Attest services are professional engagements in which an independent CPA examines information prepared by someone else and issues a written conclusion about how reliable it is. The point is leverage: an outside expert’s conclusion carries weight that a company’s own claims about its numbers, its controls, or its security never will. Businesses commission these engagements, or are forced into them, whenever a regulator, lender, customer, or statute demands independent verification of something the business has reported.
Every attestation involves three parties. The practitioner is the CPA doing the work, who must be independent of the entity being evaluated. The responsible party is the company or management team that prepared the information and stands behind it. The intended users are the people the report is written for: creditors, shareholders, regulators, or prospective business partners. The subject matter can be almost anything measurable against a defined set of criteria, from the effectiveness of internal controls over financial reporting to compliance with a contract, the accuracy of sustainability metrics, or the reliability of a cloud provider’s security systems.
The Three Levels of Assurance
Attest engagements come in three types, and the type determines how much confidence a reader can place in the conclusion. Confusing them is the single most common mistake businesses make when they commission or receive one.
Examination (Reasonable Assurance)
An examination is the most rigorous engagement. The practitioner performs detailed testing, observation, and corroboration of evidence, similar in depth to a full financial statement audit, and issues a positive opinion: “In our opinion, the subject matter is presented fairly, in all material respects, based on [the established criteria].” This is called reasonable assurance. It means the risk that a material misstatement went undetected is low, though not zero. It is the strongest level an attestation engagement provides.
Review (Limited Assurance)
A review is narrower. The practitioner relies mostly on inquiry and analytical procedures rather than the detailed corroborating work an examination requires. The conclusion comes in negative form: “We are not aware of any material modifications that should be made to the subject matter for it to be in conformity with [the established criteria].” That is limited assurance. It offers moderate confidence but leaves open the possibility that a deeper look would turn up problems.
Agreed-Upon Procedures (No Assurance)
In an agreed-upon procedures engagement, the practitioner performs only the specific steps the parties define and reports the factual findings. There is no overall opinion. A typical finding reads: “We compared the interest rate in the loan agreement to the rate recorded in the general ledger and found them to be consistent.” The parties who requested the procedures bear the risk of deciding whether those steps were enough to cover what they cared about.
AUP engagements became more flexible under SSAE No. 19. The AICPA removed the previous requirement that the practitioner obtain a written assertion from the responsible party, allowed procedures to be developed during the engagement rather than fixed entirely in advance, and broadened who may use the final report. Earlier standards restricted AUP reports solely to the parties who agreed upon the procedures; the updated standard gives practitioners more latitude on distribution.
When a Business Actually Needs One
The practical answer to “when do I need this” is: when someone with leverage over your business asks for it. That ask comes from a handful of recurring sources.
Federal Grant Spending
Organizations that spend $1,000,000 or more in federal awards during a fiscal year must undergo a single audit (or program-specific audit) under the Uniform Guidance. The threshold was raised from $750,000 in April 2024 and applies to federal awards issued after October 1, 2024, which makes it effective for fiscal years ending on or after September 30, 2025. Organizations spending less than $1,000,000 are generally exempt from the federal audit requirement for that year. The single audit itself is an examination-level engagement covering both financial statements and compliance with federal program requirements.
Public Company Internal Controls
Section 404(b) of the Sarbanes-Oxley Act requires public companies to include an independent auditor’s attestation report on the effectiveness of internal controls over financial reporting in their annual filings. Not every public company is on the hook. Non-accelerated filers, generally those with a public float under $75 million, are exempt. Smaller reporting companies with a public float of $75 million or more but revenues under $100 million also qualify as non-accelerated filers and remain exempt. Once a company crosses the accelerated-filer threshold, the attestation requirement applies.
Loan Covenants
Lenders routinely build attestation requirements into loan agreements. A bank extending a significant credit line may require audited or reviewed financial statements each year, or a CPA examination of compliance with specific covenants such as debt-to-equity ratios or minimum net worth. Missing the delivery deadline can trigger a technical default even if the borrower is current on payments. Which engagement type you owe depends on exactly what the loan documents say.
Customers and Business Partners
Companies that handle sensitive data or process transactions for others face attestation demands from the people they want to do business with. A SaaS company storing client data will almost always be asked for a SOC 2 report before an enterprise customer will sign. Franchise systems, joint ventures, and royalty arrangements commonly require attestation of reported revenue so both sides can trust the numbers flowing between them.
SOC Reports in Practice
Service Organization Control (SOC) reports are among the most common attestations businesses encounter by name. They are all examination-level engagements, and they come in three flavors for different purposes.
A SOC 1 report examines internal controls at a service organization that could affect its clients’ financial reporting. Payroll processors, benefits administrators, and financial services firms handling transaction data for other companies are the typical candidates. If an error at the service organization could cause a material misstatement in a client’s financial statements, SOC 1 is the right engagement.
A SOC 2 report evaluates controls related to security, availability, processing integrity, confidentiality, and privacy, built on the AICPA’s Trust Services Criteria. The focus is on whether the organization’s systems are reliable and secure rather than on financial reporting. Cloud providers, fintech companies, healthcare technology firms, and anyone else processing sensitive data on behalf of others typically need one. SOC 2 engagements come in two forms: a Type 1 report evaluates whether controls are properly designed at a single point in time, while a Type 2 report tests whether those controls actually operated effectively over a period, typically three to twelve months. Most sophisticated buyers will accept nothing less than a Type 2.
A SOC 3 report covers the same Trust Services Criteria as SOC 2 but produces a simplified, general-use document suitable for public distribution. SOC 2 reports contain detailed findings and usually move under nondisclosure agreements; SOC 3 is built for websites and marketing to audiences who do not need the technical detail.
What Makes the Report Worth Anything
Two conditions have to be met before an attestation report is worth the paper it is printed on.
The first is suitable criteria. The subject matter has to be capable of consistent evaluation against a benchmark, and under the AICPA’s framework that benchmark must be relevant, objective, measurable, and complete. The criteria also need to be available to the intended users so they can understand how the evaluation was done. Without suitable criteria, a practitioner has no benchmark and should decline the engagement.
The second is independence. It has two dimensions: independence in fact, meaning the practitioner’s state of mind genuinely allows them to act with integrity and objectivity, and independence in appearance, meaning the practitioner avoids circumstances that would cause a reasonable outside observer to question that objectivity. Holding a financial interest in the entity, providing management-level services during the engagement period, or having close personal relationships with the responsible party’s leadership all compromise it. When independence is gone, the conclusion is worthless, because an outside perspective was the whole point.
The practitioner also needs real expertise in the specific subject matter. Evaluating cybersecurity controls for a SOC 2 report calls for different skills than examining compliance with federal grant requirements. Accepting an engagement without that expertise violates professional standards.
Reading the Final Report
The report identifies the subject matter examined, the criteria used, the responsible party, and, critically, the level of assurance. The reader needs to see immediately whether they are holding an examination, a review, or an AUP, because that signals how much weight the conclusion carries.
For examinations, the conclusion takes one of four forms:
- Unmodified (clean): the subject matter is presented fairly in all material respects according to the established criteria. The outcome everyone wants.
- Qualified: fairly presented except for a specific, identified issue. The problem is material but confined to one area.
- Adverse: the subject matter is materially and pervasively misstated, or the responsible party fundamentally failed to meet the criteria. The worst outcome.
- Disclaimer: the practitioner could not obtain sufficient evidence to form any conclusion, typically because of scope limitations outside their control. No assurance is being provided.
Review engagements use the same spectrum but phrase conclusions in negative form. An unmodified review conclusion states the practitioner is not aware of material modifications that should be made; a modified one identifies specific concerns.
One thing to keep in mind when relying on any attestation: assurance is not a guarantee. Reasonable assurance, the highest level available, means the practitioner gathered enough evidence to conclude the risk of an undetected material misstatement is low. Limited assurance provides less confidence than that, and AUP engagements provide none at all. The report reduces risk for the people reading it. It does not eliminate it.