What Is ISRE 2400? Limited Assurance, Procedures, and Reports

ISRE 2400 (Revised) is the international standard that governs review engagements of historical financial statements when the practitioner performing the work is not the entity’s auditor. Issued by the International Auditing and Assurance Standards Board (IAASB) and effective for reviews of periods ending on or after December 31, 2013, it lets a practitioner provide limited assurance through inquiries and analytical procedures rather than the detailed testing an audit demands.¹ For entities that need professional credibility with lenders or investors but face no statutory audit requirement, it offers a middle path between unreviewed financials and a full audit.

What Limited Assurance Means

The practitioner’s objective under ISRE 2400 is narrow. After performing the review, they must be in a position to say whether anything has come to their attention that causes them to believe the financial statements are not prepared, in all material respects, in accordance with the applicable financial reporting framework.¹ That is limited assurance, sometimes called negative assurance, and it sits below the reasonable assurance produced by an audit.

The scope limitation has practical consequences. A review does not require the practitioner to evaluate internal controls, confirm balances with third parties, physically inspect assets, or test samples of transactions against source documents. There is no audit-style risk assessment. The practitioner instead works from inquiries directed at management and from analytical procedures applied to the financial data. Stakeholders get more comfort than they would from unreviewed statements, without the cost and disruption of an audit.

ISRE 2400 or ISRE 2410

ISRE 2400 does not cover every review. When the entity’s own auditor performs the review, ISRE 2410 governs the engagement instead. The IAASB drew the line this way because an auditor already carries audit-based knowledge of the business into the review, while a practitioner working under ISRE 2400 is assumed to build that understanding from scratch.² If you are engaging your existing auditor to review historical financial statements, ISRE 2410 applies, not ISRE 2400.

Accepting the Engagement

Before any fieldwork, the practitioner decides whether the engagement is one to accept. The financial reporting framework the entity uses has to be acceptable for the purpose the statements will serve. If the framework will not produce meaningful information for the intended users, the practitioner should decline.

Terms then go into an engagement letter. ISRE 2400 expects it to cover:

The objective and scope of the review, with a reference to ISRE 2400 and identification of the financial statements involved.
Management’s responsibility for preparing the statements and for providing complete, accurate information.
The practitioner’s unrestricted access to whatever records they need.
An explicit statement that the engagement cannot be relied on to detect errors, fraud, or illegal acts, and that no audit is being performed and no audit opinion will be expressed.
A specimen of the report the practitioner expects to issue.

Including the sample report matters. It heads off the most common misunderstanding in review work, which is a client expecting audit-level assurance from a review-level engagement. Seeing the report format at the start leaves less room for disappointment at the end.

Setting Materiality

The practitioner determines materiality for the financial statements as a whole before designing procedures. Materiality here means the largest misstatement that could exist without changing the economic decisions of the people relying on the statements, and it involves both quantitative thresholds and qualitative judgment.³

The right level depends on who reads the statements and what they focus on. A bank evaluating a loan cares about asset values and debt ratios. An investor in a growth-stage company cares about revenue trends and cash burn. Common benchmarks include a percentage of pre-tax income for profit-oriented entities, or a percentage of revenues or total assets for not-for-profits.

One difference from audit practice: ISRE 2400 does not require the practitioner to calculate performance materiality, the buffer below overall materiality that auditors use to reduce the risk that uncorrected and undetected misstatements add up past the threshold. Reviews skip that step, which reflects the lower level of assurance involved.³ Materiality is not fixed either. If something learned during the review would have changed the initial level, the practitioner revises it and reconsiders the work already done.

Inquiry and Analytical Procedures

The two pillars of a review engagement are inquiry and analytical procedures.

Inquiry

The practitioner questions management and others involved in the entity’s financial and accounting functions. ISRE 2400 (Revised) specifies areas these inquiries must cover, among them significant changes in the business, unusual transactions, management’s assessment of the entity’s ability to continue as a going concern, and any events or conditions that cast doubt on that assessment.⁴ In a smaller entity where management may not have prepared a formal going concern assessment, the practitioner discusses medium and long-term prospects and financing arrangements to form their own understanding.

Analytical Procedures

Analytical procedures study relationships in the financial data to identify unusual patterns or unexpected results. The practitioner compares current-period figures to prior periods, budgets, or industry norms and investigates significant fluctuations, or items that stay flat when they should have moved. A revenue line unchanged after the addition of a major customer, or cost of goods sold that drops without an obvious reason, both flag the need for follow-up.

When Something Looks Wrong

If initial inquiries or analytics suggest the financial statements might be materially misstated, the practitioner cannot simply note the concern. ISRE 2400 (Revised) requires additional procedures aimed at either resolving the issue or confirming that a modified conclusion is needed.⁴ The standard expects the practitioner to obtain evidence rather than accept a plausible-sounding explanation and move on.

Going Concern

Going concern feels like audit territory, but ISRE 2400 (Revised) addresses it directly. The practitioner asks management about the basis for its going concern assessment and about any events or conditions that could threaten the entity’s viability.⁴ Mitigating factors can offset red flags. An entity that cannot meet debt repayments may still have a credible plan to sell assets, renegotiate loan terms, or raise fresh capital, and the practitioner weighs those plans against the severity of the underlying problem. Unresolved doubt affects the practitioner’s conclusion and may require disclosure or modification of the report.

Management Representations

Written representations from management are a required piece of evidence, and the revised standard tightened this area compared with the original ISRE 2400, which obtained representations “when considered appropriate” and left much to judgment.⁵ Management now confirms in writing that it has fulfilled its responsibilities for preparing the financial statements and for providing the practitioner with complete information.

Refusal has consequences. If management declines to provide one or more of the requested representations, the practitioner discusses the matter with management and those charged with governance, reassesses management’s integrity, and evaluates what the refusal means for the reliability of all other evidence obtained during the review.⁶ If doubt about management’s integrity is sufficient to make the representations unreliable, or if management will not confirm it has met its fundamental responsibilities, the practitioner either disclaims a conclusion or withdraws from the engagement.

The Review Report

The report is the only part of the engagement most stakeholders see, and its contents are prescribed. It opens with a title identifying the practitioner as independent, names the addressee, and specifies which financial statements were reviewed and the periods they cover.¹

An unmodified conclusion uses the negative assurance format. The practitioner states that, based on the review, nothing has come to their attention causing them to believe the financial statements do not give a true and fair view in accordance with the applicable framework. The double negative is deliberate. It tells the reader that the practitioner is not guaranteeing the statements are correct, only reporting that nothing surfaced to suggest otherwise. The report also sets out management’s responsibilities, the practitioner’s responsibilities, and the nature of the procedures performed.

Modified Conclusions

Not every review ends clean. ISRE 2400 (Revised) provides for three types of modified conclusion:³

A qualified conclusion, when the financial statements are materially misstated but the effects are not pervasive, or when the practitioner cannot obtain sufficient evidence and the possible effects could be material but not pervasive.
An adverse conclusion, when the statements are materially misstated and the effects are both material and pervasive to the statements as a whole.
A disclaimer of conclusion, when the practitioner cannot obtain sufficient evidence and the possible effects could be both material and pervasive. A disclaimer is also required when doubt about management’s integrity makes written representations unreliable, or when management refuses to confirm it has fulfilled its fundamental responsibilities.

The dividing line between qualified and adverse is the word pervasive. A misstatement is pervasive when it is not confined to specific elements of the statements, when it represents a substantial proportion of them, or when it relates to disclosures fundamental to the user’s understanding. A single overvalued receivable might warrant a qualified conclusion. Systematic revenue recognition errors across the whole business would likely call for an adverse conclusion.

Documentation

The practitioner documents the matters that support the conclusion and show that the review was carried out in accordance with ISRE 2400. Working papers capture the results of inquiries, the analytical procedures performed and their outcomes, any additional procedures triggered by suspected misstatements, and the reasoning behind the final conclusion. These records are what the practitioner relies on if the engagement is later questioned by regulators, professional bodies, or in litigation, and incomplete documentation is among the most common deficiencies regulators flag in practice inspections.

1
International Auditing and Assurance Standards Board. Engagements to Review Historical Financial Statements
2
International Auditing and Assurance Standards Board. IAASB Amends International Standards on Review Engagements to Clarify Their Applicability
3
International Federation of Accountants. Guide to Review Engagements
4
Malaysian Institute of Accountants. ISRE 2400 (Revised), Engagements to Review Historical Financial Statements
5
International Federation of Accountants. ISRE 2400 – Engagements to Review Financial Statements
6
International Auditing and Assurance Standards Board. ISRE 2400 (Revised), Engagements to Review Historical Financial Statements – IAASB 2023-2024 Handbook Volume 3