Assurance Services Explained: Audit, Review, Attestation, AUP

Assurance services are professional engagements in which an independent CPA evaluates subject matter and provides a report that increases the confidence of intended users in that information. The broad category includes financial statement audits and reviews, attestation engagements on non-financial subject matter, and agreed-upon procedures reports. Each service delivers a different level of assurance and fits a different set of business needs. Choosing the right one depends on what stakeholders require, what the subject matter is, and how much evidence the situation demands.

What Are Assurance Services?

The AICPA defines an assurance engagement as one in which a practitioner expresses a conclusion designed to enhance the degree of confidence of the intended users of a subject matter. That definition covers three things at once: the practitioner must be independent, the subject matter must be capable of evaluation against suitable criteria, and the conclusion must be communicated in a written report.

Assurance services sit at the top of a broader pyramid of CPA services. Below them are preparation and compilation engagements, which help clients organize or present financial data without providing any assurance at all. Assurance services, by contrast, give lenders, investors, boards, regulators, and counterparties something they can rely on.

The spectrum runs from high to low:

• Reasonable assurance (the audit): The CPA obtains sufficient appropriate evidence to conclude the subject matter is free of material misstatement. The opinion is affirmative and positive.
• Limited assurance (the review or attestation review): The CPA performs procedures sufficient to conclude that nothing has come to their attention indicating material misstatement. The conclusion is expressed in the negative form.
• No assurance on the subject matter (agreed-upon procedures): The CPA reports factual findings; users draw their own conclusions.

Financial Statement Audits

A financial statement audit under generally accepted auditing standards (GAAS) is the highest-assurance engagement in practice. The auditor plans and executes procedures, tests internal controls, performs substantive testing, confirms balances with third parties, and evaluates whether the financial statements present fairly, in all material respects, the entity’s financial position and results of operations. The audit opinion is the end product.

Who typically needs an audit?

Audit requirements arise from many sources, not just public-company rules:

• Nonprofits and federal award recipients. Organizations that expend $1,000,000 or more in federal awards in a fiscal year are subject to a Single Audit under the Uniform Guidance (2 CFR 200.501, for fiscal years beginning on or after October 1, 2024). Learn more about how Modus supports nonprofit audit and compliance work.
• Employee benefit plans. A 401(k) or other ERISA plan that crosses the large-plan threshold, generally 100 or more participants at the beginning of the plan year, must file an audited Form 5500. For plan years beginning on or after January 1, 2023, the DOL changed the counting method for defined contribution plans to participants with account balances rather than all eligible participants, which removed the audit obligation for many plans with dormant eligible employees. The 80-120 participant rule adds further flexibility: a plan with between 80 and 120 participants at the beginning of the plan year may file in the same category, large or small, that it used the prior year.
• Lender covenants. Many credit agreements require audited financials for borrowers above a revenue or asset threshold.
• Private equity and M&A transactions. Acquirers routinely require audited financials as part of due diligence.

What the audit report says

A standard unmodified opinion states that the financial statements are presented fairly in conformity with the applicable financial reporting framework (generally US GAAP). A modified opinion, adverse opinion, or disclaimer of opinion signals a departure that users must weigh carefully.

Financial Statement Reviews

A review under AICPA AR-C Section 90 provides limited assurance, a step down from a full audit in scope, procedures, and cost. The accountant performs analytical procedures and inquiries of management but does not test internal controls, confirm balances independently, or perform the substantive sampling that defines an audit.

The review conclusion reads in the negative: the accountant states that nothing has come to their attention that causes them to believe the financial statements are materially misstated. That formulation matters, because it tells users they are getting inquiry and analysis, not full verification.

When a review is the right fit

Reviews suit mid-market businesses where:

• A bank or investor wants more comfort than bare financial statements provide, but the relationship does not yet require a full audit.
• An owner is preparing for a potential sale and wants financials with credibility before engaging a full audit team.
• A franchise agreement, joint venture, or contract requires reviewed financials.

Reviews cost materially less than audits, and the timeline is typically shorter. The trade-off is that users receive less assurance. Modus’s audit and assurance team helps clients determine which engagement level their stakeholders actually require before starting work.

Attestation Engagements

An attestation engagement extends assurance beyond historical financial statements to virtually any measurable subject matter. The governing framework is AICPA SSAE No. 18, Attestation Standards: Clarification and Recodification, which remains the primary attestation standard, organized into AT-C Sections 105 (common concepts), 205 (examination), and 210 (review). SSAE No. 19, effective for agreed-upon procedures reports dated on or after July 15, 2021, governs AUP engagements specifically (see below).

An attestation engagement has three parties: the responsible party that owns the subject matter or assertion, the intended users who will rely on the report, and the practitioner who evaluates and reports. The subject matter can include:

• Internal control over financial reporting (e.g., management’s assertion under PCAOB rules or a private-company examination)
• Compliance with laws, regulations, or contract terms
• Systems and controls over data security and availability (the SOC suite)
• Sustainability metrics and ESG disclosures (a growing application, with the AICPA ASB advancing exposure drafts in 2026 for sustainability attestation standards)
• Pro forma or prospective financial information

Examination vs. review under SSAE

Just as with financial statements, attestation engagements come in two assurance flavors:

• Examination provides reasonable assurance. The practitioner gathers sufficient evidence and expresses a positive opinion on the subject matter or assertion.
• Review provides limited assurance. The practitioner’s conclusion is expressed in the negative form.

SOC reports: a critical attestation category

SOC 1 and SOC 2 reports are attestation examinations performed under SSAE No. 18. A SOC 2 examination evaluates a service organization’s controls against the AICPA’s 2017 Trust Services Criteria (TSC) for security, availability, processing integrity, confidentiality, and privacy. The security criterion (common criteria) is required; the others are added based on the service in scope.

SOC reports matter because they let service organizations demonstrate control effectiveness to their clients and auditors without opening the door to dozens of individual customer audits each year. For more on the SOC framework and how engagements are structured, see Modus’s SOC reporting services.

Agreed-Upon Procedures (AUP) Engagements

An agreed-upon procedures engagement is unique within the assurance family because the practitioner does not form a conclusion or express an opinion. Instead, the practitioner performs specific factual procedures that the client and the intended users have agreed to in advance, then reports the findings, leaving users to reach their own conclusions.

SSAE No. 19 made AUP engagements significantly more flexible than the old AT-C Section 215 it replaced. Under SSAE No. 19, the practitioner no longer needs to obtain a written assertion from the responsible party, and the procedures can be developed by the practitioner, the engaging party, the intended users, or any combination of them. The practitioner needs only the engaging party to agree and acknowledge, before the report is issued, that the procedures performed are appropriate for the intended purpose. This flexibility has expanded the practical range of AUP use cases.

Common AUP use cases

• Royalty audits. A licensor specifies procedures for the licensee’s CPA to apply to the royalty calculation, with findings reported to both parties.
• Loan covenant compliance. A lender specifies procedures to test specific financial ratios or covenants without requiring a full audit.
• Escrow and earnout verification. In M&A deals, buyers and sellers agree on procedures to verify earnout metrics post-close.
• Grant compliance. Foundations and government grantors specify procedures to verify expenditure of grant funds.
• Due diligence components. Deal teams use AUPs to perform targeted procedures on working capital, backlog, or specific account balances as part of transaction advisory work.

Because the procedures are custom-designed for the engagement, an AUP can be more efficient and lower-cost than a full examination when the users know exactly what they need verified.

Choosing the Right Assurance Service

The decision tree is straightforward once the governing question is answered: what does the stakeholder requiring the report actually need?

Stakeholder need	Appropriate service
Lender requires financial statements be “audited”	Financial statement audit (GAAS)
Investor wants comfort without full audit cost	Financial statement review (AR-C 90)
Customers or regulators want proof of your controls	SOC examination (SSAE 18, AT-C 205)
Grant funder needs specific procedures run on expenditures	Agreed-upon procedures (SSAE 19)
Board needs management’s internal control assertion examined	Attestation examination (SSAE 18)

One practical reality: many engagements come with mandatory requirements. The Single Audit threshold, ERISA large-plan rules, lender covenant language, and SOC procurement requirements all specify the engagement type. When there is no hard requirement, matching scope to stakeholder need, rather than defaulting to the most expensive option, protects the client’s budget without compromising credibility.

Modus’s approach uses AI-native audit methodology, source-linked workpapers, and structured planning conversations to right-size the engagement and reduce the documentation burden on client finance teams from day one.

Related reading: Surety Bond Financial Statements: How They Grow Bonding Capacity

Frequently Asked Questions

What is the difference between an audit and an attestation engagement?

A financial statement audit is a specific type of attestation engagement focused on historical financial statements under GAAS. Attestation engagements governed by the AICPA’s SSAE standards are broader: they can cover any measurable subject matter, including internal controls, compliance, data security, and sustainability metrics. All audits are attestation engagements; not all attestation engagements are audits.

What level of assurance does a review provide?

A financial statement review (AR-C 90) and an attestation review (AT-C 210) both provide limited assurance, expressed in the negative form. The accountant states that nothing has come to their attention suggesting the subject matter is materially misstated. This is a lower standard of evidence than the reasonable assurance of a full audit or examination.

What is an agreed-upon procedures (AUP) engagement?

An agreed-upon procedures engagement is a professional service in which a CPA performs specific factual procedures agreed to in advance by the client and the intended users of the report. The CPA reports findings, not conclusions or opinions. Users draw their own inferences from the reported facts. AUP engagements are governed by SSAE No. 19 (effective for reports dated on or after July 15, 2021).

When is a Single Audit required?

A Single Audit under 2 CFR Part 200 (Uniform Guidance) is required when a non-federal entity expends $1,000,000 or more in federal awards in a fiscal year. That threshold applies to fiscal years beginning on or after October 1, 2024, raised from the prior $750,000 level.

What governs SOC 2 reports?

SOC 2 examination reports are attestation engagements performed under AICPA SSAE No. 18 (AT-C Section 205). The controls are evaluated against the AICPA’s 2017 Trust Services Criteria (TSC), updated with revised points of focus in 2022. The security criterion (common criteria) is required in every SOC 2 examination; availability, processing integrity, confidentiality, and privacy are added as applicable to the service in scope.

Can a company request an AUP instead of a full audit?

In most cases, yes, if the party requiring the report accepts it. AUPs are appropriate when users know exactly which facts they need the CPA to test and are willing to form their own conclusions. When a regulatory body, lender covenant, or law requires an audit or examination, however, an AUP does not satisfy that requirement. Always confirm what the mandating party will accept before designing the engagement.