1. What is the difference between an "Attestation" and a "Direct" engagement?
Under Canadian standards (CSAE 3000/3001), an Attestation Engagement is where management first provides a statement (assertion) about their compliance or data, and we provide an opinion on that statement. In a Direct Engagement, the practitioner directly evaluates the underlying subject matter (e.g., a specific set of rules) and reports the findings without needing a prior statement from management.
2. How does an "Agreed-Upon Procedures" (AUP) report differ from an Audit?
An audit provides a high level of assurance and an "opinion" that financial statements are fair. An AUP engagement (CSRS 4400) provides no assurance. Instead, we simply perform the specific tests you requested and report the factual results. It is up to the user of the report (such as a lender or partner) to draw their own conclusions from those facts.
3. Does my business need a SOC report (CSAE 3416)?
If you are a Engagements provider (e.g., managing data, payroll, or IT for other companies), your clients’ auditors may require a System and Organization Controls (SOC) report. This proves that you have the internal controls in place to protect their data. Providing this report can give you a competitive advantage by building trust with large enterprise clients.
4. What is a "Report on Supplementary Matters" (CSRS 4460)?
This is a specific Canadian standard used when a third party (like a regulator or a bank) asks for a report on a specific item that isn't the primary focus of your financial statements. For example, a calculation of a specific debt ratio or a statement of insurance coverage.
5. Can these reports be used for tax purposes?
Although the corporate tax filings are prepared as Compilation Engagements (CSRS 4200) included in the category of "Assurance Related Engagements", the majority of the reports under the category of Other Assurance are created to comply with particular contracts, grants, or regulatory agencies instead of the general income tax reporting.