How to guide

Audit, Review, Agreed-Upon Procedures or Compilation: Choosing the Scope

Choose a reporting engagement by its purpose, assurance level and intended users, with a practical checklist for agreeing the scope.

A request for an accountant’s report should begin with the decision the recipient needs to make. A bank may require audited financial statements; a grant provider may specify checks on expenditure; management may need help presenting financial information. Those requirements lead to different engagements and different reports.

This guide explains the main distinctions and provides a practical brief for discussing Special Assurance & Related Services with Saifudin & Co. The suitable engagement depends on the actual requirement, applicable standards and acceptance assessment.

The four engagement types at a glance

Audit: reasonable assurance and an opinion

A financial statement audit seeks reasonable assurance about whether the statements as a whole are free from material misstatement and supports the auditor’s opinion under the applicable reporting framework. Reasonable assurance is a high level of assurance, but it is not absolute certainty or a promise to detect every error or fraud. IFAC explains the audit objective and its limitations.

Where legislation, an agreement or the intended recipient requires an audit, establish that requirement first. A narrower engagement should not be proposed simply because it appears quicker. General-purpose financial statement audit enquiries belong under Audit & Assurance.

Review: limited assurance and a conclusion

A review provides limited assurance. Under ISRE 2400 (Revised), the work primarily involves enquiries and analytical procedures, with additional procedures where a matter suggests that the financial statements may be materially misstated. The conclusion addresses whether anything has come to the practitioner’s attention indicating material departure from the applicable reporting framework.

The assurance level is lower than an audit. Confirm whether the recipient accepts a review before commissioning it. The applicable review standard also depends on the circumstances, including whether the practitioner is the entity’s auditor. See MIA’s published ISRE 2400 (Revised), particularly paragraphs 1–8 and 14.

Agreed-upon procedures: specified work and factual findings

In an agreed-upon procedures engagement, the practitioner performs procedures agreed with the engaging party and reports the findings. No assurance opinion or conclusion is expressed; users assess the procedures and findings and draw their own conclusions. The engagement must have a clear purpose and procedures suitable for that purpose. See ISRS 4400 (Revised).

For example, a proposed procedure might compare specified expenditure items with supporting invoices and report differences. That does not, by itself, establish that every item of expenditure is eligible, that all records are complete or that a whole project complies with its funding conditions. Define the population, selection method, documents, comparisons and reporting of exceptions explicitly.

Compilation: accounting expertise without assurance

A compilation involves applying accounting and financial reporting expertise to help management prepare and present financial information. Management remains responsible for that information. The engagement does not provide an audit opinion or review conclusion, and it does not provide assurance. The practitioner’s report explains the nature of the work.

IAASB’s explanation of ISRS 4410 (Revised) describes these responsibilities. If the underlying need is bookkeeping, reconciliations or regular management accounts, begin with Accounting & Financial Reporting and clarify whether a separate report is required.

How to choose the scope

  1. Obtain the original requirement. Ask the recipient for its letter, template, agreement or reporting instructions. A request to “verify” or “certify” a figure leaves important questions unanswered.
  2. Identify the decision and users. Explain who will receive the report, what they will use it for and whether further circulation is expected. Confirm any prescribed report format before work starts.
  3. Define the information. Specify the entity, reporting period, financial statements or individual schedule, reporting framework or criteria, and available supporting records.
  4. Agree the output. Establish whether the recipient needs an audit opinion, limited-assurance conclusion, factual findings or compiled information. Where procedures are prescribed, confirm their wording and whether they are workable.
  5. Assess feasibility and acceptance. Discuss access to evidence, responsible staff, deadlines, competence and relevant ethical and independence requirements. An enquiry does not itself establish an appointment or an accepted scope.

A short brief to prepare before the discussion

Bring the recipient’s request, the latest version of the information to be reported on, a list of available records, the reporting deadline and the person authorised to agree the engagement. Identify incomplete records and unusual transactions early. If the recipient changes its requirement, revisit the scope before assuming the original work will satisfy it.

Agree management’s responsibilities, the expected report, information access and any restrictions on use in writing. The result depends on the work and evidence; a favourable finding or conclusion cannot be promised in advance.

Discuss the reporting requirement

Send Saifudin & Co the reporting requirement with the intended users and period covered. This allows the appropriate engagement to be assessed before its scope is agreed.

General information. This guide does not determine an entity’s statutory obligations or whether an engagement can be accepted. Consult the applicable Malaysian requirements and standards for the engagement and reporting period. The 2026 IAASB Handbook includes standards with different effective dates; publication alone does not make every provision immediately applicable.

Related service

START WITH SCOPE

Define the requirement before the work begins.

Tell us the entity, reporting period, applicable requirement and intended use. We will confirm fit, scope and the next evidence needed.

Discuss the engagement