Engagement letter

When an assurance engagement has been scoped out and both parties are ready to go ahead, an engagement letter is drawn up. This guidance sets out what should be expected from an engagement letter, which forms the contractual basis for an assurance engagement.

With the scope and structure of the assurance engagement established, the next stage for consideration by the practitioner is the execution of the assurance engagement.

In the same way that a comprehensive understanding of assurance is required for the appropriate scoping of the engagement, there is a critical requirement for the practitioner to be appropriately versed and experienced in assurance to deliver the assurance engagement. Quality is paramount.

There is a public expectation, and an ethical requirement as an ICAEW Chartered Accountant, to deliver the assurance engagement with integrity, with respect to professional standards and guidelines and to the required standard of quality.

The engagement letter is the document that the client and the practitioner agree on as the basis for the engagement. So it needs to be:

• Clear and unambiguous.
• Specific to the client and the subject matter.
• Explicit in terms of what will and what will not be done including any known limitations in scope.

Accepting an engagement

When accepting an engagement, it is important that practitioners take the necessary steps to ensure quality and appropriately manage the engagement as a professional service. Considerations relate to:

• acting in accordance with the ethical and other professional standards expected of a professional service provider; and
• properly discharging their contractual, legal, regulatory or professional responsibilities.

Therefore, the practitioner accepts an assurance engagement only where the practitioner’s preliminary knowledge of the engagement circumstances indicates that the practitioner:

• Satisfies relevant ethical and professional standards, including independence requirements and applicable quality control requirements.
• Complies with applicable legal and regulatory requirements and refers to available guidance materials.
• Is satisfied that the engagement exhibits all of the following characteristics:
  - the subject matter is appropriate;
  - the criteria to be used are suitable and will be available to the intended users of the assurance report;
  - the practitioner will have access to sufficient appropriate evidence to support the conclusion;
  - the practitioner’s conclusion, in the form appropriate to either a reasonable or limited assurance engagement, is to be contained in a written report;
  - the practitioner is satisfied that there is a rational purpose for the engagement; and
  - the practitioner believes that the client has no intention to associate the practitioner’s name with the subject matter or subject matter information in an inappropriate manner.
• Agrees to provide services only when the engagement team collectively possesses the necessary professional competencies, having regard to the nature of the assignment. As required by the Code of Ethics, the practitioner should not accept an assurance engagement if they are not satisfied that the persons who are to perform the engagement collectively possess the necessary professional competencies.
• When appropriate, restricts the use and distribution of the assurance report to specified users.

The ability of the practitioner to perform the engagement and to report on the findings depends on information and access being provided by the responsible party.

The nature of the information and access required will be agreed, formally and in writing, between the practitioner, the client, and where appropriate, other parties to the engagement. This requirement for information and access will be referred to in the engagement letter.

The practitioner ensures that the criteria that are to be applied during the engagement and in the assurance report are clearly communicated by including appropriate references in the engagement letter.

The practitioner reads the terms of the contract agreed between the responsible party and the users where relevant and considers the impact on the assurance engagement. For instance, unless specifically agreed in writing, the practitioner is not bound by any form of report or the terms of contract agreed between the client and any other party.

This is because, for example, the terms of business between the client and its customer might impact on the ability of the practitioner to reach an independent conclusion in the proposed engagement.

The terms of contract agreed between the client and its customer may prescribe specific wording to be used which may be inappropriate in an assurance report.

Where the practitioner becomes aware that there is such an agreement and has identified that the form of report expected from the practitioner is inappropriate because the requirements of professional guidance would not be met, the practitioner considers the implications of this for the engagement, which may ultimately result in the practitioner declining the engagement.

To best manage the risk of confusion regarding the form of the final report, a draft of the form and wording of the report should be included/attached to the engagement letter for discussion and agreement with the client and any other recipients as required.

The assurance report may also be received by a range of persons who are not party to the engagement. The practitioner does not normally intend to assume responsibility to persons who are not party to the engagement, but legal actions from such persons may nonetheless occur. The practitioner therefore needs to apply appropriate engagement acceptance procedures in order to assess the risks associated with taking on a particular engagement and accordingly whether to do so and, if so, on what terms.

Where the practitioner accepts such an engagement, suitably rigorous internal risk management policies are applied to manage any increased level of risk. Guidance is available in AAF 04/06 Assurance engagements: Management of risk and liability.

• Read more on professional ethics and independence

Quality control

The practitioner performs the assurance engagement in the same professional manner as any other engagement and in accordance with the scope agreed and recorded in the engagement letter. If it is necessary to depart from the terms of the engagement letter, the practitioner agrees an amended scope of work in writing with the client and where applicable, with other parties to the engagement.

• Read more on gather evidence in assurance engagements, in our section on fieldwork. 

When performing an assurance engagement under ISAE 3000 (Revised), the practitioner is subject to ISQC 1. ISQC 1 requires that a firm of professional accountants has an obligation to establish a system of quality control designed to provide it with reasonable assurance that the firm and its personnel comply with relevant professional standards and regulatory and legal requirements and that the assurance reports issued by the firm or engagement partners are appropriate in the circumstances.

The elements of such a system of quality control which are relevant to an individual engagement include leadership responsibilities for quality of the engagement, ethical requirements, acceptance and continuance of client relationships and specific engagements, assignment of engagement teams, engagement performance (in particular supervision, consultation, review and documentation) and monitoring.

Agreeing terms with the client

When the practitioner is requested to provide an assurance report, it is important that there is clear understanding and agreement concerning the scope and purpose of the engagement between the practitioner, the client and where appropriate other engaging parties or the intended users who are receiving the report. To help avoid possible misunderstandings, the agreed terms are recorded in writing.

Even when the engagement letter describes the type of report that will be delivered, there can be misunderstandings between the practitioner and the user as to what the final report will look and feel like.  For this reason, it can be a good idea to include a proforma report as an appendix to an engagement letter, although it’s important to make it clear that any such drafts will, of course, be affected by the findings of the engagement.

AAF 04/06 sets out detailed matters to note in relation to the terms of engagement and how the overall risks of the engagement may be managed by the practitioner. However, these will need to be carefully applied to the particular engagement circumstances because AAF 04/06 primarily focuses on situations where the responsible party is the client.

• Read more on agreeing the terms on an engagement

Requirements for an engagement letter

It is in the interests of the practitioner, the responsible party and the user for the engagement letter to include details of those elements of an assurance engagement that are required, by the International Framework for Assurance, to be in place, identifying:

• the three separate parties to the engagement practitioner, responsible party, and intended users;
• the appropriate underlying subject matter and subject matter information;
• the suitable criteria to be applied and the requirement that these be made available to users;
• the expectation that the responsible party – or others – will provide access to information of the required quality, enabling the engagement practitioner to obtain sufficient, appropriate evidence; and
• the expected form of written assurance report.

Other matters that might be addressed in the engagement letter include:

• the objective and scope of the assurance engagement;
• the responsibilities of the responsible party and measurer or evaluator, including responsibility for the preparation and presentation of the subject matter information and to establish and maintain effective internal controls;
• the practitioner’s responsibilities including responsibilities in relation to any other information that is to be presented with the subject matter information;
• which assurance standards and related guidance, if any, will be applied;
• the expectation that management will provide written representations;
• restrictions on the approved use of the deliverables;
• a description of the scope of testing;
• terms limiting the practitioner’s liability; and
• commercial matters such as fee, timetable, termination rights.

Page reviewed April 2018. Next review due April 2019.