Designing Review Inquiries and Analytical Procedures Under AR-C 90

A review gives limited assurance because the accountant applies primarily analytical procedures and inquiries. Nothing else in the engagement supports the conclusion in the report, so the quality of those two procedures sets the quality of the file. This post covers how to design them under AR-C 90 as amended by SSARS 25 and SSARS 26, and what the documentation has to show.

The engagement sequence is in the AR-C 90 step-by-step guide, and the standards timeline is in SSARS in force for 2026. The audit-side version of analytics is in AU-C 520.

What the standard requires you to cover

AR-C 90 requires the accountant to design and perform analytical procedures and inquiries, plus other procedures as appropriate, to obtain sufficient appropriate review evidence as a basis for reporting whether the accountant is aware of any material modifications the statements need. The design rests on three things: the accountant's understanding of the industry, knowledge of the entity, and awareness of the risk that the accountant may unknowingly issue an inappropriate review report.

Two SSARS 25 changes shape the design:

• Materiality is set first. The accountant determines materiality for the financial statements as a whole and applies it in designing procedures and evaluating results. The standard prescribes no format. The audit materiality worksheet is built for a different engagement; a review-specific memo recording benchmark, percentage and rationale is the better record.
• Coverage is stated as an outcome. The analytics and inquiries must address all material items in the financial statements, including disclosures, and the areas where the accountant sees increased risk of material misstatement. A review file where a material account has no analytic and no inquiry fails the standard on its face.

Designing the analytical procedures

AR-C 90 requires analytics that identify and provide a basis for inquiry about relationships and items that look unusual. The required elements are:

1. Comparison of the statements with comparable prior-period information, considering changes in the entity's business and specific transactions.
2. Consideration of plausible relationships among financial and, where relevant, nonfinancial information.
3. Comparison of recorded amounts or ratios with expectations the accountant develops from relationships reasonably expected to exist.
4. Comparison of disaggregated revenue data, as applicable.

Build the expectation before you look at the answer

Item 3 is where most review files fall short. Comparing this year to last year is a comparison, not an expectation. An expectation is a number you derive independently and then compare. Interest expense equals average debt times the stated rate. Payroll expense equals headcount movement times average wage. Rent expense equals the lease schedule. Revenue equals units or billable hours times price.

When designing each procedure the standard requires the accountant to:

• determine that the procedure is suitable;
• consider the reliability of the data behind the expectation, including its source, comparability, nature and relevance;
• develop an expectation precise enough to give limited assurance that a misstatement large enough to make the statements materially misstated, alone or in aggregate, is identified;
• determine the difference from expectation that is acceptable without further investigation.

That last point is a number written in the file before the comparison, derived from the materiality memo. A threshold chosen after seeing the variances is not a threshold.

Choose the level of detail by risk

The nature, timing and extent of analytics are matters of professional judgment, from simple comparisons at statement level to detailed account analysis. Spend detail where the risk is. Monthly or quarterly disaggregation catches cutoff problems and unusual period-end entries that annual totals hide. Gross margin by product line catches misclassification between cost of goods and operating expense. Receivable days against revenue growth catches revenue recorded without collection.

AR-C 90 also states that budgets and forecasts need caution as a benchmark, because they are imprecise and open to manipulation by management to reflect desired results. Prior-period actuals and independently derived relationships carry more weight.

Investigate what falls outside the threshold

When analytics produce fluctuations that are inconsistent with other information or differ from expectation by a significant amount, the accountant investigates by inquiring of management and performing other review procedures where necessary. The accountant is not required to corroborate management's responses with other evidence. The need for further procedures arises when management cannot explain a difference or gives an explanation the accountant finds inadequate. "Volume was up" with no volume data attached is not an adequate explanation.

Designing the inquiries

AR-C 90 requires inquiry of members of management responsible for financial and accounting matters, and of others in the entity as appropriate. As amended by SSARS 25, the required subjects include:

• whether the statements are prepared and fairly presented under the framework, consistently applied, including how management determined that significant estimates are reasonable;
• identification of related parties and related party transactions, including their purpose;
• significant, unusual or complex transactions, events or matters, including changes in operations, changes to contract terms such as debt covenants, significant journal entries, transactions in the last days of the period, the status of misstatements left uncorrected in the prior review, and related party effects;
• actual, suspected or alleged fraud and noncompliance with laws and regulations, including noncompliance with tax and pension laws that affects material amounts;
• events after the balance sheet date that require adjustment or disclosure;
• the basis for management's going concern assessment and any events or conditions that cast doubt on it;
• material commitments, contractual obligations and contingencies;
• material nonmonetary transactions or transactions for no consideration;
• litigation, claims and assessments; regulator communications; and actions at owner and board meetings.

Make inquiry specific to the person and the account

A generic "inquired of management" line proves nothing. Design the inquiry by assigning each subject to the person who knows it. The controller answers on closing entries and estimates. The owner answers on related parties, side agreements and meeting actions. Operations staff answer on volume, pricing and capacity when analytics move. Record who answered, when, and what they said, then read the answers against the analytics. AR-C 90 requires the accountant to consider the reasonableness and consistency of responses against other procedures and knowledge of the business.

Inquiries also change the plan. An answer that a related party transaction exists but is not disclosed raises the risk on every related party balance. The standard treats results of inquiries and analytics as an input that can modify risk awareness.

When the evidence is not enough

If inquiry and analytics lead the accountant to a matter that puts material misstatement in question, AR-C 90 requires additional procedures sufficient either to clear the matter or to determine that it makes the statements materially misstated. If the accountant cannot obtain sufficient appropriate review evidence to form a conclusion, the accountant withdraws from the engagement. The report consequences are in review report modifications.

Agree the statements to the books

AR-C 90 requires evidence that the financial statements agree or reconcile to the accounting records. For a client on QuickBooks, that means tying the trial balance and general ledger to each statement line, and checking that top-side adjustments made outside the ledger are listed and supported. An analytic run on statements that do not agree to the ledger is analysis of the wrong numbers.

What the file must show

Review documentation has to let an experienced accountant with no connection to the engagement understand the nature, timing and extent of procedures, the review evidence obtained and the conclusions formed, and the significant matters and judgments. Specific items include:

• the engagement letter and the representation letter;
• the materiality determination and any revision of it;
• communications with management on fraud, noncompliance and significant matters;
• how any information inconsistent with the accountant's findings on a significant matter was addressed;
• who performed each procedure and the completion date, and who reviewed it for quality control and when;
• where an engagement quality review applies, the reviewer's identity and that the review was completed before the report was released.

A usable analytics workpaper holds the expectation and its source, the acceptable-difference threshold, the recorded amount, the difference, the explanation with the name of the person who gave it, and the follow-up when the explanation fell short.

Sources

• AICPA, SSARS No. 25, Materiality in a Review of Financial Statements and Adverse Conclusions (February 2020): https://assets.ctfassets.net/rb9cdnjh59cm/5BMOcgkNedJtTs90b7cnrs/b6d98fb77d96db625e9154050be92e2e/92317096_ssars-25.pdf
• AICPA, SSARS No. 25 At a Glance: https://assets.ctfassets.net/rb9cdnjh59cm/37wTF1wRjO6Gg0XZmCAfg5/3eb4c95d450c4c45a693b25690e10ab5/ssars-25-at-a-glance.pdf
• AICPA, SSARS No. 26, Quality Management for an Engagement Conducted in Accordance With SSARS (June 2022): https://assets.ctfassets.net/rb9cdnjh59cm/3de2ucl8GiBDR19TLMp9yP/f38dfa742630038cbf1e63ca4a167065/ssars-26.pdf
• PacificCPE, SSARS Nos. 21-23 course text (AR-C 90 analytics, inquiry and reconciliation requirements): https://pacificcpe.s3.amazonaws.com/2001A_-_SSAR_21-23.pdf?1559607826
• Western CPE, SSARS 25: 10 useful pro tips: https://www.westerncpe.com/western-alert/ssars-25-10-useful-pro-tips/

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error