SSAE 22 and AT-C 210: Review Engagements Under the Attestation Standards

SSAE No. 22, Review Engagements, was issued by the AICPA Auditing Standards Board in December 2020. It supersedes SSAE No. 18's section 210 of the same title, so AT-C 210 now means the SSAE 22 version. It applies to attestation reviews: engagements where a practitioner reports limited assurance on subject matter or an assertion about it, such as a compliance statement, a sustainability metric or a performance measure.

Do not confuse AT-C 210 with AR-C 90. AR-C 90 is the review of historical financial statements under SSARS. AT-C 210 is the review of other subject matter under the attestation standards. This page covers the second. For the first, see review engagement under AR-C 90.

This page paraphrases the standard. Read AT-C 105 and AT-C 210 in AICPA Professional Standards for the full text.

When does it apply?

SSAE 22 applies to practitioners' review reports dated on or after June 15, 2022. Early implementation was allowed only if the practitioner also early implemented the AT-C 105 amendments from SSAE No. 21, Direct Examination Engagements. Reviews now in progress follow the SSAE 22 version.

What is the objective of a review?

The objective of an attestation review is to obtain limited assurance about whether the subject matter needs material modification to be in accordance with, or based on, the criteria. The conclusion is therefore expressed negatively: nothing came to the practitioner's attention that indicates the subject matter requires material modification. That is lower assurance than an examination, where the practitioner reaches a positive opinion. See examination engagement and SSAE 18 overview.

The Auditing Standards Board said SSAE 22 clarifies that the objective of a review is to obtain limited assurance and is not an exercise in performing analytical procedures and inquiries. The practitioner designs and performs procedures to obtain that assurance and cannot treat a routine set of inquiries as the engagement.

What changed from the old AT-C 210?

Three changes are visible in the standard and in the AICPA's description of it:

1. Procedures are described in the report. Review reports now disclose the procedures performed to obtain limited assurance. A reader can see what the practitioner did, and the practitioner needs a documented basis for the conclusion.
2. Adverse conclusions. A practitioner may issue an adverse review conclusion when the subject matter is materially and pervasively misstated. The ASB chair described this as letting the practitioner express an adverse conclusion when appropriate.
3. Alignment with the revised examination standard. SSAE 22 conforms AT-C 210 concepts with AT-C 205, as revised by SSAE 21, so the same terms and structure run through examination, direct examination and review.

How does a review differ from an examination and an AUP?

Choosing the engagement is a client conversation. A bank asking for comfort on a covenant calculation may be satisfied by a review, an AUP or an examination, and each carries a different price, timeline and liability. The engagement letter must name the level and the conclusion type. See agreed-upon procedures engagements.

What does the practitioner have to establish at acceptance?

AT-C 105 sets the acceptance conditions that apply to every attestation engagement and that AT-C 210 builds on. In plain terms the practitioner needs to conclude that:

• the practitioner is independent where required and competent to perform the engagement
• the subject matter is appropriate and identifiable
• the criteria are suitable and available to intended users
• a responsible party is identified
• sufficient appropriate evidence is expected to be obtainable for a limited-assurance conclusion

The AICPA's independence rules apply to a review as to an examination. Nonattest services provided to the same client, such as bookkeeping, have to clear the nonattest services evaluation.

A worked illustration

Illustrative only. A nonprofit's lender asks for a report on the nonprofit's quarterly covenant compliance certificate. The certificate shows a debt service coverage ratio of 1.35 against a covenant minimum of 1.25. Cash flow available for debt service is $540,000 and debt service is $400,000, so $540,000 / $400,000 = 1.35. In a review the practitioner would recompute the ratio from the general ledger, compare components to the trial balance, make inquiries about unusual items, and perform analytical procedures on the components. The report would describe those procedures and conclude whether anything came to the practitioner's attention indicating the certificate requires material modification. An examination would add tests of the underlying transactions and end in an opinion.

Frequently asked questions

Is AT-C 210 the same as a review of financial statements?

No. A review of historical financial statements is performed under AR-C 90 and SSARS. AT-C 210 covers reviews of other subject matter or assertions under the attestation standards.

What assurance does a review provide?

Limited assurance. It is lower than the reasonable assurance of an examination and higher than the no-assurance findings of an agreed-upon-procedures report.

Can a practitioner issue an adverse conclusion in a review?

Yes. SSAE 22 allows an adverse conclusion when the subject matter is materially and pervasively misstated.

When did SSAE 22 take effect?

For review reports dated on or after June 15, 2022.

Sources

• AICPA Auditing Standards Board, SSAE No. 22, Review Engagements (December 2020); Journal of Accountancy, "AICPA auditing standard on scope of review engagements" (December 2020)
• AICPA Professional Standards, AT-C 105, AT-C 205, AT-C 210, AT-C 215

Related

• SSAE 18 attestation standards overview
• Agreed-upon procedures engagements
• Compilation vs review vs audit
• Agreed-upon procedures report template

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error