Audit vs Attestation: What’s the Difference?

Audit vs Attestation Quiz: Test Yourself

Five quick questions on audit vs attestation. Pick an answer to get instant feedback.

Flip Cards: Quick Review

Hover over a card, or tap it on mobile, to see the meaning.

Audit vs attestation is a common stumbling block in accounting and compliance because the two overlap. Both usually involve an independent CPA, both end in a formal report, and people often use the words interchangeably. The key difference is scope: an audit centers on financial statements, while attestation covers a much wider range of subject matter.

What does audit mean?

An audit is an independent examination of an organization’s financial statements, ending with the auditor’s opinion on whether they are fairly presented under a framework such as US GAAP or IFRS. The auditor tests evidence, such as records, balances and controls, and gives reasonable assurance. That is a high level of comfort, but not a guarantee that nothing is wrong.

Public companies are audited under standards set by the PCAOB, while private companies usually follow standards from the AICPA or international auditing standards. Lenders, investors and regulators often ask for audited financial statements for this reason.

The word comes from the Latin verb for “to hear,” because early auditors listened to accounts being read aloud. In everyday speech, audit has also become a general word for any systematic check, as in a tax audit, a security audit or an energy audit.

What does attestation mean?

In accounting, attestation is an engagement where an independent practitioner reports on a subject matter, or on someone else’s claim about it, against stated criteria. In the US, these engagements follow the AICPA’s Statements on Standards for Attestation Engagements (SSAEs). The subject can be almost anything with clear criteria: security controls, compliance with a regulation, or certain non-financial metrics.

Attestation engagements come in three common forms. An examination gives reasonable assurance. A review gives limited assurance. An agreed-upon procedures engagement reports findings from specific procedures and gives no assurance at all. SOC 1 and SOC 2 reports are well-known examples, and SOC 2 reports cover controls related to security, availability, processing integrity, confidentiality or privacy.

Attestation has a second, simpler meaning in business: a signed or recorded statement confirming something is true. An employee confirming they follow the code of conduct is giving an attestation, and no outside auditor is involved. The word comes from a Latin verb meaning “to bear witness.”

Audit vs attestation: what is the difference?

The difference between audit and attestation comes down to scope, standards and level of assurance. An audit is about financial statements, while an attestation can cover any subject with measurable criteria.

The standards differ too. In US practice, audits of historical financial statements follow auditing standards, while other attest engagements follow the SSAEs. The level of assurance also varies: an audit gives reasonable assurance, whereas an attestation can give reasonable assurance, limited assurance or none, depending on the engagement type.

Finally, look at who makes the claim. In an audit, the auditor opines on management’s financial statements. In an attestation, the practitioner reports on a specific assertion made by the responsible party, such as “our controls met these criteria.”

Is an audit a type of attestation?

In broad terms, yes: both are independent assurance services performed by a CPA, so many professionals treat an audit as one kind of attestation. In US practice, though, audits follow their own standards, which is why the two are usually discussed as separate services.

Sarbanes-Oxley shows how they sit side by side. Larger public companies receive an auditor’s report on internal control over financial reporting as well as the audit of their financial statements.

Which one do you need?

It depends on who is asking and what they need to rely on. Lenders, investors and regulators commonly ask for audited financial statements. Customers and partners assessing a vendor’s security or processes commonly ask for an attestation report such as SOC 2. Internal compliance teams often just need a signed attestation from staff. When in doubt, ask the requesting party what they require and confirm with your CPA.

How can you remember which one to use?

Ask what is being checked: financial statements point to an audit, while a specific claim about controls, compliance or a process points to an attestation. The memory tricks below add a few more hooks.

Common mistakes with audit and attestation

• ✗ An attestation always gives the same assurance as an audit.
  ✓ An attestation can give reasonable assurance, limited assurance or none, depending on the engagement.
• ✗ An agreed-upon procedures report gives assurance that the statements are fairly stated.
  ✓ An agreed-upon procedures report lists findings and gives no assurance.
• ✗ The employee signed an audit confirming she follows the code of conduct.
  ✓ The employee signed an attestation confirming she follows the code of conduct.
• ✗ A SOC 2 report is an opinion on a company’s financial statements.
  ✓ A SOC 2 report is an attestation on a company’s controls, not its financial statements.
• ✗ An audit guarantees there are no errors.
  ✓ An audit provides reasonable assurance, not a guarantee.

Memory tricks for audit vs attestation

• Accounts vs assertion: An audit examines the accounts. An attestation checks an assertion, meaning a claim someone has made.
• Hear vs witness: Audit comes from “to hear,” and attest comes from “to bear witness.” The auditor hears the accounts; the attester witnesses the claim.
• Toolbox: Think of attestation as a big toolbox of independent reports, and audit as its most famous tool.

Audit vs attestation FAQ

Is an attestation the same as an audit?

No. An audit is an examination of financial statements ending in an opinion, while attestation is a broader category covering reports on many subjects, from controls to compliance.

What are the types of attestation engagements?

The three common types are an examination, which gives reasonable assurance, a review, which gives limited assurance, and agreed-upon procedures, which report findings without assurance.

Is a SOC 2 report an audit or an attestation?

A SOC 2 report comes from an attestation engagement in which a CPA firm examines a company’s controls. People often call it a SOC 2 audit informally, but it is an attestation report.

What does attestation mean in compliance?

In compliance, an attestation is a signed or recorded statement confirming that something is true, such as an employee confirming they follow a policy.

Does an audit guarantee that financial statements are error-free?

No. An audit provides reasonable assurance, which is a high level of comfort but not an absolute guarantee.

Conclusion

The audit vs attestation question comes down to scope: an audit opines on financial statements, while attestation covers independent reports on many other subjects, plus signed statements of truth in compliance. Match the term to what is being checked and the choice becomes clear. Share this with someone who mixes these up, and retake the quiz above to lock it in.