Inquiry and analytics in an independent review
The inquiry and analytical procedures an ISRE 2400 (Revised) review rests on, when more work is needed, and how to evidence each step on file.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
Independent reviews have a reputation, in some firms, as "an audit without the testing", and files that look like it: half an audit programme, a few ticks, and a conclusion copied from last year. Reviews done that way are both over-engineered and under-evidenced. They do audit-style work the standard does not ask for, and skip the inquiries and analytics it does.
ISRE 2400 (Revised) sets out a different kind of engagement. The practitioner obtains limited assurance, primarily by performing inquiry and analytical procedures, and expresses a conclusion on whether anything has come to their attention that causes them to believe the statements are materially misstated. Done properly, that is a demanding piece of work, and its evidence lives almost entirely in what was asked, what was expected and what was found.
Limited assurance and what it rests on
A review is designed to reduce engagement risk to a level that is acceptable for limited assurance, which is higher than for an audit. The reduction comes from three things working together:
- an understanding of the entity and its environment and framework, sufficient to identify the areas where material misstatements are likely to arise;
- procedures designed to address all material items in the statements, focusing on those likely areas;
- professional scepticism, so that inconsistent answers and unexpected relationships are followed up, not accepted.
What a review does not do is test controls, confirm balances with third parties or vouch samples of transactions, unless a specific matter calls for more work.
Planning the inquiries
Good inquiries are planned, specific and addressed to the right person. ISRE 2400 (Revised) requires inquiries of management and others within the entity as appropriate, including about:
- how management makes significant accounting estimates;
- related parties and transactions with them;
- significant, unusual or complex transactions;
- actual, suspected or alleged fraud, or non-compliance with laws and regulations;
- events after the reporting date;
- the basis for management's going concern assessment;
- material commitments, contractual obligations or contingencies;
- material non-monetary transactions or transactions for no consideration.
Write the questions before the meeting, and adapt them to the client. "Are there any related parties?" invites "no". "Which companies do the directors and their families own, and did any of them buy from or sell to the company this year?" invites an answer.
Written questions can also go through Achekam's RFI console, where staff create, send and track requests for documents, answers and confirmations. The written answers then sit with the request, and the meeting can focus on following them up.
Analytical procedures and their expectations
Analytics in a review must be designed, not just performed. For each material area, form an expectation from what you know: last year's figures adjusted for known changes, budgets, industry relationships, non-financial data such as staff numbers or units sold. Then compare, and investigate differences that are significant.
ISRE 2400 (Revised) also requires the practitioner to consider whether the data used is adequate for the purpose. A gross margin analysis built on an unreconciled inventory figure tells you little.
A worked example in words: the client is a small engineering company whose revenue is flat but whose receivables have grown noticeably. The expectation was that receivables would move with revenue. The practitioner asks the financial manager, who explains that a major customer has been paying late since a change in its own management. The practitioner looks at the age analysis and the receipts after year end, sees that the customer has paid part of the balance, and considers whether the remainder is recoverable. The inquiry, the expectation, the explanation and the corroboration all go on the file.
When further procedures are needed
If the practitioner becomes aware of a matter that causes them to believe the statements may be materially misstated, ISRE 2400 (Revised) requires additional procedures sufficient to conclude either that the matter is not likely to cause the statements as a whole to be materially misstated, or that it does. These are not audit procedures for their own sake; they are targeted at the specific concern, such as inspecting a contract, obtaining a lawyer's letter or reviewing post-year-end receipts.
If the work still cannot resolve the matter, the conclusion may need to be modified, which is the subject of when a review conclusion must be modified.
Documenting each step with responses and documents
The documentation must show the nature, timing and extent of the procedures, the results and the practitioner's conclusions, and significant matters and how they were resolved. In a review, the evidence is largely the inquiry and its answer, so the record of both carries the file.
Achekam ships working-paper template packs written in its own words, including ISRE 2400 review packs, for a firm to adopt and approve. The catalogue is marked unapproved platform content until the firm adopts it, and whether a pack is installed on your deployment should be checked in the Methodology Library first.
On each work item, the procedures and the documents required are listed, and a step is marked done only with a written response and its documents, or set aside with a reason; steps are never deleted. For a review, write each response as three parts: the question asked or the expectation formed, the answer or result, and how it was corroborated.
Staff can ask AI to draft a procedure's response or a conclusion on a working paper, and the draft goes into the file only when a person saves it. A template can forbid AI drafting altogether, which some firms prefer for review conclusions.
The Working Paper Control Centre shows the file as an index with progress by status, and can group the papers by preparer, reviewer, risk or statement line. On review, a reviewer raises review notes on a paper, the preparer answers and the reviewer clears them, and each note's history is kept. A note that says "expectation not documented" is the most useful one a reviewer can raise on a review file.
IFAC's Guide to Review Engagements, developed with CPA Canada, is a practical guide to ISRE 2400 (Revised) with examples and adaptable checklists for small practices. Where another firm performs the review of statements your firm prepared, the arrangements are described in sending statements to another firm for review.
A habit for review files
Before the client meeting, write down your expectation for each material line in one sentence. If you cannot, you are not ready to ask the questions that make a review worth signing.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
