Expanding Options for Providing Attestation Services

A Review of AT-C Sections 205 and 206

By: Gerald W. Hepp, CPA, Alan Reinstein, CPA and Thomas R. Weirich, PhD, CPA



In September 2020, the Auditing Standards Board issued Statement on Standards for Attestation Engagements (SSAE) 21, Direct Examination Engagements. Its provisions are effective for assertion-based and direct examination engagement reports dated on or after June 15, 2022, with early implementation permitted. SSAE 21 addresses three issues: it 1) amends AT-C section 105, “Concepts Common to All Attestation Engagements,” principally for new terminology; 2) redrafts AT-C section 205, now “Assertion-Based Examination Engagements”; and 3) adds a new service that CPAs may now provide under AT-C section 206, “Direct Examination Engagements.”

Attestation examination standards prior to SSAE 21 required that the party responsible for the subject matter, who must be someone other than the CPA, make an assertion about whether a subject matter is measured or evaluated in accordance with identified criteria. After conducting an appropriate examination, a CPA expresses an opinion on the assertion or subject matter.

SSAE 21 retains the current examination engagement, under the new name Assertion-Based Examinations, and creates a new Direct Examination standard, wherein a CPA measures or evaluates the subject matter against suitable criteria without obtaining the responsible party’s assertion. This service would be especially beneficial to an entity that lacks the in-house ability to measure or evaluate a subject matter or otherwise deal with its complexity.

The assertion-based and direct examination engagements are two of the four types of attestation engagements CPAs can provide clients (see Exhibit 1). This article focuses on the differences between assertion-based (section 205) and direct (section 206) examination engagements.

Exhibit 1: Summary of Four Types of Attestation Engagements*

 AT-C Section 205 Redraft

The redraft of AT-C section 205 has not significantly changed the nature of, or procedures appropriate for, the underlying service. Its principal changes are reorganizing the material and the terminology used. One change is that the report must include a statement about the preparer’s independence and compliance with ethical responsibilities. This disclosure is now part of all attestation and audit reports.

One part of AT-C section 205 that is not new, but equally applicable to section 206, is worthy of being repeated: A CPA should report to the responsible party any known or suspected fraud or noncompliance with laws or regulations, uncorrected misstatements, and—when relevant to the subject matter—internal control deficiencies identified during the engagement.

Required Procedures

Conceptually, both assertion-based (section 205) and direct (section 206) examination engagements focus on measuring or evaluating the subject matter against the criteria, deriving a commonality of examination procedures for the two engagements. First, both types of engagements should follow the requirements and guidance in AT-C section 105, “Concepts Common to All Attestation Engagements.” Furthermore, section 206 requires CPAs to follow its requirements in direct examinations except for any that cannot be followed as written due to the nature of the direct examination, including obtaining a written assertion from the responsible party. In such cases, CPAs should adapt section 205 procedures to the direct examination. AT-C section 206 provides guidance specifically applicable for a direct engagement.

SSAE 21 retains the current examination engagement and creates a new Direct Examination standard, wherein a CPA measures or evaluates the subject matter against suitable criteria without obtaining the responsible party’s assertion.

Acceptance and continuance. AT-C section 205 does not provide a comparably titled section. Section 206 directs CPAs to understand why the engaging party wants the direct examination service and how the report will be used. Furthermore, the CPA is directed to understand why the responsible party has not measured or evaluated the subject matter against the criteria and, if the responsible party has done so, why he does not intend to provide an assertion. CPAs should consider the responses obtained, prior engagements (if any), and discussions about the terms of engagements when deciding whether to provide the direct examination service. (These are good points to consider before providing any of the four types of attestation services.)

Terms of engagement. Both AT-C sections 205 and 206 denote matters to include in a written client engagement agreement. Although the lists are written differently, they request identical information; the direct examination expands upon the information required from responsible parties.

Written representations. The key difference between sections 205 and 206 is the requirement under section 205 for the responsible party to provide a written assertion as a condition for providing the service. Although a section 206 engagement requires no responsible party written assertions, a CPA is nevertheless directed to request written representations from the responsible party in order to acknowledge responsibility for the subject matter and criteria, and other data regarding control and the quality of the information. Both sections advise professionals to determine that the criteria are suitable, they will be available to the intended users, and they are appropriate for the purpose of the engagement. Moreover, CPAs should be satisfied that the criteria are objective, relevant, and measurable.

Report content. In an assertion-based examination under AT-C section 205, a CPA has the following options in formatting the report on the engagement:

• Examination of subject matter, with opinion on the subject matter
• Examination of the responsible party’s assertion, with opinion on the assertion
• Examination of the responsible party’s assertion, with opinion on the subject matter.

AT-C section 205 provides, however, that qualified or adverse opinions should focus on the subject matter, not on the assertion, even if the assertion acknowledges the misstatement. The report should include an alert if the criteria are somehow restrictive; for example, if the criteria used to evaluate the subject matter are only available to specified parties.

The responsible party is always responsible for the underlying subject matter, but the engaging party is responsible for the criteria used in the engagement.

In a direct examination under section 206, the CPA is also presented with three ways of stating the opinion:

• The subject matter is in accordance with the criteria, in all material respects.
• The subject matter is free from material misstatement based on the criteria.
• The subject matter is presented fairly, in all material respects, based on the criteria.

There is an unusual variation between the two sections. AT-C section 206 uses the terms underlying subject matter and subject matter information, which are defined in section 105.12. But AT-C section 205 only uses the term subject matter. Section 205.01 explains, “For purposes of applying this section, the term subject matter encompasses the terms underlying subject matter and subject matter information, as defined in AT-C Section 105. If only one of these terms is applicable, that term is used.”

Variations When Client is Not the Responsible Party

The above discussion focuses on situations wherein the responsible party engages the CPA. Both the assertion-based (section 205) and direct examination (section 206) engagements, however, recognize that the engaging party need not necessarily be the responsible party. The responsible party is always responsible for the underlying subject matter, but the engaging party is responsible for the criteria used in the engagement. The discussion above regarding acceptance and continuance would be more critical in such situations.

Both services discuss inquiries that the practitioner should make. A CPA should identify the appropriate party to whom to make the necessary inquiries: the responsibility party, the engaging party, or both.

Terms of engagement. The expected terms of engagement are presented separately for each type of engagement. Each listing calls for recognizing that the responsible party is not the engaging party and lists the issues for such situations. Given the need to plan the engagement and identify the risk of material misstatements, CPAs should consider entering into a separate agreement with the responsible party to ensure compliance with the requests that will be made of them.

Written representation. Each type of engagement calls for written representations from the responsible party. If the responsible party refuses to provide such representations, a CPA should attempt to obtain oral responses to the various issues. Such a refusal requires a CPA to disclose in the report the lack of the written representation and restrict the use of the report to the engaging party. The responsible party refusing to provide either a written or oral representation on any of the identified matters constitutes a scope limitation, which may dictate withdrawal from the engagement. (For an assertion-based examination engagement, when the responsible party is the engaging party, a refusal to provide a written assertion requires the CPA to withdraw.)

Reports. As discussed above, the way an opinion is stated varies between assertion-based and direct examination engagements. Besides the existence of a problem regarding the responsible party’s refusal to provide written or oral representations (as noted above), a difference in the engaging party does not affect the appropriate form of report.

Keeping Focus

For both assertion-based (section 205) and direct examination (section 206) engagements, CPAs should focus on the underlying subject matter and criteria. Proper descriptions of each affect the conduct of the entire engagement.

CPAs must assimilate considerable information to provide clients with either of these attestation engagements. In addition, when choosing the provided service, the CPA and engaging party should understand the engagement’s purpose, why the engagement is required, and how the client will use the report. Any similar prior engagements between the parties would form an important part of that evaluation.

Gerald W. Hepp, CPA, is the CEO of Gnosis Praxis Ltd, Novi, Mich.

Alan Reinstein, DBA, CPA, is the George R. Husband Professor of Accounting in the school of business administration, Wayne State University, Detroit, Mich.

Thomas R. Weirich, PhD, CPA, is a professor of accounting in the college of business administration, Central Michigan University, Mt. Pleasant, Mich.