Steps in this chapter (13)
Reviews, compilations, agreed-upon procedures, special purpose frameworks, single statements, interim reviews, ICFR assurance, sustainability assurance and service organisation reports.
The kind chosen when an engagement is created decides its standard, working papers, programme, phases, completion gates, letters and report. Each kind has its own letters and report, and follows the same sign-off, review note, independence and archive rules as an audit.
In the illustration Okafor Bello & Co takes on nine other engagements between May and July 2026.
Use cases
- Use case — A bank asks for reviewed financial statements. A review (ISRE 2400): limited assurance, inquiry and analytical procedures, a review report.
- Use case — A donor asks for procedures on a grant. Agreed-upon procedures (ISRS 4400): agree the procedures in writing, perform them and report factual findings.
- Use case — A listed company's ICFR report. ICFR assurance linked to the audit (step 17.9): materiality and controls are reused.
- Use case — A payroll bureau's customers ask for assurance. A service organisation report (ISAE 3402 Type 1 or 2).
17.1 Choose the kind
Why
Audit (ISAs or ISA for LCE); review of financial statements (ISRE 2400 (Revised)); compilation (ISRS 4410 (Revised)); agreed-upon procedures (ISRS 4400 (Revised)); special purpose framework (ISA 800 (Revised)); single statement or element (ISA 805 (Revised)); review of interim financial information (ISRE 2410); assurance on internal control over financial reporting (ISAE 3000 / FRC guidance); sustainability assurance (ISSA 5000, or ISAE 3000/3410 before its effective date); service organisation report (ISAE 3402 / SOC 2-type).
Who
Partner.
What to do
- Choose the kind (1); the dialog changes to the kind's settings.
17.2 A review of financial statements
Why
A review gives limited assurance, mainly from inquiry and analytical procedures. The file has the review working papers (preconditions, understanding, procedures, completion), a review programme and its own gates.
Who
Engagement partner (Tamunoemi Briggs) and team.
What to do
- Work through the review papers and programme as for an audit.
17.3 The review report
Why
The report states a conclusion in negative form (nothing has come to our attention…).
Who
Engagement partner.
What to do
- Complete the report settings and sign the review report from the Overview.
17.4 A compilation
Why
A compilation gives no assurance. The papers record the terms, the understanding of the entity and the reading of the compiled information; the compilation report says what was done.
Who
Engagement partner (Nkechi Okafor).
What to do
- Complete the compilation papers and issue the compilation report.
17.5 Agreed-upon procedures
Why
The procedures are agreed in writing before they are performed; vague wording (for example 'verify' or 'ensure') is flagged. Findings must be factual — words of opinion or assurance are refused. There is no planning phase, and independence is required only if the terms say so.
Who
Engagement partner or manager agrees; senior performs.
What to do
- Add the procedures and choose Mark agreed in writing with the date.
- Record each finding and whether there are exceptions; choose Print the report.
17.6 A special purpose framework (ISA 800)
Why
Financial information prepared under a special purpose framework (for example a loan agreement's definitions) is audited with the ISA 800 papers; the report describes the framework and restricts its use where needed.
Who
Engagement partner (Folake Adeyemi).
What to do
- Describe the framework and its purpose in SP-1 and complete the audit.
17.7 A single statement (ISA 805)
Why
An audit of a single statement or element — here a programme's statement of receipts and payments under IPSAS — uses the ISA 805 papers and report.
Who
Engagement partner.
What to do
- Identify the statement and its framework and complete the audit.
17.8 A review of interim financial information
Why
A review of interim financial information by the entity's auditor (ISRE 2410), accepted and planned in July for October. The firm can choose the exposure-draft report structure in Settings → Assurance standards.
Who
Engagement partner; manager.
What to do
- Complete acceptance now and book the team (chapter 18).
17.9 Assurance on ICFR
Why
Assurance on internal control over financial reporting follows ISAE 3000 (Revised) and the FRC guidance against COSO 2013: scoping, entity-level controls for the 17 principles, process controls, IT general controls, tests with sample sizes, deficiency severity and aggregation, management's report and limited or reasonable assurance. Linked to the audit of the same period, it reuses the audit's materiality and controls and takes the same report date.
Who
Engagement partner, manager and senior.
What to do
- Link the ICFR engagement to the audit, copy materiality and import the controls.
- Record the scope, the controls and their tests.
17.10 ICFR deficiencies
Why
Each deficiency is rated by likelihood and amount and aggregated with others affecting the same account and assertion, to decide whether there is a material weakness.
Who
Manager; engagement partner.
What to do
- Record each deficiency, its group and whether it is in management's report.
17.11 Sustainability assurance
Why
Sustainability assurance (ISSA 5000 for periods beginning on or after 15 December 2026; ISAE 3000 (Revised) and ISAE 3410 before) records each disclosure with its criteria (here IFRS S2), metric, unit and reported value, greenhouse gas scopes, value-chain and forward-looking information, materiality and misstatements, with the FRC Nigeria roadmap.
Who
Engagement partner, manager and senior.
What to do
- Add the disclosures in scope and record the work and misstatements on each.
17.12 A service organisation report
Why
A service organisation report records the control objectives (or the Trust Services Criteria for a SOC 2-type report), the controls, tests and deviations, the complementary user entity controls (CUECs) and subservice organisations (inclusive or carve-out), and gives the service auditor's report.
Who
Engagement partner (Folake Adeyemi), manager and senior.
What to do
- Record the system description, objectives, controls, CUECs and subservice organisations; test the controls and record deviations.
17.13 The firm's assurance settings
Why
Firm-wide choices for the assurance kinds are kept here.
Who
Owner or firm administrator.
What to do
- Change a setting only when the firm has decided to.