Proposed revisions to examination and review engagements in the attestation standards

Editor’s note: This is the second article in a three-part series on revisions to the attestation standards proposed by the AICPA Auditing Standards Board (ASB). You can access the February 2026 exposure draft and response template (February 2026 ED) and the March 2026 exposure draft and response template (March 2026 ED). Comments on the exposure drafts are requested from respondents by June 30.

Part 1 of this series, “Proposed Attestation Changes: What CPAs Should Know,” includes among other topics the reasons for embarking on the project to enhance or clarify AT-C sections 105, Concepts Common to All Attestation Engagements; 205, Assertion-Based Examination Engagements; and 210 Review Engagements (the baseline attestation standards).

When revising the baseline attestation standards, the main approach was to focus on the high-priority topics identified by the Assurance Services Executive Committee and others (see Part 1 for further discussion regarding these high-priority items). In addressing the high-priority and other topics, the ASB considered:

• The need for principles-based requirements that apply broadly across various subject matters while remaining sufficiently precise to minimize inappropriate diversity in practice;

• Consistency with other standards within the AICPA Professional Standards, including relevant Statements on Auditing Standards (SASs) and Statements on Standards for Accounting and Review Services (SSARSs); and

• When appropriate, aligning with the equivalent requirements in the International Auditing and Assurance Standards Board standards, specifically with International Standard on Assurance Engagements 3000 (Revised), Assurance Engagements Other Than Audits or Reviews of Historical Financial Information.

When proposing requirements for inclusion in the February 2026 ED, the approach taken to reinforce the consistency among the AICPA Professional Standards was as follows:

Examination engagements: Because the level of assurance required to be obtained to support the practitioner’s opinion in an examination engagement is the same as the reasonable assurance required to be obtained to support an auditor’s opinion in an audit of financial statements, the proposed requirements are consistent with those in the applicable SASs where the work effort is intended to be the same as for reasonable assurance engagements.

Review engagements: Because the level of assurance required to be obtained to support the practitioner’s conclusion in a review engagement is the same as the limited assurance required to be obtained to support an accountant’s conclusion in a review of financial statements performed in accordance with the SSARSs, the proposed requirements are primarily consistent with those in the SSARSs. In certain circumstances, because of the nature of subject matter subjected to an engagement performed in accordance with the attestation engagements compared to an engagement performed in accordance with the SSARSs, when the work effort is intended to be the same as in an examination engagement, the requirements are consistent between proposed revised AT-C section 210 and proposed revised AT-C section 205.

Significant matters addressed in the proposed baseline attestation standards    

The following selected significant matters are more overarching in nature and provide necessary context when considering the overall revisions that have been made to the proposed revised baseline attestation standards:

Evaluating information to be used as evidence (examination and review engagements)

Proposed AT-C sections 205 and 210 are enhanced with respect to evaluating information to be used as evidence to align more closely with overarching requirements in AU-C section 500, Audit Evidence. The intent is to drive consistency in what constitutes evidence when the practitioner is performing the same or substantially the same procedures in accordance with the SASs and the attestation standards.

• Evidence vs. review evidence: In proposed AT-C section 210, the term “review” has been removed from the phrase “review evidence” throughout the proposed attestation standards. This change is, in part, intended to address the potential misconception that evidence obtained in a review engagement is somehow different in nature from the evidence obtained in an examination engagement.
  
  What may differ, in fact, is how much evidence the practitioner is required to obtain, that is the sufficiency of evidence, to achieve the objectives of an examination or a review engagement.
  
  It is important to remember that in an examination engagement, the objective is to obtain reasonable assurance about whether the subject matter as measured or evaluated against the criteria is free from material misstatement. In a review engagement, the objective is to obtain limited assurance about whether any material modifications should be made to the subject matter for it to be in accordance with (or based on) the criteria.
• Work effort: Proposed AT-C section 210 explicitly acknowledges that the practitioner’s work effort to evaluate the relevance and reliability of information to be used as evidence is significantly less to support a review conclusion than what is required to support an examination opinion. Specifically, proposed AT-C section 210 does not include a requirement for the practitioner to evaluate whether the information is sufficiently precise and detailed for the practitioner’s purposes and to obtain evidence about the accuracy and completeness of the information.
  
  This difference is intended to highlight the scalability of work effort between an examination and a review engagement.
• Sources of information: The sources of information to be used as evidence are enhanced to include requirements to address using the work of a management’s specialist (in proposed AT-C sections 205 and 210) and using information reported on by another individual (in proposed AT-C section 205).
  
  Given the breadth of subject matters addressed by the attestation standards, management may in certain instances use a specialist to prepare or measure/evaluate the subject matter. Likewise, the practitioner for certain subject matters may need to use the reports, including the information accompanying the report, of another individual as evidence for the examination engagement.
  
  Given the nature of review engagements, and the focus on inquiry and analytical procedures, it is not considered necessary to include requirements in proposed revised AT-C section 210 to address the circumstance when the practitioner may need to use information reported on by another individual. 

Risk assessment procedures and responding to risks of material misstatement (examination engagements)

The proposed requirements and related guidance addressing risk assessment procedures and responding to risks of material misstatement in an examination engagement are intended to be more robust than extant standards, including with respect to fraud and suspected fraud as well as instances of noncompliance or suspected noncompliance with laws or regulations affecting the subject matter. Specifically, the practitioner is now required to perform procedures at the appropriate level for the subject matter.

The appropriate level at which to assess risks is based on the practitioner’s professional judgment and will vary based on the subject matter of the examination engagement. For many subject matters, for example, sustainability information, the appropriate level at which to assess risks is at the level implicit in the measurement or evaluation of an underlying subject matter against the criteria. For such subject matter, implicit characteristics may include, but are not limited to:

• Existence;
• Rights and obligations;
• Completeness;
• Accuracy, valuation, and allocation;
• Classification; and
• Presentation.

However, these characteristics may not be relevant to the practitioner’s risk assessment for all subject matters. For example, if the subject matter is the operating effectiveness of internal control, the appropriate level at which to assess the risk associated with the control is based on the underlying objective of the subject matter.

This approach is intended to drive the practitioner to perform effective procedures at an appropriately granular level that is commensurate with the circumstances of the engagement. This is consistent with the procedures for a financial statement audit contained in AU-C sections 315, Understanding the Entity and Its Environment and Assessing the Risks of Material Misstatement, and 330, Performing Audit Procedures in Response to Assessed Risks and Evaluating the Audit Evidence Obtained.

Identifying and responding to areas in which a material misstatement is likely to arise (review engagements)

The approach for the practitioner to use professional judgment when identifying areas in which a material misstatement is likely to arise, based on an understanding of the subject matter and other engagement circumstances, is retained.
 

This approach is consistent with a financial statement review performed in accordance with the SSARSs and is commonly referred to as the practitioner’s “risk awareness” to contrast it with the concept of a risk assessment in an engagement to obtain reasonable assurance. However, while proposed AT-C section 210 does not require the performance of risk assessment procedures, such procedures are not precluded if the practitioner determines that the procedures are necessary in order to obtain limited assurance.

Consistent with existing practice, the focus in a review engagement remains on performing inquiries and analytical procedures when responding to areas in which the practitioner believes material misstatement is likely to arise. Proposed AT-C section 210 also reaffirms that inquiry procedures alone are not sufficient to obtain limited assurance. The practitioner will need to perform other procedures when the circumstances of the review engagement are such that analytical procedures are impracticable because the subject matter is not financial or numerical. 

This allows for procedures, in addition to inquiries and analytical procedures, to be considered for purposes of the subject matter AT-C sections, where the circumstances of the engagement make it necessary for such procedures to be performed, such as proposed AT-C section 330, Reporting on a Review of Sustainability Information.

Part 3 of this series will focus on the two new proposed sustainability information AT-C sections addressing reporting on an examination or a review of sustainability information.

Modifying the practitioner’s review report when a scope limitation exists

Revisions have been proposed to AT-C section 210 to allow for the issuance of a qualified or disclaimer of conclusion in a review engagement when a scope limitation exists.

It should be noted that when the practitioner is unable to obtain sufficient appropriate evidence on which to base a conclusion (i.e., a scope limitation exists) and the practitioner concludes that the possible effects on the subject matter of undetected misstatements, if any, could be both material and pervasive, the practitioner should withdraw from the engagement when practicable. The practitioner should only disclaim a conclusion when the practitioner determines that it is not practicable to withdraw.

These revisions incorporate the initial proposals and the resulting feedback received from respondents to the narrow-scope proposed SSAE, Scope Limitations in a Review Engagement,that was issued in Q1 2025. Consequently, this narrow-scope exposure draft was withdrawn.

Other matters impacting the proposed baseline attestation standards

For a more complete and comprehensive discussion of the revisions to the baseline attestation standards, refer to the explanatory memorandum of the proposed Statement on Standards for Attestation Engagements (SSAE), Common Concepts, Examination Engagements, Review Engagements, and Engagements to Report on Sustainability Information, issued in February 2026.

How the proposed revisions affect other AT-C sections

The proposed revisions to the baseline attestation standards affect each of the subject matter AT-C sections, including AT-C section 320, Reporting on an Examination of Controls at a Service Organization Relevant to User Entities’ Internal Control Over Financial Reporting. This is due to the building blocks approach being used in structuring the attestation standards. In addition, revisions to proposed AT-C section 105 affect AT-C sections 206, Direct Engagements,and 215, Agreed-Upon Procedures Engagements.

No new incremental requirements have been added to the subject matter AT-C sections or to AT-C sections 206 or 215; however, conforming amendments have been proposed to ensure the continued interoperability of the suite of attestation standards.

The series at a glance

The JofA is publishing three articles about the proposed revisions to the attestation standards. These articles will cover:

• Part 1: Structure of the attestation standards and proposed enhancements.
• Part 2: Proposed revisions to examination and review engagements in the attestation standards.
• Part 3: Proposed new sustainability information AT-C sections.

— Mike Glynn, CPA, CGMA, and Ahava Goldman, CPA, CGMA,are associate directors for the AICPA Audit & Attest Standards team. Sally Ann Bailey, CPA, Chartered Accountant (South Africa), serves as a consultant to the AICPA, working with technical staff on standard-setting activities. To comment on this article or to suggest an idea for another article, contact Jeff Drew atJeff.Drew@aicpa-cima.com.