Latest / VoraPrep Audio — Professional Licensure & Certification Exam Prep / [CPA] AUD: The Assurance Spectrum: Audits, Reviews, and Compilations
Transcript
- Marcus: Welcome back to VoraPrep Audio's Office Hours. Today we're tackling a foundational question that comes up all the time in practice and on the exam. Ava: Right. A client comes to you, they need a loan, and they hand you their financial statements. They say, "Can you just look these over for the bank?" It sounds simple, but that phrase, "look these over," can mean three very different things. Marcus: Exactly. It could mean an audit, a review, or a compilation. Choosing the wrong one has serious consequences for the client, the bank, and your own license. The key is understanding what we call the assurance spectrum. Ava: Let’s start right there. When you say ‘assurance,’ what are we actually talking about? Is it like a guarantee? Marcus: That’s the perfect first question. Assurance is the level of confidence the CPA provides that the client’s financial information is reliable. And it’s definitely not a guarantee. It’s a spectrum, with different levels of confidence based on the amount of work we do. Ava: Okay, a spectrum. So what’s at the high end? The most confidence you can provide. Marcus: That would be an audit. The goal of an audit is to provide what we call "reasonable assurance." It's a high level of assurance, but not absolute. Ava: And how do we express that high level of assurance in our report? Marcus: We express it as "positive assurance." The report will say something like, "In our opinion, the financial statements present fairly..." We're making a direct, affirmative statement. Ava: "In our opinion..." So you're staking your professional judgment on it. What does that allow you to do? Marcus: It allows the user of those financials—like the bank in our example—to have a high degree of confidence that the numbers are free from material misstatement. Think of it like a comprehensive home inspection. The inspector checks the foundation, the roof, the electrical, the plumbing. They give you a detailed report that says, "In my professional opinion, this house is structurally sound." Ava: Okay, that makes sense. A deep dive. So if an audit is the full home inspection, what’s the next step down on the spectrum? Marcus: The next step down is a review. A review provides "limited assurance." It’s a moderate, or middle-ground, level of confidence. Ava: Limited assurance. So if an audit is 'positive' assurance, how do we phrase this more limited level? Marcus: We use "negative assurance." The language is very specific and indirect. A review report says something like, "...we are not aware of any material modifications that should be made..." Ava: That's a very different tone. Instead of saying "it is fair," you're saying "we didn't see anything that's *not* fair." Marcus: Precisely. The work involved is also much less than an audit. For a review, we primarily perform inquiry and analytical procedures. We're asking management questions and analyzing relationships in the data to see if they make sense. Ava: So to go back to your analogy, if an audit is the full home inspection, what's a review? Marcus: A review is more like a walkthrough with an experienced contractor. They're not opening up walls or crawling through the attic. They're looking for obvious red flags, asking the owner questions, and using their experience to see if anything looks out of place. They can tell you, "I walked through and didn't see any major issues," but they can't give you the same level of confidence as a full inspection. Ava: Got it. High-level audit, mid-level review. What’s at the low end of the spectrum? Marcus: At the lowest end, you have a compilation. And with a compilation, the CPA provides no assurance at all. Ava: None? So what is the CPA even doing then? Marcus: In a compilation, we are simply assisting management in presenting their financial information in the form of financial statements. We don't perform any procedures to verify the accuracy or completeness of that information. Ava: So what's the analogy for a compilation? Marcus: It’s like being a professional formatter for an author’s manuscript. You're taking their raw data—their chapters and notes—and putting it into a clean, professional book format. You're not fact-checking the story or verifying the sources. You're just presenting their information in the proper form. The report makes it very clear that you're not providing any assurance on the numbers. Ava: That brings up a critical question for me about the high end of the spectrum. You said an audit provides 'reasonable' assurance, not 'absolute' assurance. Why isn't it absolute? If a client is paying for the most expensive, most thorough service, why can't we give them a 100% guarantee? Marcus: That’s a question that gets to the very heart of what auditing is. There are a few fundamental, inherent limitations that prevent us from ever reaching absolute certainty. Ava: Okay, what's the first one? Marcus: The nature of financial reporting itself. Many items on financial statements rely on judgment and estimates. Think about the allowance for doubtful accounts or the useful life of an asset. There’s no single, provably correct number. It’s management’s best estimate, and our job is to determine if that estimate is reasonable, not to calculate a perfect number. Ava: So there's uncertainty baked into the numbers themselves. What's another limitation? Marcus: The nature of our audit procedures. We rely on sampling. For a large company, we can't possibly examine every single transaction. We select a representative sample and test it. But there's always a risk, however small, that a material misstatement exists in the transactions we didn't select. Ava: And I assume that risk is even higher if someone is actively trying to hide something. Marcus: Exactly. A well-concealed fraud, especially one involving collusion among management, can be very difficult to detect. We're skilled at finding errors and fraud, but we aren't forensic investigators with unlimited powers. Ava: So, subjective estimates and the limits of sampling. Is there a third reason we can't offer a guarantee? Marcus: Yes, and it's a practical one: timeliness and cost. Users need the audited financial statements within a reasonable amount of time after year-end to make decisions. If we had to test every transaction, an audit would take years and cost a fortune, making the final report irrelevant. It’s a balance between thoroughness and usefulness. Ava: That makes sense. It’s a trade-off. Let's make this concrete. Can we walk through an example? Let's use that tech company, Innovate Inc. They need a $5 million line of credit, and the CFO wants the cheapest option. Marcus: Perfect. So, what's our very first step as the CPA? Ava: I'd imagine you have to figure out who is going to be relying on these financial statements. Marcus: Exactly. Step one is to identify the user and their needs. In this case, the primary user is the bank. The bank is the one taking on risk, so they're the one who needs the assurance. A simple compilation with no assurance isn't going to work for a multi-million dollar loan. Ava: Okay, so compilation is out. That leaves a review or an audit. How do you decide between those two? Marcus: Step two is to evaluate the assurance levels required. A review provides limited assurance, while an audit provides high, reasonable assurance. The bank needs to be confident the numbers are reliable before they lend $5 million. Ava: But how do we know what the bank's threshold for confidence is? Do we just have to guess? Marcus: Never guess. Step three is the most important: we inquire directly with the user. The CPA should call the loan officer at the bank. In this scenario, the loan officer confirms that for a loan of this size, bank policy requires a *review* at a minimum. But, they add, if the company provides an *audit*, they’ll qualify for a more favorable interest rate. Ava: Ah, so there's an incentive. The audit costs more upfront, but it could save the client money in the long run. How do you present this to the CFO who just wants the cheapest option? Marcus: That’s step four: present the options and their implications to the client. We explain that the review meets the bank's minimum requirement. It's less expensive and less intrusive. Then we explain that the audit, while more expensive, provides the bank with much higher assurance, which they reward with a lower interest rate. We help the CFO do the math. Ava: So they can make an informed business decision. What did Innovate Inc. decide? Marcus: They ran the numbers and concluded the interest savings from the audit would far outweigh the higher professional fees. They chose the audit. The key was we guided them to the right choice by focusing on the needs of the third-party user, the bank. Ava: That's a great illustration. Now, I know the exam likes to get into the weeds on the specific standards that govern these engagements. I always see SSARS and SSAE. How do we keep those straight? Marcus: There's a very simple decision rule for this. You just have to ask one question: Is the subject matter historical financial statements of a nonissuer? Ava: Okay, so if the answer is YES, it's a company's regular, historical financial statements? Marcus: If yes, then the engagement—whether it's a review, a compilation, or a preparation—is governed by SSARS, which stands for Statements on Standards for Accounting and Review Services. Ava: And what if the answer is NO? What if we're asked to provide assurance on something else, like a company's sales projections or its internal controls? Marcus: If the subject matter is something *other* than historical financials, the engagement falls under SSAE—the Statements on Standards for Attestation Engagements. So, SSARS is for historical financials; SSAE is for most everything else in the world of attestation. Ava: That's a clean way to divide it. This is a lot to keep in your head for exam day. Is there a mnemonic or a memory aid that can help? Marcus: Absolutely. To remember the core services and their assurance levels, just think of the word 'ARC'. A-R-C. Ava: ARC. Okay, how does it work? Marcus: 'A' is for Audit. Think of it as an All-out effort for Reasonable, or positive, assurance. 'R' is for Review. That's Reduced procedures for Limited, or negative, assurance. And 'C' is for Compilation. That's just Collecting data for No assurance. Ava: ARC. Audit is All-out. Review is Reduced. Compilation is Collecting. That's very helpful. Marcus: It ties the service directly to the level of work and assurance. Ava: What about the question formats on the exam? Are there specific keywords we should be looking for that signal which type of engagement they’re describing? Marcus: Definitely. The questions often give away the answer in the description of the work performed. If you see the phrase "inquiry and analytical procedures" as the main work effort, the answer is almost always a Review. Ava: Okay, "inquiry and analytical procedures" means Review. What's the keyword for an audit? Marcus: If the question mentions "risk assessment," "testing internal controls," or "substantive testing," it's describing an Audit. Those are the building blocks of a full audit. Ava: And for a compilation? Marcus: The language will be much simpler. If it just says the CPA is "assisting management in presenting financial information" and specifically mentions no assurance is provided, you're in the world of Compilations or Preparation services. Ava: So the procedures described in the question stem are a huge clue. It all comes back to matching the level of work with the level of assurance the user needs. Marcus: Exactly. And the best way to get comfortable with that is to see it in action across dozens of different scenarios. Ava: And getting reps with those kinds of questions is crucial. For our listeners who want more practice on this... Marcus: That's a great point. VoraPrep is a full exam-prep app — lessons, practice questions, and an AI tutor in one place. You can find it at Vora Prep dot com to get started. Ava: Perfect. So if there's one thing to remember from today, it's that assurance isn't one-size-fits-all. You have to diagnose the situation and prescribe the right level of service. Marcus: That's the core lesson. It's about understanding what the user needs and what each level of service—audit, review, or compilation—truly provides. Thanks for the great questions, Ava. Ava: Anytime, Marcus. And to everyone listening, keep up the great work. We'll see you next time.