Auditor attestation is an independent evaluation, performed by a CPA, of a claim made by someone else — usually a company’s management — measured against defined criteria so that outside parties can rely on the claim without checking it themselves. You typically need one when a regulator, lender, customer, grant-maker, or business partner wants credible assurance about something your company is asserting, whether that’s the effectiveness of your data-security controls, your compliance with a contract, the reasonableness of a financial forecast, or the strength of your internal controls over financial reporting.
What Attestation Actually Is
An attestation engagement involves three parties. Management (the “responsible party”) puts forward a claim. A CPA tests that claim. A third party (the “intended user”) reads the CPA’s report and decides what to do with it.1AICPA & CIMA. AT-C Section 105 – Concepts Common to All Attestation Engagements The whole point is to let that third party act on the information without verifying it independently.
The subject matter can be almost anything measurable: compliance with a contract, the effectiveness of cybersecurity controls, the reasonableness of a financial forecast, greenhouse gas emissions. What matters is that suitable criteria exist to measure the claim against.
Attestation is not the same thing as a financial statement audit. An audit is a specific kind of assurance engagement governed by Generally Accepted Auditing Standards, and it always addresses whether financial statements are fairly presented. Attestation engagements follow a different rulebook — the Statements on Standards for Attestation Engagements (SSAEs) for private companies, or PCAOB attestation standards for public companies — and they can cover any subject matter, not just financial statements.
The Three Levels of Assurance
Attestation is not one thing. It comes in three tiers, and choosing the right one is often the first decision you’ll make.
Examination (Reasonable Assurance)
An examination is the most rigorous form. The CPA tests controls, inspects documents, and confirms information with outside sources, aiming for a high but not absolute level of confidence that the subject matter is free of material misstatement.2AICPA & CIMA. AT-C Sections 100-300 – US Attestation Standards The conclusion is stated affirmatively: in the CPA’s opinion, the subject matter is in accordance with the criteria in all material respects. That positive opinion is what heavy users of attestation — regulators, major lenders, large enterprise customers — usually want to see.
Review (Limited Assurance)
A review is lighter. The CPA relies mainly on inquiries of management and analytical procedures such as comparing figures to prior periods or looking for unusual patterns. There’s no testing of controls and no outside confirmation.3AICPA & CIMA. AICPA SSAEs – Currently Effective The objective is limited assurance about whether any material changes are needed.4Journal of Accountancy. New Attestation Standard Clarifies Work Effort of Review Engagements
The conclusion is stated negatively. Rather than opining that a claim is correct, the CPA reports that nothing came to their attention suggesting it is materially misstated. That is meaningfully weaker than an examination opinion, and users know it. A review fits situations where some independent check adds value but a full examination isn’t worth the cost.
Agreed-Upon Procedures (No Assurance)
An agreed-upon procedures engagement is different in kind. The CPA forms no opinion at all. Instead, the engaging party specifies particular procedures it wants performed, the CPA performs them, and the report lists the factual findings.5Public Company Accounting Oversight Board. AT Section 201 – Agreed-Upon Procedures Engagements Users draw their own conclusions from those facts.
SSAE No. 19 modernized these engagements, dropping the older requirement that management provide a written assertion and letting procedures develop over the course of the work rather than being fixed at the outset.6AICPA & CIMA. AICPA Statement on Standards for Attestation Engagements No 19 AUPs are common when a contract, regulation, or grant agreement calls for a narrow factual check rather than a broad opinion.
Common Reasons Companies Get an Attestation
Most attestation engagements you’ll encounter fall into a handful of recurring categories.
SOC Reports for Service Providers
If your company handles data or transactions for other businesses — cloud hosting, payroll, payment processing — your customers’ auditors and procurement teams will almost certainly ask for a Service Organization Controls (SOC) report.
SOC 1 covers controls that affect customers’ financial reporting. If you process payroll for a client, errors in your controls flow straight into that client’s financial statements, and their auditor needs comfort with your controls to sign off on their audit. SOC 2 is broader, evaluating controls against five trust services criteria: security, availability, processing integrity, confidentiality, and privacy.7AICPA & CIMA. SOC 2 – SOC for Service Organizations Trust Services Criteria Security is mandatory in every SOC 2; the other four are included when they’re relevant. SOC 3 covers the same ground as SOC 2 but is written for public distribution with less detail.
Within SOC 1 and SOC 2, watch the Type 1 versus Type 2 distinction. A Type 1 report evaluates whether controls are properly designed at a single point in time. A Type 2 report tests whether those controls actually operated effectively over a period, typically three to twelve months. Most sophisticated buyers insist on Type 2, since a well-designed control that no one follows is worthless.
Compliance Attestation
Compliance engagements test whether you’re meeting the requirements of a specific law, regulation, or contract. Federal grant recipients often need to show that funds were spent on allowed purposes. Franchisees are sometimes required to demonstrate they hit operational standards. The CPA measures your actual practices against those specific requirements and reports the results.
Financial Forecasts and Projections
Companies seeking financing or preparing for a merger often present forecasts to investors or acquirers. A CPA can attest to whether the underlying assumptions are reasonable and whether the presentation follows proper methods.8Public Company Accounting Oversight Board. AT Section 301 – Financial Forecasts and Projections The CPA is not promising the projected numbers will come true. The work covers the process and assumptions, not the outcome.
Management’s Discussion and Analysis
Public company annual reports include an MD&A section — management’s narrative about financial condition, results, and outlook. A CPA can perform an examination or review of MD&A, checking that required elements are present, that historical figures tie to the audited financial statements, and that forward-looking assumptions have a reasonable basis.9Public Company Accounting Oversight Board. AT Section 701 – Management’s Discussion and Analysis
When Attestation Is Legally Required
Most attestation engagements are voluntary, driven by contract terms or market expectations. For public companies, one category is mandatory: internal control over financial reporting under the Sarbanes-Oxley Act.
Section 404 of Sarbanes-Oxley requires public companies to include an internal control report in their annual filing, and subsection (b) requires the company’s auditor to attest to management’s assessment of those controls.10GovInfo. 15 USC 7262 – Management Assessment of Internal Controls That attestation follows PCAOB standards and is integrated with the annual financial statement audit. The auditor evaluates both the design and the operating effectiveness of controls, working top-down from entity-level controls through to account-level controls.11Public Company Accounting Oversight Board. AS 2201 – An Audit of Internal Control Over Financial Reporting
Not every public company faces the auditor attestation requirement. Non-accelerated filers and emerging growth companies are exempt, though they still must perform their own management assessment.10GovInfo. 15 USC 7262 – Management Assessment of Internal Controls The SEC further narrowed the accelerated filer definition to exclude companies with public floats between $75 million and $700 million that report less than $100 million in annual revenue.12SEC. Statement on the Rollback of Auditor Attestation Requirements For companies that do qualify, SOX 404(b) is usually the most expensive and time-consuming attestation they face.
Why the Report Is Credible: Independence and Honest Assertions
Two things make an attestation report worth anything. The first is CPA independence. A CPA’s independence is impaired if the practitioner or a covered member of their firm holds a financial interest in the client, serves as an officer or director, or has other relationships that create conflicts.13Public Company Accounting Oversight Board. ET Section 101 – Independence Without independence, the conclusion carries no weight, and intended users have nothing to rely on.
The second is truthful information from management. Attestation procedures are designed to catch material problems, but they assume management is not actively concealing fraud. Federal law backs this up with real penalties. A corporate officer who certifies a non-compliant financial report faces up to $1 million in fines and 10 years in prison; if the certification is willful, the penalties rise to $5 million and 20 years.14Office of the Law Revision Counsel. 18 USC 1350 – Failure of Corporate Officers to Certify Financial Reports Those penalties exist because the entire framework collapses if management can lie to the CPA without personal risk.
If you’re deciding whether you need an attestation engagement, the practical questions are: who is asking for assurance, what claim do they need tested, and how much confidence do they require? The answers point you to the level of assurance, the type of engagement, and the standards that will govern the work.