Other Assurance Services and the Future of Audit

Introduction

Auditing is no longer confined to expressing an opinion on historical financial statements. Organisations increasingly need credible information about internal controls, regulatory compliance, cybersecurity, sustainability, performance, risk management and governance. This expansion has created a range of assurance and related services, each with a different objective, level of evidence, reporting form and degree of confidence.

A central professional principle is that the service must be defined before evidence is collected. A financial statement audit, a review, an agreed-upon procedures engagement, an internal audit assignment and a forensic investigation are not interchangeable. Users can make poor decisions when a report is described as “assurance” without explaining what was tested, against which criteria, and with what level of confidence.

The future of audit will be shaped by sustainability reporting, integrated reporting, artificial intelligence, continuous monitoring, blockchain-based records, regulatory change and changing expectations of professional competence. These developments create opportunities, but they do not eliminate the need for professional scepticism, ethical judgement and accountability.

Learning Objectives

By the end of this chapter, a student should be able to:

1. Distinguish reasonable assurance, limited assurance and related services.
2. Compare reviews, agreed-upon procedures, internal audit, public-sector audit and forensic audit.
3. Explain assurance over sustainability and ESG information and its relationship with integrated reporting.
4. Evaluate continuous auditing, data analytics, artificial intelligence and blockchain in audit practice.
5. Discuss regulatory developments, independence risks and future auditor competencies.
6. Apply an appropriate engagement design to a practical organisational problem.

1. The Assurance Landscape

An assurance engagement is a professional engagement in which a practitioner obtains sufficient appropriate evidence to express a conclusion intended to enhance the confidence of intended users in information measured or evaluated against suitable criteria. The information may be financial or non-financial. The criteria may include accounting standards, laws, contractual requirements, control frameworks, sustainability standards or internally approved policies.

Assurance is therefore best understood as a professional process that reduces information risk through evidence, evaluation and communication. It is not a measurable probability and should not be represented by subtracting “residual risk” from one. The amount of confidence communicated depends on the engagement’s objective, procedures, evidence, materiality, inherent limitations and reporting form.

The principal elements are:

• Three-party relationship: a responsible party prepares or presents the subject matter, a practitioner evaluates it, and intended users rely on the report.
• Subject matter: for example, financial statements, greenhouse-gas emissions, internal controls or compliance.
• Suitable criteria: benchmarks that are relevant, complete, reliable, neutral, understandable and available to intended users.
• Evidence: information supporting the practitioner’s evaluation.
• Written report: a conclusion or findings communicated in an appropriate form.

Levels of assurance

Reasonable assurance is a high, but not absolute, level of assurance. The practitioner performs risk assessment and substantive and control procedures sufficient to support a positive-form conclusion, such as: “In our opinion, the financial statements present fairly…” Absolute assurance is generally unattainable because of sampling, judgement, persuasive rather than conclusive evidence, time constraints, management estimates and the possibility of concealed fraud.

Limited assurance is a lower level than reasonable assurance. Procedures are less extensive, often involving inquiry and analytical procedures, although other procedures may be necessary. The conclusion is expressed in negative form, such as: “Nothing has come to our attention that causes us to believe…” Limited assurance does not mean no assurance.

The difference is not simply the number of procedures. The practitioner designs procedures to achieve the intended level of confidence, considering the risk of a materially misleading conclusion and the quality of available evidence.

2. Reviews and Agreed-Upon Procedures

Review engagements

A review of historical financial statements provides limited assurance. The practitioner normally performs inquiries of management and analytical procedures, considers unusual relationships and obtains representations. A review generally does not involve the same extensive testing of controls, confirmation, physical inspection and detailed substantive procedures expected in an audit.

A review report commonly uses a negative-form conclusion. It is appropriate where users need more credibility than unaudited information but do not require the cost and depth of a reasonable-assurance audit. It may be useful for interim financial statements, smaller entities or lender monitoring, subject to applicable law and contractual requirements.

A review has limitations. Analytical procedures may not detect an isolated misstatement, and management inquiry may not reveal fraud or intentional concealment. Users should not interpret a clean review conclusion as equivalent to an unmodified audit opinion.

Agreed-upon procedures

An agreed-upon procedures (AUP) engagement is a related service, not an assurance engagement under IAASB terminology. The engaging party and other specified users agree with the practitioner on procedures to be performed. The practitioner reports factual findings, such as the number of invoices inspected, exceptions identified or reconciliations recomputed.

The practitioner does not provide an assurance conclusion. Users evaluate the findings themselves and draw their own conclusions. AUP engagements can be efficient where users know precisely what evidence they need—for example, verifying selected grant expenditures or testing compliance with specified contractual clauses.

AUP quality depends on clearly defined procedures. “Review the payroll” is vague; “agree the gross pay on 30 specified employees to approved payroll records and report exceptions” is more reproducible. The report should identify the subject matter, criteria or procedures, responsible parties, restrictions on use and the fact that no assurance conclusion is expressed.

3. Internal Audit

Internal audit is an independent and objective assurance and consulting function designed to add value and improve an organisation’s operations. It evaluates governance, risk management and control processes and may review financial, operational, compliance, information-technology and strategic risks.

Internal audit differs from external audit in purpose and accountability. External auditors primarily report to shareholders or other external users on financial statements or other specified information. Internal auditors serve the organisation while retaining objectivity.

Independence and reporting

The chief audit executive should have functional reporting to the board or audit committee. Functional reporting commonly includes approval of the internal audit charter, risk-based plan, budget, appointment or removal of the chief audit executive, performance evaluation, significant findings and unrestricted access to the board or audit committee. Administrative reporting—such as day-to-day scheduling, facilities and payroll—may be to the chief executive or another senior manager, but it must not compromise objectivity.

Internal auditors should not assume operational responsibility for activities they later audit. If they design a control, approve transactions or manage a risk process, a self-review threat arises. Safeguards include independent review, reassignment of responsibility and transparent disclosure.

A risk-based internal audit cycle normally includes understanding organisational objectives, identifying and assessing risks, preparing a board-approved plan, performing engagements, communicating findings and following up remediation. Internal audit may use control self-assessment, data analytics, thematic reviews and advisory work, but advisory work should not become management decision-making.

4. Public-Sector Audit

Public-sector audit serves citizens, legislatures, public bodies, service users and other stakeholders. It commonly includes three complementary forms:

• Financial audit: whether public financial statements are fairly presented.
• Compliance audit: whether activities comply with laws, regulations, appropriations, policies and contractual conditions.
• Performance audit: whether programmes demonstrate economy, efficiency and effectiveness.

Performance audit is often described through the “three Es.” Economy concerns acquiring resources at an appropriate cost and quality; efficiency concerns the relationship between inputs and outputs; effectiveness concerns achievement of intended outcomes. These concepts must be applied carefully. A low-cost programme is not necessarily economical if quality is poor, and high output does not prove social effectiveness.

Public-sector auditors face distinctive issues: political accountability, public money, procurement risk, complex programmes, privacy, service equity and pressure from elected officials. Independence is essential. Audit findings should be evidence-based, fair to audited entities and sufficiently clear for legislative and public scrutiny.

5. Forensic Audit and Investigation

Forensic audit applies accounting, auditing, investigation and analytical skills to disputes, suspected fraud or legal proceedings. Its objectives may include identifying schemes, quantifying losses, tracing assets, analysing digital and financial evidence, and presenting findings in a form suitable for court or settlement.

A forensic engagement is not automatically an assurance engagement. Its objective and reporting requirements depend on the assignment. The practitioner must preserve evidence integrity, document chain of custody, distinguish facts from assumptions and avoid advocacy that compromises objectivity.

Fraud examination often follows a fraud triangle model: pressure or incentive, opportunity, and rationalisation. The model helps organise risk assessment but does not prove that fraud occurred. Data analytics can identify duplicate payments, unusual timing, round-dollar transactions, split purchases and conflicts of interest; each indicator requires corroboration.

Forensic conclusions should be proportionate to the evidence. A pattern may justify further investigation but may not establish intent. Legal conclusions should generally be left to the court or legal advisers unless the practitioner is specifically qualified and authorised to provide them.

6. Sustainability, ESG and Integrated Reporting

Environmental, social and governance (ESG) information includes matters such as greenhouse-gas emissions, energy use, biodiversity, workforce safety, diversity, human rights, supply-chain practices, board oversight and anti-corruption controls. Sustainability information may be quantitative, qualitative, historical, forward-looking or based on estimates.

Assurance over ESG information requires the practitioner to assess:

1. Whether the reporting criteria are suitable and consistently applied.
2. Whether organisational boundaries and value-chain boundaries are clear.
3. Whether data definitions, estimates and calculation methods are documented.
4. Whether controls over data capture, aggregation and reporting operate effectively.
5. Whether omissions, selective presentation and greenwashing risks are addressed.

For emissions information, for example, the practitioner may test source data, activity records, emission factors, consolidation and management review. The evidence challenge is often greater than in financial reporting because systems may be immature and estimates may involve suppliers or other value-chain participants.

Sustainability assurance may be limited or reasonable, depending on regulation, stakeholder needs and the maturity of evidence. The report should identify the subject matter, criteria, level of assurance, practitioner responsibilities, inherent limitations and conclusion.

Integrated reporting

Integrated reporting connects financial performance with strategy, governance, risks, opportunities and the organisation’s use of resources and relationships. It encourages a broader explanation of how value is created, preserved or diminished over time. The commonly discussed capitals include financial, manufactured, intellectual, human, social and relationship, and natural capital.

Integrated reporting is not simply a longer annual report. It requires connectivity: strategy should relate to risks, resources, performance measures and future outlook. Assurance may cover selected metrics, controls or the whole report, but practitioners must define the subject matter carefully. Narrative claims, forecasts and causal assertions require different evidence from historical numerical data.

7. Continuous Auditing and Data Analytics

Continuous auditing uses technology-enabled procedures to provide audit evidence or conclusions closer to the time transactions occur. Continuous monitoring is primarily a management responsibility; continuous auditing is an independent assurance activity. The two may use similar data but have different accountability.

A continuous audit system may:

1. Extract transactions and master data from source systems.
2. Apply rules, statistical tests or machine-learning models.
3. Rank exceptions according to risk.
4. Investigate and corroborate selected exceptions.
5. Record conclusions and communicate matters to management and the audit committee.

Analytics can improve population coverage, but testing every transaction does not automatically produce sufficient appropriate evidence. Data may be incomplete, duplicated, incorrectly mapped or altered. The auditor must test data completeness and accuracy, validate algorithms, understand false positives and false negatives, and retain an auditable record of procedures.

Artificial intelligence can assist classification, anomaly detection, document review and risk prediction. It cannot transfer accountability away from the auditor. Key risks include automation bias, opaque models, biased training data, confidentiality breaches and fabricated outputs. Human review, model governance, access controls and reproducibility are essential.

8. Blockchain and Audit Evidence

Blockchain is a distributed ledger in which transactions are recorded through a consensus process and linked cryptographically. It can improve traceability and reduce certain forms of unauthorised alteration, but it does not guarantee that an original input was valid. The “garbage in, garbage out” problem remains.

Auditors must consider whether the ledger is permissioned or public, who controls participation, how private keys are protected, how consensus operates, how corrections are made and whether smart contracts function as intended. Evidence from a blockchain may support existence and sequence assertions, but ownership, valuation, rights and obligations may require off-chain evidence.

Blockchain may reduce some reconciliation work while increasing the importance of IT general controls, access management, oracle reliability and cybersecurity. Immutability is not the same as accuracy, legality or completeness.

9. Regulation, Ethics and the Future Profession

Regulatory developments increasingly address sustainability disclosures, climate-related risk, audit quality management, auditor independence, data protection and technology governance. Requirements differ across jurisdictions, so practitioners must consult applicable legislation, professional standards, stock-exchange rules and regulator guidance.

The fundamental ethical principles remain integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour. Common threats include self-interest, self-review, advocacy, familiarity and intimidation. Safeguards may include independent review, rotation, restricted services, separation of teams, disclosure and withdrawal from the engagement.

Future auditors require a blended capability profile:

• strong accounting and auditing foundations;
• knowledge of sustainability and sector-specific risks;
• data literacy, statistics and technology controls;
• cybersecurity and privacy awareness;
• critical thinking and professional scepticism;
• communication with boards and non-specialist users;
• investigation and interviewing skills;
• ethical judgement and independence;
• lifelong learning and adaptability.

Technology changes the distribution of work rather than removing the need for auditors. Routine extraction and matching may be automated, while judgement about relevance, reliability, materiality, bias, causation and accountability becomes more important.

Applied Case: Meridian Foods’ ESG and Control Assurance

Background

Meridian Foods, a fictional listed food producer, publishes financial statements and a sustainability report. The report claims a 20% reduction in emissions, zero serious worker injuries and responsible sourcing from suppliers. The board asks the audit committee whether a reasonable-assurance audit, limited assurance, agreed-upon procedures or internal audit work is most appropriate.

Problem

The emissions data come from invoices and factory meters, but two factories changed measurement systems during the year. Supplier labour information is based on questionnaires, and injury data are maintained by the human-resources department. Management proposes an AUP engagement limited to confirming selected figures.

Analysis

The objective is broader than checking a sample of invoices. Investors need a conclusion on whether reported information is prepared in accordance with identified criteria. An AUP engagement could report factual findings on selected invoices, but it would not provide an assurance conclusion. A limited-assurance engagement may be appropriate initially because controls and evidence are developing; reasonable assurance could be considered after systems mature.

Internal audit should independently evaluate data governance, access rights, meter controls, supplier-data processes and management review. Its functional reporting should remain with the audit committee. The external practitioner should assess criteria, boundaries, completeness, measurement methods, estimates and evidence from suppliers.

Approach and outcome

The audit committee commissions limited assurance over specified ESG indicators and asks internal audit to review the control environment. Procedures include walkthroughs, testing source records, reconciling factory data, evaluating system changes, testing selected supplier evidence and reviewing injury-reporting controls. The report clearly identifies the indicators and limitations. Internal audit reports control weaknesses and remediation responsibilities to management and the audit committee.

The practitioner identifies insufficient evidence for one supplier-related claim and a need to disclose estimation uncertainty. Meridian revises the report, narrows one claim and implements stronger data ownership and review controls. The outcome is more credible than an AUP report that might have been misunderstood as assurance.

Learning points

1. Engagement form must match user needs and evidence maturity.
2. AUP findings are not an assurance conclusion.
3. ESG assurance requires criteria, boundaries and data governance.
4. Internal audit supports improvement but must preserve functional independence.
5. A transparent limitation is preferable to an overstated claim.

Challenges and Best Practices

Major challenges include expectation gaps, inconsistent ESG criteria, weak non-financial controls, cyber threats, complex supply chains, management bias, algorithmic opacity and pressure to provide assurance over information that is not yet auditable.

Best practice is to define the intended users and decision before accepting the engagement; specify subject matter and criteria; assess competence and independence; document risk and materiality judgements; test data lineage; use specialists when necessary; explain limitations plainly; protect confidential information; and maintain board-level oversight of significant findings.

A sound engagement is not the one with the most technology or the longest report. It is the one whose objective, evidence, procedures, conclusion and user expectations are aligned.

Chapter Summary

Assurance services differ in objective, evidence and reporting. Audits provide reasonable assurance and a positive-form opinion; reviews provide limited assurance and a negative-form conclusion; agreed-upon procedures are related services that report factual findings without expressing assurance. Internal audit evaluates governance, risk and controls and should have functional reporting to the board or audit committee. Public-sector audit includes financial, compliance and performance dimensions, while forensic work addresses suspected fraud, disputes and evidence suitable for legal contexts.

Sustainability and ESG assurance require clear criteria, boundaries, controls and reliable data. Integrated reporting connects financial and non-financial matters but does not automatically make every narrative claim auditable. Continuous auditing, analytics, AI and blockchain can improve timeliness and coverage, but they introduce data, model, cybersecurity and governance risks. The future auditor must combine technical accounting knowledge with technology, sustainability, communication, investigation and ethical judgement.

Key Terms

Assurance engagement: An engagement in which a practitioner evaluates subject matter against suitable criteria and expresses a conclusion.

Reasonable assurance: A high, but not absolute, level of assurance.

Limited assurance: A lower level of assurance than reasonable assurance, normally reported in negative form.

Agreed-upon procedures: A related service reporting factual findings from procedures agreed with specified users.

Review engagement: A limited-assurance engagement commonly involving inquiry and analytical procedures.

Internal audit: An independent, objective function that evaluates and improves governance, risk management and controls.

Functional reporting: Reporting by the chief audit executive to the board or audit committee on mandate, plan, resources and findings.

Public-sector audit: Audit of public resources, programmes, compliance and performance.

Performance audit: Evaluation of economy, efficiency and effectiveness.

Forensic audit: Investigative accounting and auditing applied to suspected fraud, disputes or legal matters.

ESG: Environmental, social and governance information and risks.

Sustainability assurance: Assurance over specified sustainability information against identified criteria.

Integrated reporting: Reporting that connects strategy, governance, performance, risks and resources over time.

Continuous auditing: Technology-enabled audit work performed closer to the time transactions occur.

Continuous monitoring: Management’s ongoing oversight of controls and performance.

Data lineage: The traceable path of data from origin through processing to reported information.

Blockchain: A distributed ledger that records linked transactions through a consensus process.

Professional scepticism: An alert and questioning mind that critically evaluates evidence.

Materiality: The significance of information or misstatement in influencing users’ decisions.

Greenwashing: Misleading presentation of environmental or sustainability performance.

Review Questions

Short Answer Questions

1. Why is assurance not appropriately expressed as a numerical subtraction from residual risk?
2. What is the principal reporting difference between a review and an audit?
3. Why are agreed-upon procedures not assurance engagements under IAASB terminology?
4. What does functional reporting of internal audit to the audit committee involve?
5. Why does blockchain not guarantee the truth of every recorded transaction?

Long Answer Questions

1. Compare audit, review and agreed-upon procedures in terms of objective, evidence and reporting.
2. Explain the independence, responsibilities and organisational position of internal audit.
3. Discuss the distinctive purposes and challenges of financial, compliance and performance audits in the public sector.
4. Explain the evidence and governance challenges involved in ESG assurance.
5. Evaluate how artificial intelligence and continuous auditing may change auditor work and accountability.

Analytical / Application Questions

1. A lender wants factual confirmation that 40 specified loan covenants were recalculated, while a regulator wants a conclusion on overall compliance. Recommend suitable engagements and explain why.
2. A company reports a major emissions reduction after replacing its factory measurement systems. Design procedures for a limited-assurance engagement and identify likely evidence limitations.
3. An internal audit director reports administratively to the chief financial officer, who controls the audit budget and asks internal audit to omit a procurement finding. Analyse the threats and recommend governance safeguards.

Multiple Choice Questions with Answers

Question 1

Which statement correctly describes an agreed-upon procedures engagement?

A. It provides reasonable assurance through a positive-form opinion.

B. It provides limited assurance through a negative-form conclusion.

C. It reports factual findings without expressing an assurance conclusion.

D. It is identical to an internal audit engagement.

Correct Answer: C. It reports factual findings without expressing an assurance conclusion.

Question 2

Who should normally receive the functional reporting of the chief audit executive?

A. The procurement manager

B. The board or audit committee

C. The external auditor’s audit assistant

D. The payroll supervisor

Correct Answer: B. The board or audit committee

Question 3

Which conclusion is characteristic of limited assurance?

A. In our opinion, the information is fairly presented.

B. Nothing has come to our attention that causes us to believe the information is materially misstated.

C. The information is guaranteed to be accurate.

D. The procedures found exactly no exceptions in the population.

Correct Answer: B. Nothing has come to our attention that causes us to believe the information is materially misstated.

Question 4

Which of the following is a performance-audit criterion?

A. Economy, efficiency and effectiveness

B. Share price, dividend and beta

C. Liquidity, solvency and profitability only

D. Inventory count, bank confirmation and ageing

Correct Answer: A. Economy, efficiency and effectiveness

Question 5

What is a principal limitation of blockchain evidence?

A. It cannot record transactions in sequence.

B. It guarantees that every input was truthful.

C. It may preserve an inaccurate or unauthorised input immutably.

D. It prevents all cyberattacks.

Correct Answer: C. It may preserve an inaccurate or unauthorised input immutably.

Question 6

Which activity is primarily management’s responsibility rather than an independent continuous-audit activity?

A. Continuous monitoring of controls

B. Independent evaluation of exception evidence

C. Reporting significant findings to the audit committee

D. Testing the reliability of extracted audit data

Correct Answer: A. Continuous monitoring of controls

Question 7

In ESG assurance, why are reporting boundaries important?

A. They determine which activities and entities are included in the reported information.

B. They eliminate the need for evidence.

C. They convert limited assurance into absolute assurance.

D. They determine the auditor’s salary.

Correct Answer: A. They determine which activities and entities are included in the reported information.

Question 8

Which service is most directly designed to investigate suspected fraud and quantify losses for a dispute?

A. Forensic audit

B. Routine bookkeeping

C. A standard bank reconciliation

D. A review of interim statements

Correct Answer: A. Forensic audit

Question 9

What does reasonable assurance mean?

A. Absolute certainty that fraud is impossible

B. A high but not absolute level of assurance supported by sufficient appropriate evidence

C. A guarantee that every transaction was tested

D. A report containing only management representations

Correct Answer: B. A high but not absolute level of assurance supported by sufficient appropriate evidence

Question 10

Which situation creates a self-review threat for internal audit?

A. Reviewing a control designed and operated independently by management

B. Reporting a finding to the audit committee

C. Auditing a control that internal audit previously designed and implemented

D. Using data analytics to identify unusual payments

Correct Answer: C. Auditing a control that internal audit previously designed and implemented