Reasonable assurance: what an audit does not promise
What reasonable assurance means under ISA 200, why an audit stops short of certainty, and how to explain those limits plainly to a client's directors.
By Achekam · · 5 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A director receives a clean audit report, and months later learns that the stores manager had been selling stock out of the back door for years. The first call is to the auditor: "You signed off the accounts. How did you miss it?"
That call goes better when the same conversation has already happened once, at the start, in plain words. Reasonable assurance sits at the heart of every audit under the ISAs, and most directors outside the profession hear it as a polite way of saying "certain". It is not. This article sets out what the phrase means, why it stops short of certainty, and how to explain it to a board without sounding evasive.
The overall objective, in the standard's terms
ICAEW explains that ISA 200 sets the auditor's overall objectives as obtaining reasonable assurance about whether the financial statements as a whole are free from material misstatement, whether due to fraud or error, and then reporting and communicating on the statements in line with what the audit found.
Each part of that sentence narrows the promise:
- Reasonable assurance, not absolute.
- The financial statements as a whole, not each account or transaction.
- Material misstatement, not every error.
- The statements, not the business's prospects, its management or how efficiently it runs.
ICAEW draws the link to materiality directly: because the ISAs require reasonable assurance that the statements as a whole are free from material misstatement, materiality is fundamental to the audit. Its guide to materiality in the audit of financial statements is a sensible page to share with a finance director who wants to understand how the threshold works.
Why reasonable is not absolute
An audit cannot deliver certainty, and it helps to be able to say why in a sentence each.
Testing, not re-performing. An audit examines evidence chosen for its risk and size. It does not redo every transaction, so an error in items that were not tested can go unseen.
Judgement. Provisions, impairments, fair values and useful lives rest on estimates. The auditor evaluates whether management's judgement is reasonable; often there is no single right answer to check against.
Evidence that persuades rather than proves. Most audit evidence points towards a conclusion rather than proving it. Confirmations, documents and explanations can be wrong, incomplete or forged.
The limits of any control system. ACCA explains that no internal control system is perfect, so the purpose of a control system should be to provide reasonable assurance that the organisation can meet its objectives, a view it traces to the Turnbull Report. Investopedia makes the same point and names two ways controls fail: management override, and collusion between employees. An auditor who relies on controls inherits those limits.
Fraud deserves its own sentence with directors. Concealment, forgery and collusion are designed to defeat exactly the procedures an audit uses. That is no excuse for weak work; it is why the audit plan responds specifically to fraud risk, and why the board's own controls matter so much.
Materiality and the words "as a whole"
"As a whole" is often dropped in conversation, and it is where most misunderstandings start. The auditor sets materiality for the statements overall, then lower thresholds for the detailed work. An error below those thresholds, alone or with others, may not change the opinion. A director who expected the audit to find every misallocated invoice will be disappointed; one who understands that the audit is built to catch errors that could change a reader's decisions will not be.
It also cuts the other way. A misstatement can be small in amount and still material because of what it concerns, such as directors' pay or a loan covenant, and auditors weigh that too.
What an unmodified opinion says, and what it does not
ICAEW explains that auditors give either an unmodified opinion, commonly called a "clean" opinion, where the financial statements give a true and fair view, or a modified one.
A clean opinion says that, on the evidence obtained, the statements as a whole are fairly presented in all material respects under the applicable framework. It does not say:
- that no fraud has taken place;
- that every figure is exact;
- that the business is well run or a sound investment;
- that internal controls are effective, unless the firm was separately engaged to report on them.
Where the evidence does not support a clean opinion, the report changes. Modified audit opinions explains qualified, adverse and disclaimer reports.
Previewing the report with the client in Achekam
The best moment to revisit reasonable assurance is when the client reads the draft report. In Achekam, the engagement team drafts the auditor's report on standard ISA 700, 705, 706 and 701 wording, unmodified, qualified, adverse or a disclaimer, and only the engagement partner approves it. Approval is refused while any bracketed placeholder remains, so a report cannot go out with an unfinished paragraph.
Before signing, the partner can send the client a read-and-comment preview link to the report. The client opens it without signing in, and the link expires and can be revoked. Once approved, the report can be sent for e-signature and recorded as issued, which binds the statements' fingerprint and starts the file-assembly clock.
Where the firm also prepares the statements, Achekam's Studio builds the draft set from a mapped trial balance with every figure calculated in code, and the practitioner's report follows the level chosen: audit, independent review, compilation or none. Choosing that level deliberately is itself a conversation about how much assurance the client is buying.
Plain answers for a director who wants certainty
Some answers that work in a boardroom:
- "Will you find any fraud?" We design our work to respond to the risk of material fraud, and we will tell you if we find signs of it. We cannot promise to find fraud that is concealed, especially where people collude or management overrides controls.
- "Why don't you check everything?" Because our opinion is about the statements as a whole. We test what could make them materially wrong, chosen by risk and size.
- "Then who prevents errors?" You do. ACCA explains that in a limited company the board is responsible for making sure appropriate internal controls are in place. Our work does not replace them.
- "So what am I paying for?" An independent opinion, on evidence, that the statements your lenders, shareholders and tax authority rely on are not materially misstated, and a report to you of significant weaknesses we come across.
Put the same points in the engagement letter, as described in audit engagement letter terms, so the conversation at the end of the audit matches the one at the beginning. Directors rarely object to the limits of an audit; they object to hearing about them for the first time after something has gone wrong.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
