SSARS Explained: Compilation vs Review vs Audit (AR-C 70, 80 and 90)

A client asks for "financials for the bank." The lender's covenant says "reviewed." A board member asks why the firm cannot "just do an audit." Sorting out these requests starts with knowing exactly what each service is, what it costs the firm to perform, and what the user actually receives.

This guide explains the Statements on Standards for Accounting and Review Services (SSARS), codified in the AR-C sections, and compares preparation, compilation and review engagements with an audit performed under GAAS (the AU-C sections). It paraphrases the standards, which are in AICPA Professional Standards.

What are the SSARS?

The SSARS are issued by the AICPA's Accounting and Review Services Committee (ARSC). They apply when a CPA in public practice is engaged to prepare, compile or review the financial statements of a nonissuer. The sections most firms use are:

• AR-C 60, General Principles for Engagements Performed in Accordance With SSARS
• AR-C 70, Preparation of Financial Statements
• AR-C 80, Compilation Engagements
• AR-C 90, Review of Financial Statements

The SSARS also have conforming amendments for the AICPA quality management standards (SSARS No. 26), effective alongside SQMS No. 1 and SAS No. 146.

The SSARS apply based on what the CPA is engaged to do. If a firm is engaged to prepare financial statements, AR-C 70 applies. If it is engaged to perform a compilation or review, AR-C 80 or AR-C 90 applies. Bookkeeping or tax work alone, without an engagement to prepare financial statements, does not by itself trigger the SSARS.

Preparation of financial statements (AR-C 70)

A preparation engagement is the lightest SSARS service. The accountant prepares financial statements using the records, documents, explanations and other information provided by management.

Key points:

• No assurance. The accountant does not verify the information or obtain evidence about it.
• No report. There is no accountant's report. Instead, each page of the financial statements must include a statement that no assurance is provided. If the accountant cannot include that statement, AR-C 70 points to other options, such as performing a compilation instead.
• Independence not required to be determined. Because preparation is a nonattest service for purposes of the Code, independence is not a precondition, though independence still matters if the firm also performs attest work for the same client.
• Engagement letter required. AR-C 70 requires the accountant and management to agree on the terms in writing, signed by the accountant or firm and by management or those charged with governance.
• Basis of accounting. The financial statements can be prepared under GAAP or a special purpose framework, such as cash, modified cash or tax basis; statements prepared under a special purpose framework include a description of that framework. Material departures and omitted disclosures must be disclosed.

A preparation engagement can fit a small owner-managed business that needs financial statements for internal use or for a lender that does not require a CPA report.

Compilation engagements (AR-C 80)

In a compilation, the accountant applies accounting and financial reporting expertise to assist management in presenting financial information without obtaining or providing assurance. The difference from a preparation engagement is the report: a compilation always results in an accountant's compilation report.

Key points:

• No assurance. The accountant does not express an opinion, a conclusion or any form of assurance.
• Procedures. The accountant must understand the financial reporting framework and the significant accounting policies, read the financial statements for obvious material misstatements, and follow up when information appears incorrect, incomplete or otherwise unsatisfactory. There is no requirement to perform inquiry or analytical procedures, and no requirement to verify records.
• Independence. A compilation can be performed when the accountant is not independent, but the report must state that the accountant is not independent. The accountant may disclose the reasons for the impairment; if the accountant chooses to describe the reasons, all of them must be described.
• Engagement letter required, signed by both parties.
• Omitted disclosures. Management can elect to omit substantially all disclosures. The compilation report must disclose that election, and the omission cannot be intended to mislead users.
• Report. The report states that management is responsible for the financial statements, that the accountant performed the compilation under the SSARS, and that no opinion, conclusion or assurance is expressed.

Review engagements (AR-C 90)

A review gives limited assurance. The accountant obtains limited assurance as a basis for reporting whether the accountant is aware of any material modifications that should be made to the financial statements for them to be in accordance with the applicable framework.

Key points:

• Independence required. An accountant who is not independent cannot issue a review report.
• Procedures. The accountant performs primarily analytical procedures and inquiries of management, designed based on the accountant's understanding of the industry, the entity and the areas where material misstatements are likely to arise. The accountant develops expectations for analytical procedures and investigates significant differences.
• Materiality. AR-C 90 requires the accountant to determine materiality for the financial statements as a whole and apply it in designing procedures and evaluating results. The concept is consistent with audit materiality under AU-C 320. The materiality calculator can help with the arithmetic.
• No control testing or external evidence required. A review does not require obtaining an understanding of internal control for purposes of assessing control risk, testing records through inspection or confirmation, or other audit procedures. If the accountant becomes aware of information that the statements may be materially misstated, additional procedures are required.
• Written representations. A representation letter from management is required.
• Going concern. The accountant considers whether there is substantial doubt about the entity's ability to continue as a going concern and evaluates management's disclosures.
• Documentation. The file must show the analytical procedures performed (including expectations and significant differences), the significant inquiries and responses, significant findings, and the representation letter.
• Report. The review report includes a conclusion stating whether the accountant is aware of any material modifications that should be made to the financial statements.

What does an audit add?

An audit under GAAS gives reasonable assurance, a high but not absolute level of assurance, that the financial statements as a whole are free from material misstatement, whether due to fraud or error. To get there, the auditor:

• assesses risks of material misstatement under AU-C 315, including understanding the components of internal control and evaluating the design and implementation of certain controls
• designs further audit procedures that respond to those risks under AU-C 330, including tests of details and, where planned, tests of controls
• obtains external evidence such as confirmations (AU-C 505) and observes inventory counts where material (AU-C 501)
• evaluates misstatements under AU-C 450
• documents the work under AU-C 230
• issues an opinion under AU-C 700

Compilation vs review vs audit: comparison table

Review vs audit: how to explain the difference to a client

A useful way to explain review vs audit to a client is in terms of what the CPA does and what the user can rely on.

• In a review, the CPA asks questions and analyzes the numbers. If the answers and trends make sense, the CPA says nothing came to their attention that requires material changes. The CPA does not send confirmations to customers or banks, observe inventory, or test controls.
• In an audit, the CPA independently gathers evidence, often from third parties, tests transactions and balances, considers fraud risk specifically, and gives a positive opinion on whether the statements are fairly presented.

That difference drives cost. An audit generally takes more time because of the risk assessment, the testing and the documentation.

How to choose the right engagement

Start with the user's requirement, not the client's preference.

1. Read the document that creates the requirement. Loan agreements, grant agreements, operating agreements and regulatory rules often specify the level of service and the framework. "CPA-prepared" is not the same as "reviewed."
2. Check the framework. Some lenders accept tax-basis statements; others require GAAP. Special purpose frameworks are available for all three SSARS services and for audits.
3. Check independence. If the firm also maintains the client's books or provides other nonattest services, evaluate independence under the AICPA Code's nonattest services interpretation (ET 1.295). If independence is impaired, a review or audit is off the table, while a compilation with disclosure of the impairment remains possible.
4. Consider the risk to the firm. A higher level of service brings more exposure and documentation. Price and staff accordingly.
5. Document the decision in the engagement letter, including the intended users and the framework.

Moving between levels

A client sometimes asks to change from an audit to a review, or a review to a compilation, partway through. The SSARS require the accountant to consider the reason for the request. A change because the user's requirement changed or was misunderstood is generally reasonable. A change requested because the client would not provide information, or to avoid a likely modified report, calls for caution, and the accountant should consider whether to continue.

Common SSARS mistakes

• Issuing a review report without being independent.
• Missing or unsigned engagement letters.
• Review files without documented expectations for analytical procedures.
• Review files without a representation letter dated as of the review report date.
• Compilation reports that do not disclose an independence impairment or omitted disclosures.
• Preparation engagements where the "no assurance" legend is missing from some pages.

Frequently asked questions

Are compiled financial statements reliable?

Compiled financial statements are management's representations presented with the help of a CPA who has not obtained any evidence about them. They can be accurate and useful, but the CPA's report provides no assurance, so users rely on management's integrity and processes.

Is a review cheaper than an audit?

A review generally costs less than an audit because it relies on inquiry and analytical procedures and does not require controls work, confirmations or detailed testing. The exact difference depends on the client's size, complexity and records.

Can a CPA who does the client's bookkeeping perform a review?

A CPA who provides bookkeeping can perform a review only if independence is maintained under the AICPA Code's nonattest services requirements, including management taking responsibility for the work and having the skill, knowledge or experience to oversee it. If independence is impaired, a review cannot be performed.

Do reviewed financial statements need full disclosures?

Reviewed financial statements must include the disclosures required by the applicable financial reporting framework. Omitting substantially all disclosures is permitted for preparation and compilation engagements, but not for reviews or audits.

Sources

• AICPA, AR-C Section 60, General Principles for Engagements Performed in Accordance With SSARS; AR-C Section 70, Preparation of Financial Statements; AR-C Section 80, Compilation Engagements; AR-C Section 90, Review of Financial Statements
• AICPA, SSARS No. 26, Quality Management (conforming to SQMS No. 1)
• AICPA, AU-C Section 200, 210, 230, 315, 330, 450, 501, 505, 580 and 700
• AICPA Code of Professional Conduct, ET 1.200 (Independence) and ET 1.295 (Nonattest Services)
• AICPA Peer Review Standards (scope of engagement and system reviews)

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error