C Section 205.84
    The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including when the engaging party is not the responsible party and the responsible party will not provide the written representations regarding the matters in paragraph .33, the oral responses from the responsible party to the practitioner's inquiries regarding the matters in paragraph .33, in accordance with paragraph .34; and AT-C Section 210.62 a.v.]
    Establish/Maintain Documentation Preventive
    Include a statement that the examination involves procedures for collecting evidence in the audit report. CC ID 13941
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that an examination involves performing procedures to obtain evidence about the related pro forma adjustments, and AT-C Section 310.17 j.iii.(2)
    A service auditor's type 1 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design of the service organization's controls to achieve the related control objectives stated in the description involves performing procedures to obtain evidence about the fairness of the presentation of the description and the suitability of the design of the controls to achieve the related control objectives stated in the description, based on the criteria in management's assertion. AT-C Section 320.41 i.i.
    A service auditor's type 1 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design of the service organization's controls to achieve the related control objectives stated in the description involves performing procedures to obtain evidence about the fairness of the presentation of the description and the suitability of the design of the controls to achieve the related control objectives stated in the description, based on the criteria in management's assertion. AT-C Section 320.41 i.i.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that an examination involves performing procedures to obtain evidence about management's assumptions, AT-C Section 310.17 j.iii.(1)]
    Establish/Maintain Documentation Preventive
    Express an adverse opinion in the audit report when significant assumptions are not suitably supported. CC ID 13944
    [{financial forecast} {financial projection} {not supported} {not provide} The following are circumstances that require the practitioner to modify the opinion and the type of modified opinion the practitioner should express in each circumstance: If the practitioner believes that one or more significant assumptions are not suitably supported or do not provide a reasonable basis for the forecast, or for the projection given the hypothetical assumptions, the practitioner should express an adverse opinion. AT-C Section 305.35 c.
    The following are circumstances that require the practitioner to modify the opinion and the type of modified opinion the practitioner should express in each circumstance: If the prospective financial information fails to disclose assumptions that, in the practitioner's professional judgment, are significant, or misapplies the accounting principles, the practitioner should express an adverse opinion. AT-C Section 305.35 b.]
    Establish/Maintain Documentation Preventive
    Include a statement that modifications to historical evidence accurately reflect current evidence in the audit report. CC ID 13938
    [{attestation standard} The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether, in accordance with (or based on) the criteria and, in all material respects, the pro forma amounts reflect the proper application of those adjustments to the historical financial statement amounts. AT-C Section 310.17 j.ii.(2)(b)
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: The practitioner's opinion about whether, in accordance with (or based on) the criteria and, in all material respects the pro forma amounts reflect the proper application of those adjustments to the historical financial statement amounts. AT-C Section 310.17 l.ii.(2)
    The practitioner's review report on pro forma financial information should include the following: A statement that those standards require that the practitioner plan and perform the review to obtain limited assurance about whether, in accordance with (or based on) the criteria, any material modifications should be made to the pro forma amounts in order for them to reflect the proper application of those adjustments to the historical financial statement amounts. AT-C Section 310.18 j.ii.(3)
    The practitioner's review report on pro forma financial information should include the following: the practitioner's conclusion about whether, in accordance with (or based on) the review and based on the criteria, the practitioner is aware of any material modifications that should be made to the pro forma amounts in order for them to reflect the proper application of those adjustments to the historical financial statement amounts. AT-C Section 310.18 l.iii.]
    Establish/Maintain Documentation Preventive
    Refrain from referencing other auditor's work in the audit report. CC ID 13881
    [The practitioner should not refer to the work of a practitioner's specialist in the practitioner's report containing an unmodified opinion. AT-C Section 205.67
    The practitioner should not refer to the work of a practitioner's specialist in the practitioner's report containing an unmodified conclusion. AT-C Section 210.50
    {attestation engagement} If the practitioner concludes, based on the practitioner's professional judgment, that there is reasonable justification to change the terms of the engagement from the original level of service that the practitioner was engaged to perform to a lower level of service, for example, from an examination to a review, and if the practitioner complies with the AT-C sections applicable to the lower level of service, the practitioner should issue an appropriate practitioner's report on the lower level of service. The report should not include reference to (a) the original engagement, (b) any procedures that may have been performed, or (c) scope limitations that resulted in the changed engagement. AT-C Section 105.30]
    Establish/Maintain Documentation Preventive
    Include that the audit findings are not a predictive analysis of future compliance in the audit report. CC ID 07018
    [A service auditor's type 1 report should include the following: A description of the inherent limitations of controls, including that projecting to the future any evaluation of the fairness of the presentation of management's description of the service organization's system or conclusions about the suitability of the design of the controls to achieve the related control objectives is subject to the risk that controls at a service organization may become ineffective. AT-C Section 320.41 j.]
    Establish/Maintain Documentation Preventive
    Include the organization's audit assertion of the in scope system in the audit report. CC ID 07005
    [The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A description of the objectives and limitations of pro forma financial information AT-C Section 310.17 k.
    The practitioner's review report on pro forma financial information should include the following: A statement that the pro forma adjustments are based on management's assumptions. AT-C Section 310.18 h.
    A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for AT-C Section 320.40 f.
    A service auditor's type 2 report should include the following: Identification of the following: The criteria identified in management's assertion against which the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description were evaluated AT-C Section 320.40 c.ii.
    A service auditor's type 2 report should include the following: Identification of the following: The criteria identified in management's assertion against which the fairness of the presentation of the description and the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description were evaluated AT-C Section 320.40 c.ii.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for AT-C Section 320.41 f.
    A service auditor's type 1 report should include the following: Identification of the following: The criteria identified in management's assertion against which the fairness of the presentation of the description and the suitability of the design of the controls to achieve the related control objectives stated in the description were evaluated. AT-C Section 320.41 c.ii.
    A service auditor's type 1 report should include the following: Identification of the following: The criteria identified in management's assertion against which the fairness of the presentation of the description and the suitability of the design of the controls to achieve the related control objectives stated in the description were evaluated. AT-C Section 320.41 c.ii.]
    Actionable Reports or Measurements Preventive
    Include that the organization is the responsible party for the content of its audit assertion and in scope system description in the audit report. CC ID 07010
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that identifies the responsible party and its responsibility for the subject matter in accordance with (or based on) the criteria or for its assertion, and AT-C Section 205.63 e.i.
    The practitioner's report should include the following: A statement that identifies the responsible party and its responsibility for the subject matter in accordance with (or based on) the criteria or for its assertion and AT-C Section 210.46 e.i.
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should acknowledge that the responsible party is responsible for the subject matter and assertion. AT-C Section 210.35 a.
    The practitioner's agreed-upon procedures report should include the following: A statement that identifies the responsible party and its responsibility for the subject matter or its assertion. AT-C Section 215.35 f.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the sufficiency of the procedures is solely the responsibility of the parties specified in the report. AT-C Section 305.39 g.i.
    The practitioner's review report on pro forma financial information should include the following: A statement that identifies management and its responsibility for the pro forma financial information. AT-C Section 310.18 i.i.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Identifying the risks that threaten the achievement of the control objectives stated in the description and designing, implementing, and documenting controls that are suitably designed and operating effectively to provide reasonable assurance that the control objectives stated in the description of the service organization's system will be achieved AT-C Section 320.10 b.v.
    A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for preparing the description of the service organization's system and the assertion, including the completeness, accuracy, and method of presentation of the description and assertion. AT-C Section 320.40 f.i.
    A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for preparing the description of the service organization's system and the assertion, including the completeness, accuracy, and method of presentation of the description and assertion. AT-C Section 320.40 f.i.
    A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for providing the services covered by the description of the service organization's system. AT-C Section 320.40 f.ii.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for preparing the description of the service organization's system and the assertion, including the completeness, accuracy, and method of presentation of the description and assertion. AT-C Section 320.41 f.i.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for providing the services covered by the description of the service organization's system. AT-C Section 320.41 f.ii.
    {attributed} The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether, in accordance with (or based on) the criteria management's assumptions provide a reasonable basis for presenting the significant effects directly attributable to the underlying transaction (or event), AT-C Section 310.17 j.ii.(1)]
    Establish/Maintain Documentation Preventive
    Include that the organization is the responsible party for specifying in scope controls not defined by law or contractual obligation in the audit report. CC ID 07011
    [A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for specifying the control objectives and stating them in the description of the service organization's system. AT-C Section 320.40 f.iii.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for specifying the control objectives and stating them in the description of the service organization's system. AT-C Section 320.41 f.iii.]
    Establish/Maintain Documentation Preventive
    Include that the organization is the responsible party for designing and implementing the in scope controls it identified in the audit scope in the audit report. CC ID 07014
    [In order to accept an attestation engagement to examine compliance with specified requirements, in addition to the preconditions for an examination engagement in sections 105 and 205, the practitioner should determine that management accepts responsibility for the entity's compliance with specified requirements and the entity's internal control over compliance. AT-C Section 315.09 a.
    In order to accept an attestation engagement to examine compliance with specified requirements, in addition to the preconditions for an examination engagement in sections 105 and 205, the practitioner should determine that management accepts responsibility for the entity's compliance with specified requirements and the entity's internal control over compliance. AT-C Section 315.09 a.
    In an examination engagement, in addition to the written representations from management required by section 205, the practitioner should request written representations from management that acknowledge management's responsibility for establishing and maintaining effective internal control over compliance. AT-C Section 315.17 a.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A statement that identifies management and its responsibility for compliance with the specified requirements (when reporting on the subject matter) or for its assertion (when reporting on the assertion). AT-C Section 315.20 e.i.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Specifying the control objectives, stating them in the description of the service organization's system, and, if the control objectives are specified by law, regulation, or another party (for example, a user group or a professional body), identifying in the description the party specifying the control objectives AT-C Section 320.10 b.iv.
    A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for designing, implementing, and documenting controls that are suitably designed and operating effectively to achieve the related control objectives stated in the description of the service organization's system. AT-C Section 320.40 f.vi.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for designing, implementing, and documenting controls that are suitably designed and operating effectively to achieve the related control objectives stated in the description of the service organization's system. AT-C Section 320.41 f.vi.
    {financial forecast} {financial projection} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that identifies the responsible party and its responsibility for preparing and presenting the forecast (or projection) in accordance with the guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants. AT-C Section 305.39 f.
    A service auditor's type 1 report should include the following: A statement that the controls and control objectives included in the description are those that management believes are likely to be relevant to user entities' internal control over financial reporting, and the description does not include those aspects of the system that are not likely to be relevant to user entities' internal control over financial reporting. AT-C Section 320.41 d.]
    Establish/Maintain Documentation Preventive
    Include the audit opinion regarding the accurateness of the in scope system description in the audit report. CC ID 07019
    [The practitioner should consider the reasonableness and consistency of the responsible party's responses in light of the results of other review procedures and the practitioner's knowledge of the subject matter, criteria, and responsible party. AT-C Section 210.22
    The service auditor should determine through inquiries made in combination with other procedures whether the service organization's system has been implemented. AT-C Section 320.26
    A service auditor's type 2 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion management's description of the service organization's system fairly presents the service organization's system that was designed and implemented throughout the specified period. AT-C Section 320.40 l.i.
    A service auditor's type 1 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion management's description of the service organization's system fairly presents the service organization's system that was designed and implemented as of the specified date. AT-C Section 320.41 l.i.
    A service auditor's type 1 report should include the following: A statement that the service auditor is responsible for expressing an opinion on the fairness of the presentation of management's description of the service organization's system and on the suitability of the design of the controls to achieve the related control objectives stated in the description, based on the service auditor's examination. AT-C Section 320.41 g.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. The practitioner's opinion about whether, in all material respects management's assertion about the entity's compliance with specified requirements is fairly stated. AT-C Section 315.20 j.(2)
    A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves evaluating the overall presentation of management's description of the service organization's system, suitability of the control objectives stated in the description, and suitability of the criteria specified by the service organization in its assertion. AT-C Section 320.40 i.iv.
    A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves evaluating the overall presentation of management's description of the service organization's system, suitability of the control objectives stated in the description, and suitability of the criteria specified by the service organization in its assertion. AT-C Section 320.40 i.iv.
    A service auditor's type 1 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design of the service organization's controls to achieve the related control objectives stated in the description involves assessing the risks that management's description of the service organization's system is not fairly presented and that the controls were not suitably designed to achieve the related control objectives. AT-C Section 320.41 i.ii.]
    Establish/Maintain Documentation Preventive
    Include the attestation standards the auditor follows in the audit report. CC ID 07015
    [{review engagement} The agreed-upon terms of the engagement should include the following: A statement that the engagement will be conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants AT-C Section 210.09 c.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement that the practitioner's examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 305.32 f.i.
    {attestation standards} {financial forecasts} {financial projection} The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether the forecast (or projection) is presented in accordance with the guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants, in all material respects. AT-C Section 305.32 f.ii.
    {attestation standards} A service auditor's type 1 report should include the following: A statement that those standards require that the service auditor plan and perform the examination to obtain reasonable assurance about whether, in all material respects, based on the criteria in management's assertion, management's description of the service organization's system is fairly presented, and the controls are suitably designed as of the specified date to achieve the related control objectives. AT-C Section 320.41 h.ii.
    The practitioner's agreed-upon procedures report should include the following: A statement that the agreed-upon procedures engagement was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 215.35 j.i.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that the practitioner's examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 310.17 j.i.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the agreed-upon procedures engagement was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 305.39 j.i.
    A service auditor's type 2 report should include the following: A statement that the examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 320.40 h.i.
    The practitioner's review report on pro forma financial information should include the following: A statement that the practitioner's review was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 310.18 j.i.
    {examination engagement} The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A statement that the examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 315.20 f.i.
    The practitioner's agreed-upon procedures report on compliance should include the following: A statement that the agreed-upon procedures engagement was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 315.26 j.i.
    A service auditor's type 1 report should include the following: A statement that the examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants. AT-C Section 320.41 h.i.]
    Establish/Maintain Documentation Preventive
    Include the audit opinion about the audit assertion in relation to the audit criteria used for evaluation in the audit report. CC ID 07169
    [{attestation standards} The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether the responsible party's assertion is fairly stated, in all material respects. AT-C Section 205.63 f.ii(2)
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: The practitioner's opinion about whether the subject matter is in accordance with (or based on) the criteria, in all material respects or AT-C Section 205.63 i.i.
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: The practitioner's opinion about whether the responsible party's assertion is fairly stated, in all material respects. AT-C Section 205.63 i.ii.
    When the practitioner expresses a qualified opinion due to a material misstatement of the subject matter, the practitioner should state that, in the practitioner's opinion, except for the effects of the matter(s) giving rise to the modification, the subject matter is presented in accordance with (or based on) the criteria, in all material respects. When the modification arises from an inability to obtain sufficient appropriate evidence, the practitioner should use the corresponding phrase "except for the possible effects of the matter(s) ..." for the modified opinion. AT-C Section 205.71
    When the practitioner expresses an adverse opinion, the practitioner should state that, in the practitioner's opinion, because of the significance of the matter(s) giving rise to the modification, the subject matter is not presented in accordance with (or based on) the criteria, in all material respects. AT-C Section 205.73
    The practitioner's opinion on the subject matter or assertion should be clearly separated from any paragraphs emphasizing matters related to the subject matter or any other reporting responsibilities. AT-C Section 205.80
    The practitioner's report should include the following: The practitioner's conclusion about whether, based on the review, the practitioner is aware of any material modifications that should be made to the responsible party's assertion in order for it to be fairly stated. AT-C Section 210.46 h.ii.
    {examination engagement} {financial forecast} {financial projection} If after accepting the engagement, the practitioner determines that the forecast or projection fails to disclose one or more of the significant assumptions, the practitioner should describe the assumption(s) in the practitioner's report and express an adverse opinion. AT-C Section 305.13
    As required by section 105, the practitioner should determine whether management has used suitable criteria in preparing and presenting the pro forma financial information. In assessing the suitability of the criteria, the practitioner should determine whether the criteria include, at a minimum, that the financial information be extracted from audited or reviewed historical financial statements; AT-C Section 310.11 a.
    {attributed} As required by section 105, the practitioner should determine whether management has used suitable criteria in preparing and presenting the pro forma financial information. In assessing the suitability of the criteria, the practitioner should determine whether the criteria include, at a minimum, that the pro forma adjustments be directly attributable to the transaction (or event), AT-C Section 310.11 b.i.
    {give effect} The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether, in accordance with (or based on) the criteria and, in all material respects, the related pro forma adjustments give appropriate effect to those assumptions, and AT-C Section 310.17 j.ii.(2)(a)
    {give effect} The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: The practitioner's opinion about whether, in accordance with (or based on) the criteria and, in all material respects the related pro forma adjustments give appropriate effect to those assumptions, and AT-C Section 310.17 l.ii.(1)
    Frequently, criteria will be contained in the compliance requirements, in which case, it is not necessary to repeat the criteria in the practitioner's report; however, if the criteria are not included in the compliance requirement, the report should identify the criteria. AT-C Section 315.21
    The service auditor should obtain and read management's description of the service organization's system and should evaluate whether those aspects of the description that are included in the scope of the engagement are presented fairly, in all material respects, based on the criteria in management's assertion, including whether AT-C Section 320.25
    {attestation standards} A service auditor's type 1 report should include the following: A statement that those standards require that the service auditor plan and perform the examination to obtain reasonable assurance about whether, in all material respects, based on the criteria in management's assertion, management's description of the service organization's system is fairly presented, and the controls are suitably designed as of the specified date to achieve the related control objectives. AT-C Section 320.41 h.ii.
    {attributed} The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: The practitioner's opinion about whether, in accordance with (or based on) the criteria management's assumptions provide a reasonable basis for presenting the significant effects directly attributable to the transaction (or event), AT-C Section 310.17 l.i.]
    Establish/Maintain Documentation Preventive
    Include the auditor's significant reservations about the engagement, the audit assertion, or the audit subject matter in the audit report. CC ID 07170
    [When the practitioner disclaims an opinion due to an inability to obtain sufficient appropriate evidence, the practitioner's report should state that because of the significance of the matter(s) giving rise to the modification, the practitioner has not been able to obtain sufficient appropriate evidence to provide a basis for an examination opinion and AT-C Section 205.75 a.
    {audit report} If it is discovered after the engagement has been accepted that one or more of the preconditions for an attestation engagement is not present, the practitioner should discuss the matter with the appropriate party(ies) and should determine if the matter cannot be resolved but it is still appropriate to continue with the engagement, whether, and if so how, to communicate the matter in the practitioner's report. AT-C Section 105.28 c.
    When the engaging party is the responsible party, and one or more of the requested written representations are not provided, or the practitioner concludes that there is sufficient doubt about the competence, integrity, ethical values, or diligence of those providing the written representations, or the practitioner concludes that the written representations are otherwise not reliable, the practitioner should reevaluate the integrity of those from whom the representations were requested or received and evaluate the effect that this may have on the reliability of representations and review evidence in general, and AT-C Section 210.38 b.
    The practitioner's agreed-upon procedures report should include the following: When applicable, reservations or restrictions concerning procedures or findings. AT-C Section 215.35 l.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement indicating that the prospective results may not be achieved and describing other significant inherent limitations, if any. AT-C Section 305.32 i.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement indicating that the prospective results may not be achieved and describing other significant inherent limitations, if any. AT-C Section 305.32 i.
    The following are circumstances that require the practitioner to modify the opinion and the type of modified opinion the practitioner should express in each circumstance: If the practitioner is unable to obtain sufficient appropriate evidence, the practitioner should disclaim an opinion and describe the scope limitation in the practitioner's report. AT-C Section 305.35 d.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: When applicable, reservations or restrictions concerning procedures or findings. AT-C Section 305.39 n.
    The practitioner's agreed-upon procedures report on compliance should include the following: When applicable, reservations or restrictions concerning procedures or findings. AT-C Section 315.26 l.
    The practitioner's report should include the following: The practitioner's conclusion about whether, based on the review, the practitioner is aware of any material modifications that should be made to the subject matter in order for it be in accordance with (or based on) the criteria (or equivalent language regarding the subject matter and criteria, such as the language used in the examples in paragraph .A67) or AT-C Section 210.46 h.i.]
    Establish/Maintain Documentation Preventive
    Include the organization's description of the in scope system in the audit report. CC ID 11626
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: An identification or description of the subject matter or assertion being reported on, including the point in time or period of time to which the measurement or evaluation of the subject matter or assertion relates. AT-C Section 205.63 c.
    When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the practitioner's report should include the following information, rather than the information required by paragraph .65: A description of the purpose of the report AT-C Section 205.66 a.
    The practitioner's report should include the following: An identification or description of the subject matter or assertion being reported on, including the point in time or period of time to which the measurement or evaluation of the subject matter or assertion relates. AT-C Section 210.46 c.
    The practitioner's agreed-upon procedures report should include the following: An identification of the subject matter or assertion and the nature of an agreed-upon procedures engagement. AT-C Section 215.35 c.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: An identification of the prospective financial information being reported on, including the period of time to which the prospective financial information relates. AT-C Section 305.32 c.
    When a practitioner examines a projection, the practitioner's opinion regarding the assumptions should be conditioned on the hypothetical assumptions, that is, the practitioner should express an opinion on whether the assumptions provide a reasonable basis for the projection, given the hypothetical assumptions. In addition to the required elements for a practitioner's report on an examination of a forecast, a report on an examination of a projection should include When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .33c: a description of the purpose of the report, and AT-C Section 305.33 d.i.
    {agreed-upon procedures engagement} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .39o. A description of the purpose of the report AT-C Section 305.39 p.i.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A reference to the pro forma adjustments included in the pro forma financial information. AT-C Section 310.17 c.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A reference to management's description of the transaction (or event) to which the pro forma adjustments give effect. (The description is included in the pro forma financial information.) AT-C Section 310.17 d.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: An identification or description of the pro forma financial information being reported on, including the point in time or period of time to which the measurement or evaluation of the pro forma financial information relates. AT-C Section 310.17 e.
    The practitioner's agreed-upon procedures report on compliance should include the following: When the engagement is also performed in accordance with Government Auditing Standards, the alert that restricts the use of the report should include the following information, rather than the information required by paragraph .26m: A description of the purpose of the report AT-C Section 315.26 n.i.
    A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Specifying the control objectives, stating them in the description of the service organization's system, and, if the control objectives are specified by law, regulation, or another party (for example, a user group or a professional body), identifying in the description the party specifying the control objectives AT-C Section 320.10 b.iv.
    In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: Other aspects of the service organization's control environment, risk assessment process, information and communications (including the related business processes), control activities, and monitoring activities that are relevant to the services provided. AT-C Section 320.15 a.viii.
    The service auditor should obtain an understanding of the service organization's system, including controls that are included in the scope of the engagement. That understanding should include service organization processes used to prepare the description of the service organization's system, including the determination of control objectives, AT-C Section 320.20 a.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for preparing the description of the service organization's system and the assertion, including the completeness, accuracy, and method of presentation of the description and assertion. AT-C Section 320.41 f.i.
    A service auditor's type 1 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design of the service organization's controls to achieve the related control objectives stated in the description involves evaluating the overall presentation of management's description of the service organization's system, suitability of the control objectives stated in the description, and suitability of the criteria specified by the service organization in its assertion. AT-C Section 320.41 i.iii.
    A service auditor's type 1 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design of the service organization's controls to achieve the related control objectives stated in the description involves evaluating the overall presentation of management's description of the service organization's system, suitability of the control objectives stated in the description, and suitability of the criteria specified by the service organization in its assertion. AT-C Section 320.41 i.iii.
    A service auditor's type 1 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design of the service organization's controls to achieve the related control objectives stated in the description involves evaluating the overall presentation of management's description of the service organization's system, suitability of the control objectives stated in the description, and suitability of the criteria specified by the service organization in its assertion. AT-C Section 320.41 i.iii.
    A service auditor's type 1 report should include the following: A statement that the controls and control objectives included in the description are those that management believes are likely to be relevant to user entities' internal control over financial reporting, and the description does not include those aspects of the system that are not likely to be relevant to user entities' internal control over financial reporting. AT-C Section 320.41 d.
    A service auditor's type 2 report should include the following: Identification of the following: Management's description of the service organization's system, the function performed by the system, and the period to which the description relates AT-C Section 320.40 c.i.
    A service auditor's type 2 report should include the following: Identification of the following: Management's description of the service organization's system, the function performed by the system, and the period to which the description relates AT-C Section 320.40 c.i.
    A service auditor's type 2 report should include the following: Identification of the following: Management's description of the service organization's system, the function performed by the system, and the period to which the description relates AT-C Section 320.40 c.i.
    A service auditor's type 1 report should include the following: Identification of the following: Management's description of the service organization's system, the function performed by the system, and the specified date to which the description relates. AT-C Section 320.41 c.i.
    A service auditor's type 1 report should include the following: Identification of the following: Management's description of the service organization's system, the function performed by the system, and the specified date to which the description relates. AT-C Section 320.41 c.i.
    A service auditor's type 1 report should include the following: Identification of the following: Management's description of the service organization's system, the function performed by the system, and the specified date to which the description relates. AT-C Section 320.41 c.i.
    A service auditor's type 2 report should include the following: A statement that the controls and control objectives included in the description are those that management believes are likely to be relevant to user entities' internal control over financial reporting, and the description does not include those aspects of the system that are not likely to be relevant to user entities' internal control over financial reporting. AT-C Section 320.40 d.
    A service auditor's type 2 report should include the following: A statement that the controls and control objectives included in the description are those that management believes are likely to be relevant to user entities' internal control over financial reporting, and the description does not include those aspects of the system that are not likely to be relevant to user entities' internal control over financial reporting. AT-C Section 320.40 d.]
    Audits and Risk Management Preventive
    Include any out of scope components of in scope systems in the audit report. CC ID 07006
    [The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: When applicable, a description of any agreed-upon materiality limits. AT-C Section 305.39 i.]
    Establish/Maintain Documentation Preventive
    Include that the organization is the responsible party for identifying material risks in the audit report. CC ID 07012
    [A service auditor should accept or continue an engagement to report on controls at a service organization pursuant to this section only if the preconditions for an attestation engagement identified in section 105 and the following conditions are met: Management acknowledges and accepts its responsibility for the following: Identifying the risks that threaten the achievement of the control objectives stated in the description and designing, implementing, and documenting controls that are suitably designed and operating effectively to provide reasonable assurance that the control objectives stated in the description of the service organization's system will be achieved AT-C Section 320.10 b.v.
    A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for identifying the risks that threaten the achievement of the control objectives. AT-C Section 320.40 f.iv.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for identifying the risks that threaten the achievement of the control objectives. AT-C Section 320.41 f.iv.]
    Establish/Maintain Documentation Preventive
    Include that the organization is the responsible party for selecting the audit criteria in the audit report. CC ID 07013
    [A service auditor's type 2 report should include the following: A reference to management's assertion and a statement that management is responsible for selecting the criteria. AT-C Section 320.40 f.v.
    A service auditor's type 1 report should include the following: A reference to management's assertion and a statement that management is responsible for selecting the criteria. AT-C Section 320.41 f.v.]
    Establish/Maintain Documentation Preventive
    Include the scope and work performed in the audit report. CC ID 11621
    [The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A list of the procedures performed (or reference thereto) and related findings. (The practitioner should not provide a conclusion.) AT-C Section 305.39 h.
    The following are circumstances that require the practitioner to modify the opinion and the type of modified opinion the practitioner should express in each circumstance: If the practitioner is unable to obtain sufficient appropriate evidence, the practitioner should disclaim an opinion and describe the scope limitation in the practitioner's report. AT-C Section 305.35 d.
    The practitioner's agreed-upon procedures report on compliance should include the following: A list of the procedures performed (or reference thereto) and related findings. (The practitioner should not provide a conclusion.) AT-C Section 315.26 h.
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: AT-C Section 320.41 c.iv.
    The practitioner's agreed-upon procedures report should include the following: A list of the procedures performed (or reference thereto) and related findings. (The practitioner should not provide a conclusion. (See paragraph .25.) AT-C Section 215.35 h.]
    Audits and Risk Management Preventive
    Review the adequacy of the internal auditor's work papers. CC ID 01146
    [When using internal auditors to provide direct assistance to the practitioner, the practitioner should direct, supervise, and review the work of the internal auditors. AT-C Section 205.42]
    Audits and Risk Management Detective
    Compare the evaluations completed by the internal auditors and the external auditors in past audit reports. CC ID 01158
    [In establishing the overall engagement strategy, the practitioner should consider the results of preliminary engagement activities, such as client acceptance, and, when applicable, whether knowledge gained on other engagements performed by the engagement partner for the entity is relevant; and AT-C Section 205.12 c.]
    Establish/Maintain Documentation Detective
    Review the adequacy of the internal auditor's audit reports. CC ID 11620 Audits and Risk Management Detective
    Review past audit reports. CC ID 01155
    [In establishing the overall engagement strategy, the practitioner should consider the results of preliminary engagement activities, such as client acceptance, and, when applicable, whether knowledge gained on other engagements performed by the engagement partner for the entity is relevant; and AT-C Section 205.12 c.
    The practitioner's review report on pro forma financial information should include the following: A reference to the financial statements from which the historical financial information is derived and if the practitioner issued a review report on the historical financial statements, a statement that a review report was issued, and, if applicable, whether the financial statements were reviewed by another accountant. (The report on pro forma financial information should refer to any modification in the accountant's report on the historical financial information. In the case of a business combination, this paragraph applies to each significant constituent part of the combined entity.) AT-C Section 310.18 g.ii.]
    Establish/Maintain Documentation Detective
    Review past audit reports for specific process steps and calculations that were stated to support the audit report's conclusions. CC ID 01160
    [For those engagements, if any, for which the firm has determined that an engagement quality control review is required the engagement quality control reviewer should perform an objective evaluation of the significant judgments made by the engagement team and the conclusions reached in formulating the report. This evaluation should include the following: Reading selected engagement documentation relating to the significant judgments the engagement team made and the related conclusions it reached AT-C Section 105.42 b.iii.
    {examination engagement} The examination procedures should be based on the practitioner's consideration of the following: Knowledge obtained during current and previous engagements AT-C Section 305.20 c.
    The service auditor should read the reports of the internal audit function and regulatory examinations that relate to the services provided to user entities and the scope of the engagement, if any, to obtain an understanding of the nature and extent of the procedures performed and the related findings. The findings should be taken into consideration as part of the risk assessment and in determining the nature, timing, and extent of the tests. AT-C Section 320.23
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Evaluate whether computations of pro forma adjustments are mathematically correct and whether the pro forma column reflects the proper application of those adjustments to the historical financial statements. AT-C Section 310.13 h.
    {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Evaluate whether computations of pro forma adjustments are mathematically correct and whether the pro forma column reflects the proper application of those adjustments to the historical financial statements. AT-C Section 310.13 h.]
    Establish/Maintain Documentation Detective
    Review the reporting of material weaknesses and risks in past audit reports. CC ID 01161
    [In designing and performing further procedures in accordance with paragraph .21, the practitioner should consider the reasons for the assessment given to the risk of material misstatement, including AT-C Section 205.22 a.
    The service auditor should assess whether the controls that management identified in its description of the service organization's system as the controls that achieve the control objectives were suitably designed to achieve those control objectives by evaluating the linkage of the controls identified in management's description of the service organization's system with those risks, including risks arising from each of the described classes of transactions and risks that IT poses to the user entity's internal control over financial reporting, and AT-C Section 320.27 b.]
    Establish/Maintain Documentation Detective
    Resolve disputes before creating the audit summary. CC ID 08964 Behavior Preventive
    Refrain from including the description of the audit in the audit report when the auditor is disclaiming an audit opinion. CC ID 13975
    [{refrain from including} If the service auditor plans to disclaim an opinion, the service auditor should not identify the procedures that were performed nor include statements describing the characteristics of a service auditor's engagement in the service auditor's report—to do so might overshadow the disclaimer. AT-C Section 320.44]
    Establish/Maintain Documentation Preventive
    Refrain from including scope limitations from changed attestation engagements in the audit report. CC ID 13983
    [{attestation engagement} If the practitioner concludes, based on the practitioner's professional judgment, that there is reasonable justification to change the terms of the engagement from the original level of service that the practitioner was engaged to perform to a lower level of service, for example, from an examination to a review, and if the practitioner complies with the AT-C sections applicable to the lower level of service, the practitioner should issue an appropriate practitioner's report on the lower level of service. The report should not include reference to (a) the original engagement, (b) any procedures that may have been performed, or (c) scope limitations that resulted in the changed engagement. AT-C Section 105.30]
    Establish/Maintain Documentation Preventive
    Refrain from including in the audit report any procedures that were performed that the auditor is disclaiming in an audit opinion. CC ID 13974
    [{refrain from including} If the service auditor plans to disclaim an opinion, the service auditor should not identify the procedures that were performed nor include statements describing the characteristics of a service auditor's engagement in the service auditor's report—to do so might overshadow the disclaimer. AT-C Section 320.44]
    Establish/Maintain Documentation Preventive
    Determine the effect of fraud and non-compliance on the audit report, as necessary. CC ID 13979
    [If the service auditor becomes aware of incidents of noncompliance with laws or regulations, fraud or uncorrected misstatements attributable to management or other service organization personnel that are not clearly trivial and that may affect one or more user entities, the service auditor should determine the effect of such incidents on management's assertion, management's description of the service organization's system, the achievement of the control objectives, and the service auditor's report. AT-C Section 320.34]
    Process or Activity Detective
    Include an audit opinion in the audit report. CC ID 07017
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that the practitioner believes the evidence the practitioner obtained is sufficient and appropriate to provide a reasonable basis for the practitioner's opinion. AT-C Section 205.63 f.iii.
    {qualified opinion} {audit opinion} If the practitioner has concluded that conditions exist that, individually or in combination, result in one or more material misstatements based on the criteria, the practitioner should modify the opinion and express a qualified or adverse opinion directly on the subject matter, not on the assertion, even when the assertion acknowledges the misstatement. AT-C Section 205.79
    {audit report} In order to establish that the preconditions for an attestation engagement are present, the practitioner should determine both of the following: The engagement exhibits all of the following characteristics: The practitioner's opinion, conclusion, or findings, in the form appropriate to the engagement, is to be contained in a written practitioner's report. AT-C Section 105.25 b.iv.
    The practitioner's report should include the following: A statement that the practitioner believes the review provides a reasonable basis for the practitioner's conclusion. AT-C Section 210.46 f.iv.
    {examination engagement} {financial forecast} {financial projection} A practitioner should not examine a forecast or projection that discloses none of the significant assumptions. If after accepting the engagement the practitioner determines that the forecast or projection discloses none of the significant assumptions, the practitioner should withdraw from the engagement, unless required by law or regulation to report on the financial forecast or projection, in which case, the practitioner should express an adverse opinion in the practitioner's report. AT-C Section 305.12
    {examination engagement} {financial projection} {hypothetical assumptions} If after accepting the engagement the practitioner determines that a projection fails to identify which of the assumptions are hypothetical or describe the limitations on the usefulness of the projection, the practitioner should withdraw from the engagement, unless required by law or regulation to report on the projection, in which case, the practitioner should express an adverse opinion in the practitioner's report. AT-C Section 305.14
    {financial forecast} {financial projection} The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: The practitioner's opinion about whether the forecast (or projection) is presented, in all material respects, in accordance with the guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants, and whether the underlying assumptions are suitably supported and provide a reasonable basis for the forecast or a reasonable basis for the projection given the hypothetical assumptions. AT-C Section 305.32 h.
    {is appropriate} The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A statement that the practitioner believes the evidence obtained is sufficient and appropriate to provide a reasonable basis for the practitioner's opinion. AT-C Section 315.20 f.iii.]
    Establish/Maintain Documentation Preventive
    Include qualified opinions in the audit report, as necessary. CC ID 13928 Establish/Maintain Documentation Preventive
    Include that the auditor is the responsible party to express an opinion on the audit subject matter based on examination of evidence in the audit report. CC ID 07174
    [The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that identifies the practitioner's responsibility to express an opinion on the subject matter or assertion, based on the practitioner's examination. AT-C Section 205.63 e.ii.
    {attestation standards} The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: A statement that those standards require that the practitioner plan and perform the examination to obtain reasonable assurance about whether the subject matter is in accordance with (or based on) the criteria, in all material respects (or equivalent language regarding the subject matter and criteria, such as the language used in the examples in paragraph .A82) or AT-C Section 205.63 f.ii(1)
    The practitioner should express a qualified opinion when the practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are material, but not pervasive to the subject matter or AT-C Section 205.70 a.
    The practitioner should express a qualified opinion when the practitioner is unable to obtain sufficient appropriate evidence on which to base the opinion, but the practitioner concludes that the possible effects on the subject matter of undetected misstatements, if any, could be material, but not pervasive. AT-C Section 205.70 b.
    {are material} {are pervasive} The practitioner should express an adverse opinion when the practitioner, having obtained sufficient appropriate evidence, concludes that misstatements, individually or in the aggregate, are both material and pervasive to the subject matter. AT-C Section 205.72
    {attestation standards} The practitioner's report should include the following: A statement that those standards require that the practitioner plan and perform the review to obtain limited assurance about whether any material modifications should be made to the subject matter in order for it to be in accordance with (or based on) the criteria (or equivalent language regarding the subject matter and criteria, such as the language used in the examples in paragraph .A65) or AT-C Section 210.46 f.ii.(1)
    {be less than} The practitioner's report should include the following: A statement that a review is substantially less in scope than an examination, the objective of which is to obtain reasonable assurance about whether the subject matter is in accordance with (or based on) the criteria, in all material respects, or the responsible party's assertion is fairly stated, in all material respects, in order to express an opinion. Accordingly, the practitioner does not express such an opinion. AT-C Section 210.46 f.iii.
    {are pervasive} {not pervasive} The practitioner should express a qualified conclusion when the effects of a matter are material but not pervasive. A qualified conclusion is expressed as being "except for the effects" of the matter to which the qualification relates. When the effects of a matter are material and also pervasive, the practitioner should withdraw from the engagement, when withdrawal is possible under applicable laws and regulations. AT-C Section 210.53
    If the practitioner has concluded that the material misstatement results in a qualified conclusion, the practitioner should report directly on the subject matter, not on the assertion, even when the assertion acknowledges the misstatement. AT-C Section 210.54
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: A statement that identifies the practitioner's responsibility is to express an opinion on the prospective financial information, based on the practitioner's examination. AT-C Section 305.32 e.ii.
    {financial forecast} {financial projection} The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: The practitioner's opinion about whether the forecast (or projection) is presented, in all material respects, in accordance with the guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants, and whether the underlying assumptions are suitably supported and provide a reasonable basis for the forecast or a reasonable basis for the projection given the hypothetical assumptions. AT-C Section 305.32 h.
    {qualified opinion} The following are circumstances that require the practitioner to modify the opinion and the type of modified opinion the practitioner should express in each circumstance: If, in the practitioner's judgment, the prospective financial information materially departs from AICPA presentation guidelines, the practitioner should express a qualified or adverse opinion. AT-C Section 305.35 a.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: A statement that identifies the practitioner's responsibility to express an opinion on the pro forma financial information based on the practitioner's examination. AT-C Section 310.17 i.ii.
    The practitioner's review report on pro forma financial information should include the following: A statement that identifies the practitioner's responsibility to express a conclusion on the pro forma financial information based on the practitioner's review. AT-C Section 310.18 i.ii.
    The practitioner's review report on pro forma financial information should include the following: A statement that the practitioner believes that the practitioner's review provides a reasonable basis for the practitioner's conclusion. AT-C Section 310.18 j.iv.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. A statement that identifies the practitioner's responsibility to express an opinion on the entity's compliance with the specified requirements or on management's assertion about the entity's compliance with the specified requirements, based on the practitioner's examination. AT-C Section 315.20 e.ii.
    A service auditor's type 2 report should include the following: A statement that the service auditor is responsible for expressing an opinion on the fairness of the presentation of management's description of the service organization's system and on the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description based on the service auditor's examination. AT-C Section 320.40 g.
    A service auditor's type 2 report should include the following: A statement that the service auditor is responsible for expressing an opinion on the fairness of the presentation of management's description of the service organization's system and on the suitability of the design and operating effectiveness of the controls to achieve the related control objectives stated in the description based on the service auditor's examination. AT-C Section 320.40 g.
    {is appropriate} A service auditor's type 1 report should include the following: A statement that the service auditor believes the evidence obtained is sufficient and appropriate to provide a reasonable basis for the service auditor's opinion. AT-C Section 320.41 h.iii.
    When the opinion is modified, reference to an external specialist is permitted when such reference is relevant to an understanding of the modification to the practitioner's opinion. The practitioner should indicate in the practitioner's report that such reference does not reduce the practitioner's responsibility for that opinion. AT-C Section 205.81
    A service auditor's type 2 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion the controls related to the control objectives stated in management's description of the service organization's system were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively throughout the specified period. AT-C Section 320.40 l.ii.
    A service auditor's type 2 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion the controls operated effectively to provide reasonable assurance that the control objectives stated in management's description of the service organization's system were achieved throughout the specified period. AT-C Section 320.40 l.iii.
    A service auditor's type 1 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion the controls related to the control objectives stated in management's description of the service organization's system were suitably designed to provide reasonable assurance that the control objectives would be achieved if the controls operated effectively as of the specified date. AT-C Section 320.41 l.ii.]
    Establish/Maintain Documentation Preventive
    Include a description of the reasons for modifying the audit opinion in the audit report. CC ID 13898
    [When the practitioner modifies the opinion, the practitioner should include a separate paragraph in the practitioner's report that provides a description of the matter(s) giving rise to the modification. AT-C Section 205.69
    The practitioner should modify the opinion when either of the following circumstances exist and, in the practitioner's professional judgment, the effect of the matter is or may be material: The practitioner is unable to obtain sufficient appropriate evidence to conclude that the subject matter is in accordance with (or based on) the criteria, in all material respects. AT-C Section 205.68 a.
    When the practitioner qualifies the conclusion, the practitioner should include a separate paragraph in the practitioner's report that provides a description of the matter(s) giving rise to the qualification. AT-C Section 210.52
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion management's description of the service organization's system is not fairly presented, in all material respects; AT-C Section 320.42 a.
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion in the case of a type 2 report, the controls did not operate effectively throughout the specified period to achieve the related control objectives stated in management's description of the service organization's system, in all material respects; or AT-C Section 320.42 c.
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion the service auditor is unable to obtain sufficient appropriate evidence. AT-C Section 320.42 d.
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion the controls are not suitably designed to provide reasonable assurance that the control objectives stated in management's description of the service organization's system would be achieved if the controls operated effectively, in all material respects; AT-C Section 320.42 b.]
    Establish/Maintain Documentation Corrective
    Include that the auditor did not express an opinion in the audit report, as necessary. CC ID 13886
    [{audit opinion} When the practitioner disclaims an opinion due to an inability to obtain sufficient appropriate evidence, the practitioner's report should state that accordingly, the practitioner does not express an opinion on the subject matter. AT-C Section 205.75 b.
    {do not express} The practitioner's report should not express an opinion or conclusion about whether the subject matter is in accordance with (or based on) the criteria or whether the assertion is fairly stated, for example, the report should not state, "Nothing came to our attention that caused us to believe that the subject matter is not in accordance with (or based on) the criteria, in all material respects, or that the assertion is not fairly stated, in all material respects." AT-C Section 215.25
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or a conclusion, respectively, on whether the underlying assumptions are suitably supported, and AT-C Section 305.39 j.ii.(2)
    {financial forecast} {financial projection} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or a conclusion, respectively, on whether the underlying assumptions provide a reasonable basis for the forecast or a reasonable basis for the projection given the hypothetical assumptions. AT-C Section 305.39 j.ii.(3)
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the practitioner does not express such an opinion or conclusion. AT-C Section 305.39 j.iii.
    The practitioner's agreed-upon procedures report should include the following: A statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or conclusion, respectively, on the subject matter. AT-C Section 215.35 j.ii.
    The practitioner's agreed-upon procedures report should include the following: A statement that the practitioner does not express such an opinion or conclusion. AT-C Section 215.35 j.iii.
    The practitioner's agreed-upon procedures report on compliance should include the following: A statement that the practitioner does not express such an opinion or conclusion. AT-C Section 315.26 j.iii.
    {financial forecast} {financial projection} The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: A statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or a conclusion, respectively, on whether the presentation of the forecast (or projection) is in accordance with guidelines for the presentation of a forecast (or projection) established by the American Institute of Certified Public Accountants, AT-C Section 305.39 j.ii.(1)
    A service auditor's type 1 report should include the following: A statement the service auditor has not performed any procedures regarding the operating effectiveness of controls and, therefore, expresses no opinion thereon. AT-C Section 320.41 k.]
    Establish/Maintain Documentation Preventive
    Disclaim the audit opinion in the audit report, as necessary. CC ID 13901
    [{audit opinion} {examination engagement} If law or regulation does not allow the practitioner to withdraw from the engagement, the practitioner should disclaim an opinion. AT-C Section 205.83
    {be material} {be pervasive} {audit opinion} The practitioner should disclaim an opinion when the practitioner is unable to obtain sufficient appropriate evidence on which to base the opinion, and the practitioner concludes that the possible effects on the subject matter of undetected misstatements, if any, could be both material and pervasive. AT-C Section 205.74]
    Business Processes Corrective
    Collect all work papers for the audit and audit report into an engagement file. CC ID 07001
    [The practitioner should prepare engagement documentation that is sufficient to determine the results of the procedures performed and the evidence obtained. AT-C Section 205.87 b.
    The practitioner should assemble the engagement documentation in an engagement file and complete the administrative process of assembling the final engagement file no later than 60 days following the practitioner's report release date. AT-C Section 105.35
    The engagement partner should take responsibility for the overall quality on each attestation engagement. This includes responsibility for the following: Appropriate engagement documentation being maintained to provide evidence of achievement of the practitioner's objectives and that the engagement was performed in accordance with the attestation standards and relevant legal and regulatory requirements AT-C Section 105.33 d.
    The practitioner should prepare engagement documentation that is sufficient to determine the results of the procedures performed and the review evidence obtained. AT-C Section 210.62 b.
    The practitioner should prepare engagement documentation that is sufficient to determine the results of the procedures performed and the review evidence obtained. AT-C Section 210.62 b.
    The practitioner should prepare engagement documentation that is sufficient to determine the specified parties' agreement on the procedures. AT-C Section 215.43 a.
    The practitioner should prepare engagement documentation that is sufficient to determine the results of the procedures performed and the evidence obtained. AT-C Section 215.43 c.
    The practitioner should prepare engagement documentation that is sufficient to determine the results of the procedures performed and the evidence obtained. AT-C Section 215.43 c.]
    Actionable Reports or Measurements Preventive
    Include any subsequent events related to the audit assertion or audit subject matter in the work papers. CC ID 07177
    [The practitioner has no responsibility to perform any procedures regarding the subject matter or assertion after the date of the practitioner's report. Nevertheless, the practitioner should respond appropriately to facts that become known to the practitioner after the date of the report that, had they been known to the practitioner at that date, may have caused the practitioner to revise the report. AT-C Section 210.32
    When the engaging party is not the responsible party, the practitioner should request written representations from the engaging party, in addition to those requested from the responsible party, in the form of a letter addressed to the practitioner. The representations should state that the engaging party has disclosed to the practitioner all known events subsequent to the period (or point in time) of the subject matter being reported on that would have a material effect on the subject matter or assertion. AT-C Section 210.35 e.
    {attributed} {examination engagement} The procedures the practitioner should apply to the assumptions and pro forma adjustments for either an examination or a review engagement are as follows: Evaluate whether pro forma adjustments are included for all significant effects directly attributable to the transaction (or event). AT-C Section 310.13 d.
    {participants} {date} The practitioner should prepare engagement documentation that is sufficient to determine the nature, timing, and extent of the procedures performed to comply with relevant AT-C sections and applicable legal and regulatory requirements, including the discussions with the responsible party or others about findings or issues that, in the practitioner's professional judgment, are significant, including the nature of the significant findings or issues discussed, and when and with whom the discussions took place; AT-C Section 210.62 a.iii.]
    Audits and Risk Management Preventive
    Document any after the fact changes to the engagement file. CC ID 07002
    [If, in circumstances such as those described in paragraph .49, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the circumstances encountered; AT-C Section 205.89 a.
    If, in circumstances such as those described in paragraph .49, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document when and by whom the resulting changes to the documentation were made and reviewed. AT-C Section 205.89 c.
    {date} {person} If the practitioner finds it necessary to amend existing engagement documentation or add new engagement documentation after the documentation completion date, the practitioner should, regardless of the nature of the amendments or additions, document when, and by whom, they were made and reviewed. AT-C Section 105.37 b.
    If the practitioner finds it necessary to amend existing engagement documentation or add new engagement documentation after the documentation completion date, the practitioner should, regardless of the nature of the amendments or additions, document the specific reasons for making the amendments or additions and AT-C Section 105.37 a.
    If, in circumstances such as those described in paragraph .32, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document the circumstances encountered; AT-C Section 210.64 a.
    {person} If, in circumstances such as those described in paragraph .32, the practitioner performs new or additional procedures or draws new conclusions after the date of the practitioner's report, the practitioner should document when and by whom the resulting changes to the documentation were made and reviewed. AT-C Section 210.64 c.]
    Establish/Maintain Documentation Preventive
    Protect access to the engagement file and all associated audit documentation in compliance with Authority Documents the organization must follow. CC ID 07179
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Agree with the practitioner's specialist regarding the need for the practitioner's specialist to observe confidentiality requirements. AT-C Section 205.36 c.iv.
    Because engagement documentation often contains confidential information, the practitioner should adopt reasonable procedures to maintain the confidentiality of that information. AT-C Section 105.39
    The practitioner also should adopt reasonable procedures to prevent unauthorized access to engagement documentation. AT-C Section 105.40]
    Establish/Maintain Documentation Preventive
    Disclose work papers in the engagement file in compliance with legal requirements. CC ID 07180 Establish/Maintain Documentation Preventive
    Archive the engagement file and all work papers for the period prescribed by law or contract. CC ID 10038
    [Engagement documentation is the property of the practitioner, and some jurisdictions recognize this right of ownership in their statutes. The practitioner should adopt reasonable procedures to retain engagement documentation for a period of time sufficient to meet the needs of the practitioner and to satisfy any applicable legal or regulatory requirements for records retention. AT-C Section 105.38]
    Records Management Preventive
    Include items that were excluded from the audit report in the audit report. CC ID 07007
    [A service auditor's type 2 report should include the following: Identification of the following: Any information included in a document containing the report that is not covered by the report AT-C Section 320.40 c.iii.
    A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the carve-out method was used, a statement indicating that management's description of the service organization's system excludes the control objectives and related controls of the relevant subservice organizations AT-C Section 320.40 c.iv.(1)(a)
    A service auditor's type 1 report should include the following: Identification of the following: Any information included in a document containing the report that is not covered by the report. AT-C Section 320.41 c.iii.]
    Establish/Maintain Documentation Preventive
    Include the organization's privacy practices in the audit report. CC ID 07029 Establish/Maintain Documentation Preventive
    Include items that pertain to third parties in the audit report. CC ID 07008
    [In assessing the suitability of the criteria to evaluate whether management's description of the service organization's system is fairly presented, the service auditor should determine if the criteria include, at a minimum whether management's description of the service organization's system presents how the service organization's system was designed and implemented, including the following information about the service organization's system, if applicable: Services performed by a subservice organization, if any, including whether the carve- out method or the inclusive method has been used in relation to them. AT-C Section 320.15 a.vi.
    A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: AT-C Section 320.40 c.iv.
    A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: AT-C Section 320.40 c.iv.
    A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the inclusive method was used, a statement that management's description of the service organization's system includes the subservice organization's specified control objectives and related controls, and that the service auditor's procedures included procedures related to the subservice organization AT-C Section 320.40 c.iv.(2)
    A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the inclusive method was used, a statement that management's description of the service organization's system includes the subservice organization's specified control objectives and related controls, and that the service auditor's procedures included procedures related to the subservice organization AT-C Section 320.40 c.iv.(2)
    The practitioner's agreed-upon procedures report should include the following: When applicable, a description of the nature of the assistance provided by a practitioner's external specialist, as discussed in paragraphs .21–.22. AT-C Section 215.35 k.
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: AT-C Section 320.41 c.iv.
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the carve-out method was used, a statement indicating that the service auditor's procedures do not extend to such complementary subservice organization controls. AT-C Section 320.41 c.iv.(1)(c)
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the inclusive method was used, a statement that management's description of the service organization's system includes the subservice organization's specified control objectives and related controls, and that the service auditor's procedures included procedures related to the subservice organization. AT-C Section 320.41 c.iv.(2)
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the inclusive method was used, a statement that management's description of the service organization's system includes the subservice organization's specified control objectives and related controls, and that the service auditor's procedures included procedures related to the subservice organization. AT-C Section 320.41 c.iv.(2)
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the carve-out method was used, a statement indicating that management's description of the service organization's system excludes the control objectives and related controls of the relevant subservice organizations. AT-C Section 320.41 c.iv.(1)(a)]
    Establish/Maintain Documentation Preventive
    Refrain from including reference to procedures performed in previous attestation engagements in the audit report. CC ID 13970
    [{attestation engagement} If the practitioner concludes, based on the practitioner's professional judgment, that there is reasonable justification to change the terms of the engagement from the original level of service that the practitioner was engaged to perform to a lower level of service, for example, from an examination to a review, and if the practitioner complies with the AT-C sections applicable to the lower level of service, the practitioner should issue an appropriate practitioner's report on the lower level of service. The report should not include reference to (a) the original engagement, (b) any procedures that may have been performed, or (c) scope limitations that resulted in the changed engagement. AT-C Section 105.30]
    Establish/Maintain Documentation Preventive
    Include a statement in the audit report that no procedures were performed subsequent to the date of the practitioner's review report on pro forma financial information, as necessary. CC ID 13969
    [{not performed} If the practitioner provides written acknowledgment that the nonparticipant party has been added as a specified party, such written acknowledgment ordinarily should state that no procedures have been performed subsequent to the date of the practitioner's report. AT-C Section 215.40]
    Establish/Maintain Documentation Preventive
    Include any of the organization's use of compensating controls that were not audited in the audit report. CC ID 07009
    [A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the carve-out method was used, a statement indicating that the service auditor's procedures do not extend to such complementary subservice organization controls AT-C Section 320.40 c.iv.(1)(c)
    A service auditor's type 2 report should include the following: If management's description of the service organization's system refers to the need for complementary user entity controls, a statement that the service auditor has not evaluated the suitability of the design or operating effectiveness of complementary user entity controls, and that the control objectives stated in the description can be achieved only if complementary user entity controls are suitably designed and operating effectively, along with the controls at the service organization. AT-C Section 320.40 e.
    A service auditor's type 1 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the carve-out method was used, a statement indicating that certain control objectives specified by the service organization can be achieved only if complementary subservice organization controls assumed in the design of the service organization's controls are suitably designed and operating effectively. AT-C Section 320.41 c.iv.(1)(b)
    A service auditor's type 1 report should include the following: If management's description of the service organization's system refers to the need for complementary user entity controls, a statement that the service auditor has not evaluated the suitability of the design or operating effectiveness of complementary user entity controls, and that the control objectives stated in the description can be achieved only if complementary user entity controls are suitably designed and operating effectively, along with the controls at the service organization. AT-C Section 320.41 e.]
    Establish/Maintain Documentation Preventive
    Include whether the use of compensating controls are necessary in the audit report. CC ID 07020
    [A service auditor's type 2 report should include the following: Identification of the following: Any services performed by a subservice organization and whether the carve-out method or the inclusive method was used in relation to them. Depending on which method is used, the following should be included: If the carve-out method was used, a statement indicating that certain control objectives specified by the service organization can be achieved only if complementary subservice organization controls assumed in the design of the service organization's controls are suitably designed and operating effectively AT-C Section 320.40 c.iv.(1)(b)
    A service auditor's type 2 report should include the following: If management's description of the service organization's system refers to the need for complementary user entity controls, a statement that the service auditor has not evaluated the suitability of the design or operating effectiveness of complementary user entity controls, and that the control objectives stated in the description can be achieved only if complementary user entity controls are suitably designed and operating effectively, along with the controls at the service organization. AT-C Section 320.40 e.
    A service auditor's type 2 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion if the application of complementary user entity controls is necessary to achieve the related control objectives stated in management's description of the service organization's system, a statement to that effect. AT-C Section 320.40 l.iv.
    A service auditor's type 2 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion if the application of complementary subservice organization controls is necessary to achieve the related control objectives stated in management's description of the service organization's system, a statement to that effect. AT-C Section 320.40 l.v.
    A service auditor's type 1 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion if the application of complementary user entity controls is necessary to achieve the related control objectives stated in management's description of the service organization's system, a statement to that effect. AT-C Section 320.41 l.iii.
    A service auditor's type 1 report should include the following: The service auditor's opinion on whether, in all material respects, based on the criteria described in management's assertion if the application of complementary subservice organization controls is necessary to achieve the related control objectives stated in management's description of the service organization's system, a statement to that effect. AT-C Section 320.41 l.iv.
    The service auditor should obtain and read management's description of the service organization's system and should evaluate whether those aspects of the description that are included in the scope of the engagement are presented fairly, in all material respects, based on the criteria in management's assertion, including whether complementary user entity controls and complementary subservice organization controls, if any, are adequately described; and AT-C Section 320.25 c.
    A service auditor's type 1 report should include the following: If management's description of the service organization's system refers to the need for complementary user entity controls, a statement that the service auditor has not evaluated the suitability of the design or operating effectiveness of complementary user entity controls, and that the control objectives stated in the description can be achieved only if complementary user entity controls are suitably designed and operating effectively, along with the controls at the service organization. AT-C Section 320.41 e.]
    Establish/Maintain Documentation Preventive
    Include the pass or fail test status of all in scope controls in the audit report. CC ID 07016
    [{are not operating effectively} A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves assessing the risks that management's description of the service organization's system is not fairly presented and that the controls were not suitably designed or operating effectively to achieve the related control objectives. AT-C Section 320.40 i.ii.
    {are not operating effectively} A service auditor's type 2 report should include the following: A statement that an examination of management's description of a service organization's system and the suitability of the design and operating effectiveness of the service organization's controls to achieve the related control objectives stated in the description involves assessing the risks that management's description of the service organization's system is not fairly presented and that the controls were not suitably designed or operating effectively to achieve the related control objectives. AT-C Section 320.40 i.ii.]
    Establish/Maintain Documentation Preventive
    Include the process of using evidential matter to test in scope controls in the audit report. CC ID 07021
    [Irrespective of the assessed risks of material misstatement, the practitioner should design and perform tests of details or analytical procedures related to the subject matter, except when the subject matter is internal control. AT-C Section 205.26
    {financial forecast} {financial projection} The practitioner should perform those procedures the practitioner considers necessary in the circumstances to report on whether the assumptions underlying the forecast are suitably supported and provide a reasonable basis for the forecast, or whether the assumptions underlying the projection are suitably supported and provide a reasonable basis for the projection, given the hypothetical assumptions. AT-C Section 305.22
    {attestation standards} The practitioner's report should include the following: A statement that those standards require that the practitioner plan and perform the review to obtain limited assurance about whether any material modifications should be made to the responsible party's assertion in order for it to be fairly stated. AT-C Section 210.46 f.ii.(2)
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes any identified deviations in the operation of controls included in the description, the extent of testing performed by the service auditor that led to the identification of the deviations (including the number of items tested), and the number and nature of the deviations noted (even if, on the basis of tests performed, the service auditor concludes that the related control objective was achieved). AT-C Section 320.40 k.iv.]
    Establish/Maintain Documentation Preventive
    Include the nature and causes of identified in scope control deviations in the audit report. CC ID 07022
    [A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes any identified deviations in the operation of controls included in the description, the extent of testing performed by the service auditor that led to the identification of the deviations (including the number of items tested), and the number and nature of the deviations noted (even if, on the basis of tests performed, the service auditor concludes that the related control objective was achieved). AT-C Section 320.40 k.iv.
    A service auditor's type 2 report should include the following: A reference to a description of the service auditor's tests of controls and the results thereof that includes any identified deviations in the operation of controls included in the description, the extent of testing performed by the service auditor that led to the identification of the deviations (including the number of items tested), and the number and nature of the deviations noted (even if, on the basis of tests performed, the service auditor concludes that the related control objective was achieved). AT-C Section 320.40 k.iv.
    If the service auditor plans to disclaim an opinion because of the inability to obtain sufficient appropriate evidence, and, based on the limited procedures performed, has concluded that, in all material respects, based on the criteria in management's assertion a. certain aspects of management's description of the service organization's system are not fairly presented, b. certain controls were not suitably designed to provide reasonable assurance that the control objectives stated in management's description of the service organization's system would be achieved if the controls operated effectively, or c. in the case of a type 2 report, certain controls did not operate effectively throughout the specified period to achieve the related control objectives stated in management's description of the service organization's system, then the service auditor should identify these findings in the service auditor's report. AT-C Section 320.43 ¶ 2]
    Establish/Maintain Documentation Preventive
    Modify the audit opinion in the audit report under defined conditions. CC ID 13937
    [{audit opinion} The practitioner should modify the opinion when either of the following circumstances exist and, in the practitioner's professional judgment, the effect of the matter is or may be material: The practitioner concludes, based on evidence obtained, that the subject matter is not in accordance with (or based on) the criteria, in all material respects. AT-C Section 205.68 b.
    {practitioner's opinion} If the practitioner determines that there is material noncompliance, the practitioner's report should describe the material noncompliance, and the opinion should be modified in accordance with section 205. AT-C Section 315.22
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion management's description of the service organization's system is not fairly presented, in all material respects; AT-C Section 320.42 a.
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion in the case of a type 2 report, the controls did not operate effectively throughout the specified period to achieve the related control objectives stated in management's description of the service organization's system, in all material respects; or AT-C Section 320.42 c.
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion the service auditor is unable to obtain sufficient appropriate evidence. AT-C Section 320.42 d.
    The service auditor's opinion should be modified, and the service auditor's report should contain a clear description of all the reasons for the modification, if the service auditor concludes that, based on the criteria in management's assertion the controls are not suitably designed to provide reasonable assurance that the control objectives stated in management's description of the service organization's system would be achieved if the controls operated effectively, in all material respects; AT-C Section 320.42 b.]
    Establish/Maintain Documentation Corrective
    Disclose any audit irregularities in the audit report. CC ID 06995
    [If the practitioner identified information that is inconsistent with the practitioner's final conclusion regarding a significant finding or issue, the practitioner should document how the practitioner addressed the inconsistency. AT-C Section 205.88
    {is aware} If the practitioner expresses a modified opinion because of a scope limitation but is also aware of a matter(s) that causes the subject matter to be materially misstated, the practitioner should include in the practitioner's report a clear description of both the scope limitation and the matter(s) that causes the subject matter to be materially misstated. AT-C Section 205.78
    If the practitioner identified information that is inconsistent with the practitioner's final conclusion regarding a significant finding or issue, the practitioner should document how the practitioner addressed the inconsistency. AT-C Section 210.63
    Although the practitioner need not perform procedures beyond the agreed-upon procedures, if in connection with the application, and through the completion of, the agreed-upon procedures engagement, matters come to the practitioner's attention by other means that significantly contradict the subject matter or assertion referred to in the practitioner's report, the practitioner should include this matter in the practitioner's report. AT-C Section 215.41
    {type 1 report} In performing subsequent events procedures as required by section 205, if the service auditor becomes aware of an event that is of such a nature and significance that its disclosure is necessary to prevent users of a type 1 or type 2 report from being misled, and information about that event is not disclosed by management in its description, the service auditor should disclose such event in the service auditor's report. AT-C Section 320.35
    {practitioner's opinion} If the practitioner determines that there is material noncompliance, the practitioner's report should describe the material noncompliance, and the opinion should be modified in accordance with section 205. AT-C Section 315.22
    The practitioner's agreed-upon procedures report on compliance should include the following: A statement that the practitioner was not engaged to and did not conduct an examination or review, the objective of which would be the expression of an opinion or conclusion, respectively, on compliance with specified requirements (or internal control over compliance with specified requirements). AT-C Section 315.26 j.ii.]
    Actionable Reports or Measurements Preventive
    Include the written signature of the auditor's organization in the audit report. CC ID 13897
    [The practitioner's report should include the following: The manual or printed signature of the practitioner's firm. AT-C Section 210.46 i.
    The practitioner's agreed-upon procedures report should include the following: The manual or printed signature of the practitioner's firm. AT-C Section 215.35 o.
    The practitioner's examination report on prospective financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .32f, and .32g should be omitted: The manual or printed signature of the practitioner's firm. AT-C Section 305.32 k.
    The practitioner's report should include the following, unless the practitioner is disclaiming an opinion, in which case, items .63f, and .63g should be omitted: The manual or printed signature of the practitioner's firm. AT-C Section 205.63 j.
    The practitioner's report on the application of agreed-upon procedures to a forecast or projection should include the following: The manual or printed signature of the practitioner's firm. AT-C Section 305.39 q.
    The practitioner's review report on pro forma financial information should include the following: The manual or printed signature of the practitioner's firm. AT-C Section 310.18 n.
    The practitioner's examination report on compliance should include the following, unless the practitioner is disclaiming an opinion, in which case, items .20g and .20h should be omitted. The manual or printed signature of the practitioner's firm. AT-C Section 315.20 l.
    The practitioner's agreed-upon procedures report on compliance should include the following: The manual or printed signature of the practitioner's firm. AT-C Section 315.26 o.
    A service auditor's type 2 report should include the following: The manual or printed signature of the service auditor's firm. AT-C Section 320.40 n.
    A service auditor's type 1 report should include the following: The manual or printed signature of the service auditor's firm. AT-C Section 320.41 n.
    The practitioner's examination report on pro forma financial information should include the following, unless the practitioner is disclaiming an opinion, in which case, items .17j and .17k should be omitted: The manual or printed signature of the practitioner's firm. AT-C Section 310.17 n.]
    Establish/Maintain Documentation Preventive
    Disseminate and communicate the audit report to all interested personnel and affected parties identified in the distribution list. CC ID 07117
    [In the following circumstances, the practitioner's report should include an alert, in a separate paragraph, that restricts the use of the report: The criteria used to evaluate the subject matter are available only to specified parties. AT-C Section 210.47 b.]
    Establish/Maintain Documentation Preventive
    Disseminate and communicate to the organization that access and use of audit reports are based on least privilege. CC ID 07171 Behavior Preventive
    Disseminate and communicate documents that contain information in support of the audit report. CC ID 07175
    [{examination engagement} {audit terms} Although an engagement may recur, each engagement is considered a separate engagement. The practitioner should assess whether circumstances require revision to the terms of a preceding engagement. If the practitioner concludes that the terms of the preceding engagement need not be revised for the current engagement, the practitioner should remind the engaging party of the terms of the current engagement, and the reminder should be documented. AT-C Section 205.09
    Although an engagement may recur, each engagement is considered a separate engagement. The practitioner should assess whether circumstances require revision to the terms of a preceding engagement. If the practitioner concludes that the terms of the preceding engagement need not be revised for the current engagement, the practitioner should remind the engaging party of the terms of the current engagement, and the reminder should be documented. AT-C Section 210.10]
    Establish/Maintain Documentation Preventive
    Correct any material misstatements in documents that contain information in support of the audit report. CC ID 07176
    [{qualified opinion} {is appropriate} When the practitioner expresses a qualified or an adverse opinion, the practitioner should amend the description of the practitioner's responsibility to state that the practitioner believes that the evidence the practitioner has obtained is sufficient and appropriate to provide a basis for the practitioner's modified opinion. AT-C Section 205.76
    When the practitioner disclaims an opinion due to an inability to obtain sufficient appropriate evidence, the practitioner should amend the practitioner's report to state that the practitioner was engaged to examine the subject matter (or assertion). The practitioner should also amend the description of the practitioner's responsibility and the description of an examination to state only the following: "Our responsibility is to express an opinion on the subject matter (or assertion) based on conducting the examination in accordance with attestation standards established by the American Institute of Certified Public Accountants. Because of the limitation on the scope of our examination discussed in the preceding paragraph, the scope of our work was not sufficient to enable us to express, and we do not express, an opinion on whether the subject matter is in accordance with (or based on) the criteria, in all material respects." AT-C Section 205.77
    {examination engagement} The practitioner should communicate to the responsible party known and suspected fraud and noncompliance with laws or regulations, uncorrected misstatements, and, when relevant to the subject matter, internal control deficiencies identified during the engagement. When the engaging party is not the responsible party, the practitioner should also communicate this information to the engaging party. AT-C Section 205.85
    The practitioner should inquire whether the responsible party, and if different, the engaging party, is aware of any events subsequent to the period (or point in time) covered by the review engagement up to the date of the practitioner's report that could have a significant effect on the subject matter or assertion. If the practitioner becomes aware, through inquiry or otherwise, of such an event, or any other event that is of such a nature and significance that its disclosure is necessary to prevent users of the report from being misled, and information about that event is not adequately disclosed by the responsible party in the subject matter or in its assertion, the practitioner should take appropriate action. AT-C Section 210.31
    The practitioner should conclude whether the prospective financial information, including related disclosures, should be revised because of any of the following: AT-C Section 305.27
    As required by paragraphs .25–.39 of this section and section 205, the service auditor should design and implement overall responses to address the assessed risks of material misstatement for the subject matter and AT-C Section 320.24 a.]
    Establish/Maintain Documentation Preventive
    Submit an audit report that is complete. CC ID 01145
    [{audit report} The engagement partner should be satisfied that the engagement team, and any practitioner's external specialists, collectively, have the appropriate competence, including knowledge of the subject matter, and capabilities to enable the issuance of a practitioner's report that is appropriate in the circumstances. AT-C Section 105.32 a.ii.]
    Testing Detective
    Accept the audit report. CC ID 07025 Establish/Maintain Documentation Preventive
    Implement a corrective action plan in response to the audit report. CC ID 06777
    [The practitioner should design and implement overall responses to address the assessed risks of material misstatement for the subject matter or assertion. AT-C Section 205.20]
    Establish/Maintain Documentation Corrective
    Assign responsibility for remediation actions, as necessary. CC ID 13622 Human Resources Management Preventive
    Review management's response to issues raised in past audit reports. CC ID 01149 Audits and Risk Management Detective
    Define penalties for uncorrected audit findings or remaining non-compliant with the audit report. CC ID 08963 Establish/Maintain Documentation Preventive
    Take appropriate action to correct deficiencies identified in the audit report. CC ID 01177 Testing Detective
    Assess the quality of the audit program in regards to the staff and their qualifications. CC ID 01150
    [When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Evaluate whether the practitioner's specialist has the necessary competence, capabilities, and objectivity for the practitioner's purposes. In the case of a practitioner's external specialist, the evaluation of objectivity should include inquiry regarding interests and relationships that may create a threat to the objectivity of the practitioner's specialist. AT-C Section 205.36 a.
    When the practitioner expects to use the work of a practitioner's specialist, the practitioner should do the following: Obtain a sufficient understanding of the field of expertise of a practitioner's specialist to enable the practitioner to determine the nature, scope, and objectives of that specialist's work for the practitioner's purposes and AT-C Section 205.36 b.i.
    When the practitioner expects to use the work of the internal audit function in obtaining evidence or to use internal auditors to provide direct assistance, the practitioner should determine whether the work can be used for purposes of the examination by evaluating the level of competence of the internal audit function or the individual internal auditors providing direct assistance; AT-C Section 205.39 a.
    {quality control procedures} The nature, timing, and extent of the procedures a practitioner performs when the practitioner expects to use the work of a practitioner's specialist will vary depending on the circumstances. In determining the nature, timing, and extent of those procedures, the practitioner should consider the following: Whether that specialist is subject to the practitioner's firm's quality control policies and procedures AT-C Section 205.38 e.
    When the practitioner expects to use the work of the internal audit function in obtaining evidence or to use internal auditors to provide direct assistance, the practitioner should determine whether the work can be used for purposes of the examination by evaluating the extent to which the internal audit function's organizational status and relevant policies and procedures support the objectivity of the internal audit function or for internal auditors providing direct assistance, the existence of threats to the objectivity of those internal auditors and the related safeguards applied to reduce or eliminate those threats; and AT-C Section 205.39 b.
    When the practitioner expects to use the work of an other practitioner, the practitioner should obtain an understanding of the other practitioner's professional competence. AT-C Section 105.31 b.
    {attestation engagement} The engagement partner should be satisfied that the engagement team, and any practitioner's external specialists, collectively, have the appropriate competence, including knowledge of the subject matter, and capabilities to perform the engagement in accordance with professional standards and applicable legal and regulatory requirements and AT-C Section 105.32 a.i.
    The practitioner should consider the reasonableness and consistency of the responsible party's responses in light of the results of other review procedures and the practitioner's knowledge of the subject matter, criteria, and responsible party. AT-C Section 210.22
    {persons} When written representations are directly related to matters that are material to the subject matter, the practitioner should consider whether those making the representations can be expected to be well informed on the particular matters. AT-C Section 210.36 b.