What trips up even the sharpest CPA candidates on the AUD exam isn't the volume of rules for SSARS and SSAE—it's getting the very first sorting decision wrong. You must answer one question correctly before all others: "What is the subject matter and who is the client?" Get that wrong, and every subsequent decision about assurance levels, report types, and independence is guaranteed to be incorrect. This guide teaches you to stop memorizing and start thinking like an examiner.
The core difference is the subject matter. SSARS (Statements on Standards for Accounting and Review Services) apply to a practitioner's services on a non-issuer's historical financial statements (preparations, compilations, reviews). SSAE (Statements on Standards for Attestation Engagements) is a broad framework for providing assurance on virtually any other subject matter, from financial forecasts to cybersecurity controls.
Key facts
- SSARS Scope: Applies to services on a non-issuer's (private company's) historical financial statements. Governed by AR-C sections.
- SSAE Scope: Applies to attestation services on virtually any other subject matter, including financial forecasts, pro forma information, and internal controls (SOC reports). Governed by AT-C sections.
- Governing Standards: SSARS engagements are governed by AR-C sections; SSAE engagements are governed by AT-C sections.
- Primary Distinction: The core difference lies in the subject matter of the engagement.
- Independence: Required for SSARS Reviews and all SSAE Examinations and Reviews. Also required for SSAE Agreed-Upon Procedures engagements.
- Independence Not Required: For SSARS Preparations, SSARS Compilations, and SSAE Compilations of prospective financial information (though lack of independence must be disclosed in compilation reports).
Your First Mental Sort: Is It Historical Financials for a Private Company?
This is the only question that matters first. Before you worry about assurance levels or independence, you must correctly identify the playground you're in.
- Is the service on unaudited historical financial statements for a private company (non-issuer)?
- YES → You are in the world of SSARS. Your only options are Preparation, Compilation, or Review.
- Is the service on anything else? Financial forecasts, assertions about contract compliance, reports on internal controls (like SOC reports), or greenhouse gas statements?
- YES → You are in the world of SSAE. (Or GAAS, if it's a full audit).
Getting this first cut right prevents the vast majority of common errors on AUD questions. The CPA exam is a test of judgment, and this is your first and most important judgment call. Don't let the alphabet soup of section codes intimidate you; this single distinction is your key.
Studying for CPA AUD? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
Myth vs. Reality: Mastering the Standards
Myth: "I need to memorize every detail of AR-C 70, AR-C 80, and AT-C 205 before I can even attempt a practice question." Reality: "I need to master the initial sorting decision first. Once I know which standard applies, I can then recall the specific rules for that engagement type." The exam tests your sorting ability more than your rote memory.The Engagement Decision Tree: Your First Step to Avoiding Exam Traps
A mental flowchart is the most powerful tool for correctly classifying an engagement under pressure. Before you try to recall specific report language or independence rules, walk through these gates.
- Is the client a public company (an "issuer")?
- Yes: Stop. Neither SSARS nor SSAE apply. You are in the realm of the PCAOB.
- No (it's a private company, non-profit, or government entity): Proceed to Step 2.
- What is the subject matter of the engagement?
- Historical Financial Statements: You are in the world of auditing standards or SSARS. Proceed to Step 3.
- Anything Else (e.g., financial forecasts, pro forma financials, internal controls, compliance with a contract): You are in the world of SSAE. Your main options are Examination, Review, or Agreed-Upon Procedures.
- What level of service is requested for the Historical Financial Statements?
- Audit (Reasonable Assurance): You are governed by Statements on Auditing Standards (SAS), issued by the AICPA's Auditing Standards Board.
- Less than an Audit: You are governed by SSARS. Your only options are a Review (limited assurance), a Compilation (no assurance), or a Preparation (non-attest, no assurance).
Mastering this three-step tree transforms a confusing web of standards into a simple, linear process. This is precisely the kind of structured thinking the exam rewards.
What Are the Different Levels of Assurance?
The value of a practitioner's report is the level of confidence, or assurance, it provides to a user. Understanding this spectrum is critical because the report language and the work performed are directly tied to it.
- Reasonable Assurance (High, but not absolute): This is the highest level of assurance. The practitioner performs extensive procedures to gather sufficient appropriate evidence to reduce engagement risk to an acceptably low level. The conclusion is expressed in a positive form.
- Example Engagements: Financial Statement Audit (GAAS), SSAE Examination.
- Key Language: "In our opinion..."
- Limited Assurance (Moderate): This level of assurance is meaningfully lower than reasonable assurance. Procedures are substantially less in scope than an examination or audit, consisting primarily of inquiry and analytical procedures. The conclusion is expressed in the form of negative assurance.
- Example Engagements: SSARS Review, SSAE Review.
- Key Language: "We are not aware of any material modifications..."
- No Assurance: The practitioner provides no assurance, opinion, or conclusion on the subject matter. The value is in the practitioner's expertise in presenting information or performing specific procedures.
- Example Engagements: SSARS Compilation, SSARS Preparation, SSAE Compilation, SSAE Agreed-Upon Procedures.
- Key Language: "We do not express an opinion, a conclusion, nor provide any assurance." (For compilations).
This table maps the engagement types to their corresponding assurance levels.
| Assurance Level | Engagement Type | Key Concept |
|---|---|---|
| Reasonable | Audit (GAAS/PCAOB), SSAE Examination | Positive Opinion |
| Limited | SSARS Review, SSAE Review | Negative Assurance |
| None | SSARS Preparation, SSARS Compilation, SSAE AUP | Disclaimer / Findings |
Why Does the Word "Review" Mean Two Different Things?
The AUD exam loves this trap. You see the word "review" and your brain jumps to a conclusion. Slow down. The subject matter dictates the standard.
A SSARS Review (AR-C 90) provides limited assurance that there are no material modifications needed for a non-issuer's historical financial statements to be in conformity with the reporting framework. The procedures are primarily inquiry and analytical procedures.
An SSAE Review (AT-C 210) provides the same level of assurance (limited) but on a completely different subject matter. For example, a company might assert that its management's discussion and analysis (MD&A) is presented in conformity with SEC rules. An SSAE review is suitable here because the practitioner can apply inquiry and analytical procedures to MD&A. It would not be suitable for a subject matter like the effectiveness of internal controls, which requires more rigorous testing.
The procedures are similar, but the playground is entirely different.
How Does Report Language Change with Assurance Level?
The assurance level directly impacts the wording in the practitioner's report. This is a favorite area for the examiners to test in multiple-choice questions and simulations.
| Engagement Type | Level of Assurance | Key Report Language (The Conclusion) |
|---|---|---|
| SSAE Examination | Reasonable (High) | "In our opinion, [the subject matter] is in accordance with [the criteria] in all material respects." (Positive Opinion) |
| SSARS Review | Limited | "Based on our review, we are not aware of any material modifications that should be made to the accompanying financial statements..." (Negative Assurance) |
| SSAE Review | Limited | "Based on our review, we are not aware of any material modifications that should be made to [the subject matter]..." (Negative Assurance) |
| SSARS Compilation | None | "We have not audited or reviewed the financial statements... and, accordingly, do not express an opinion, a conclusion, nor provide any assurance." (Disclaimer) |
Notice the pattern: High assurance leads to a positive opinion ("it is..."). Limited assurance leads to negative assurance ("nothing came to our attention..."). This isn't just semantics; it's the entire basis of the value provided to the user. The VoraPrep adaptive learning engine has thousands of MCQs designed to train your judgment on these subtle but critical distinctions. Try VoraPrep's free CPA practice questions to see how you stack up.
When Is Independence Required (And When Is It Not)?
Independence is the bedrock of the profession, but its application isn't universal. The exam loves to test the exceptions and the tricky non-assurance rules.
- Required: SSARS Review, all SSAE Examinations and Reviews, and—critically—SSAE Agreed-Upon Procedures engagements.
- Not Required: The big exceptions are SSARS Preparations (AR-C 70), SSARS Compilations (AR-C 80), and SSAE Compilations of Prospective Financials (AT-C 305).
For compilations where you are not independent, you must add a final paragraph to your report stating, "We are not independent with respect to [Company Name]." That's it. No reasons, no explanations. Just the statement.
Tempting Wrong Answer: A common mental shortcut is "No assurance means no independence required." This is dangerously wrong. An Agreed-Upon Procedures (AUP) engagement (AT-C 215) provides no assurance. You simply perform specific procedures and report the findings. Yet, independence is absolutely required. Why? Because the users of the report must trust that you performed the procedures objectively, without bias. The value is in the impartial execution of the procedures, not in an opinion.What Kinds of SSAE Subject Matters Appear on the Exam?
While SSARS is narrowly focused on historical financials, the SSAE standards are designed to be flexible. Don't get stuck thinking it's only for forecasts. The exam can test your ability to apply the framework to less common scenarios.
Management makes an assertion about a subject matter, and the practitioner is engaged to provide assurance on that assertion. You might see questions involving:
- Prospective Financial Information: Financial forecasts or projections (AT-C 305).
- Pro Forma Financial Information: Showing the effect of a hypothetical event on historical financial statements (AT-C 310).
- Effectiveness of Internal Control: This is the basis for Service Organization Control (SOC) reports. Both SOC 1 (controls over financial reporting) and SOC 2 (controls over security, availability, etc.) are SSAE Examination engagements.
- Compliance with Laws, Regulations, or Contracts: Management asserts that the company has complied with specific covenants in a debt agreement. A practitioner can perform an examination to provide reasonable assurance on this claim.
- Sustainability or ESG Reporting: A company asserts that its reported greenhouse gas emissions for 2026 are stated in accordance with a specific framework. A practitioner can perform a review (limited assurance) or an examination (reasonable assurance) on this data.
If the topic is not historical financial statements as a whole, your mind should immediately go to SSAE.
SSARS vs. SSAE: A Plain English Analogy
Imagine you're a building inspector hired for different tasks. The tools you use and the report you write depend entirely on what the property owner asks you to do.
SSARS Engagements: Inspecting the "Standard Blueprint" This is for when a private homeowner (a non-issuer) needs help with their original building blueprints (their historical financial statements).- Preparation (AR-C 70): You simply help the owner draft the blueprints using their data. You're a scribe. You don't issue a report because you're not attesting to anything. You provide no assurance.
- Compilation (AR-C 80): You take the owner's data and put it into a professional blueprint format. You read them to ensure they aren't obviously nonsensical, but you aren't verifying the measurements. You issue a report that provides no assurance.
- Review (AR-C 90): You perform analytical procedures and make inquiries to see if anything looks obviously wrong. You're not knocking down walls, but you're checking for major, visible issues. You provide limited assurance.
- Examination (AT-C 205): This is the most intense inspection. The owner asserts the house's electrical system is 100% up to 2026 code. You conduct extensive tests to form an opinion. You provide reasonable assurance.
- Review (AT-C 210): Same level of work as a SSARS Review (inquiry and analytics) but on a different subject. The owner asserts their new roof is leak-proof. You'll talk to the roofer and review their work, but you won't bring in a fire hose. You provide limited assurance.
- Agreed-Upon Procedures (AT-C 215): The owner and a potential buyer give you a specific checklist. "1. Verify the brand of the furnace. 2. Measure the master bedroom." You perform only these steps and report your findings. You provide no assurance on the overall quality of the house, but you must be independent.
Are Engagement Letters Always Required?
Yes. A common procedural trap on the AUD exam is forgetting the requirements for the engagement letter. For both SSARS and SSAE engagements, the practitioner is required to obtain a signed engagement letter from management (or those charged with governance).
Check Your State’s Exact CPA Exam Requirements
Every state has different credit hour, ethics, and residency rules. Use our 55-jurisdiction checker to verify your eligibility before applying.
This isn't optional.
The purpose is to prevent misunderstandings. Think of it as the contract that defines the scope of work. While the specifics vary, every engagement letter must include:
- The objective and scope of the engagement.
- The responsibilities of the practitioner.
- The responsibilities of management (this is crucial—management is always responsible for the underlying subject matter).
- A statement about the limitations of the engagement.
- The identification of the applicable financial reporting framework (for SSARS) or the criteria (for SSAE).
- The expected form and content of the report to be issued.
Forgetting this foundational requirement can cost you easy points on a simulation that asks you to identify deficiencies in engagement planning documentation.
A Full SSARS vs. SSAE Example Problem (TBS-Style)
Let's apply this logic to a complex, multi-part scenario like you'd see in a Task-Based Simulation.
--- Scenario:
Acuity Robotics, a privately held developer of warehouse automation systems, is trying to secure Series B funding. The potential lead investor, Crestview Ventures, has made four requests of Acuity's management and its CPA firm, Apex LLP.
- Request 1: Crestview needs Acuity's historical financial statements for the year ended December 31, 2025. They don't require a full audit but need a CPA to provide a report offering a moderate level of comfort that the financials don't contain obvious errors.
- Request 2: Acuity has asserted to Crestview that their inventory system has maintained an uptime of at least 99.9% over the past 12 months. Crestview wants a CPA to provide a high level of assurance on this uptime claim.
- Request 3: Acuity has provided Crestview with a financial forecast for the next three years. Crestview wants a CPA to issue a report on this forecast, but they are not seeking a high level of assurance and want to minimize costs.
- Request 4: Crestview is concerned about specific cash disbursements. They have provided Apex LLP with a list of 50 specific check numbers and asked the firm to verify that the payee on the cleared check matches the payee listed in Acuity's general ledger. They want a report detailing any exceptions.
For each request, identify the appropriate professional standard (SSARS or SSAE), the specific type of engagement, the level of assurance provided, and whether independence is required.
---
Step-by-Step Solution:
Analysis of Request 1: The Historical Financials- Subject Matter & Client: "Historical financial statements" for a "privately held" company.
- Decision: The standard must be SSARS.
- Assurance & Engagement: "Moderate level of comfort" directly maps to limited assurance.
- Decision: The engagement is a Review (AR-C 90).
- Independence: For a SSARS Review, independence is mandatory.
- Decision: Yes, independence is required.
- Subject Matter & Client: An assertion about "system uptime." This is an operational metric, not historical financials.
- Decision: The standard must be SSAE.
- Assurance & Engagement: "High level of assurance" maps to reasonable assurance.
- Decision: The engagement is an Examination (AT-C 205).
- Independence: For an SSAE Examination, independence is mandatory.
- Decision: Yes, independence is required.
- Subject Matter & Client: A "financial forecast." This is prospective, not historical, information.
- Decision: The standard must be SSAE (specifically, AT-C 305).
- Assurance & Engagement: Crestview wants a report but not a high level of assurance. Here is the exam's biggest trap. Your brain might think "limited assurance," but an SSAE Review is prohibited for prospective financial statements. The available options are Examination, Compilation, or AUP. Since they want to minimize costs and don't need high assurance, a Compilation is the best fit. (Note: An Examination would also be a valid option if they needed high assurance).
- Decision: The engagement is a Compilation.
- Independence: This is the follow-up trap. For an Examination or AUP on prospective financials, independence is required. But for a Compilation of prospective financials, independence is NOT required (but its absence must be disclosed).
- Decision: Independence is not required.
- Subject Matter & Client: Verifying specific transactions based on a list provided by the user. This is not historical financials as a whole. It's a specific, limited task.
- Decision: The standard must be SSAE.
- Assurance & Engagement: The firm is asked to perform specific procedures and report the findings. They are not asked for an opinion or conclusion. This perfectly describes an Agreed-Upon Procedures (AUP) engagement (AT-C 215).
- Decision: The engagement is Agreed-Upon Procedures.
- Independence: As discussed, even though no assurance is provided, independence is required for an AUP engagement.
- Decision: Yes, independence is required.
This last point is exactly the kind of nuance that separates a 74 from a 75. The VoraPrep question bank is filled with these scenarios to build your muscle memory for exam day.
SSARS vs. SSAE Engagement Comparison Matrix
Use this table as a final review tool before your exam.
| Attribute | Preparation (SSARS) | Compilation (SSARS) | Review (SSARS) | Examination (SSAE) | Review (SSAE) | Agreed-Upon Procedures (SSAE) |
|---|---|---|---|---|---|---|
| Standard | AR-C 70 | AR-C 80 | AR-C 90 | AT-C 205 | AT-C 210 | AT-C 215 |
| Subject Matter | Non-Issuer Hist. F/S | Non-Issuer Hist. F/S | Non-Issuer Hist. F/S | Any Other Subject | Any Other Subject | Any Other Subject |
| Assurance | None | None | Limited | Reasonable | Limited | None |
| Independence? | No | No (Disclose if lacking) | Yes | Yes | Yes | Yes |
| Report Issued? | No | Yes | Yes | Yes | Yes | Yes |
| Report Type | N/A | Disclaimer | Negative Assurance | Positive Opinion | Negative Assurance | List of Findings |
| Exam Tip | Non-attest service. | Non-assurance service. Watch for independence trap. | Distinguish from SSAE Review. | Highest SSAE assurance. | Distinguish from SSARS Review. | No assurance, but independence is required. |
AUD Exam Traps & How to Disarm Them
| Trap Description | Why It's Tempting | How to Disarm It (Your Mental Rule) |
|---|---|---|
| The "Review" Ambiguity | The word "review" appears, and you automatically think SSARS. | The "Of What?" Rule: Immediately ask, "A review of what?" If it's historical financials → SSARS. Anything else → SSAE. |
| The "No Assurance" Independence Mix-Up | You see "no assurance" and assume independence is never required. | Isolate the Exceptions: Only SSARS Preparations, SSARS Compilations, and SSAE Compilations of Prospective Financials do not require independence. An SSAE AUP engagement provides no assurance but always requires independence. |
| The Prospective Financials "Review" Trap | A client wants limited assurance on a financial forecast. "Review" is an answer choice. | Memorize the Prohibition: An SSAE Review (AT-C 210) engagement is not permitted for prospective financial statements. The available options are Examination, Compilation, or AUP. |
| The "Preparation" vs. "Compilation" Blur | Both are SSARS, no-assurance services for historical financials. | The Report Rule: A Preparation (AR-C 70) is a non-attest service and no report is issued. A Compilation (AR-C 80) is a non-assurance service and requires a report. |
| The "Issuer" Distractor | A question describes a service on historical financials, but casually mentions the company is publicly traded. | The Client Rule: As soon as you see "issuer" or "publicly traded," SSARS is off the table. Engagements for issuers fall under PCAOB standards. |
Your 7-Day Reinforcement Drill
Integrate this 30-minute drill into your study schedule once a week to build judgment, not just memorization.
- Day 1: Framework Recitation (5 mins): Verbally recite the sorting process: 1. Is the client an issuer? (If yes, PCAOB). 2. Is the subject matter historical financials? (If yes, SSARS). 3. If not, it's SSAE. Then, what's the assurance level requested?
- Day 2: SSARS MCQs (10 mins): Do a 10-question quiz in the VoraPrep adaptive learning engine focused only on SSARS. For each question you get wrong, write one sentence explaining why the correct engagement type was the right choice.
- Day 3: SSAE MCQs (10 mins): Do a 10-question quiz focused only on SSAE. Include questions on Prospective Financials, Pro Forma information, and AUPs.
- Day 4: Mixed Bag Drill (10 mins): Do a 10-question quiz that mixes SSARS, SSAE, and GAAS questions. This forces your brain to practice the initial sorting decision under pressure.
- Day 5: Matrix Recall (5 mins): Look at the Comparison Matrix. Cover up all columns except the first one (Attribute). Try to fill in the details for each engagement type from memory.
- Day 6: Ask Vory (5 mins): Think of the one question that still confuses you. Log into VoraPrep and get a personalized explanation from Vory, our AI tutor. For example, "Vory, explain why an SSAE review isn't allowed for a financial forecast."
- Day 7: Teach It Back (5 mins): Find a friend, family member, or just talk to your wall. Explain the entire SSARS vs. SSAE framework out loud as if you were teaching it. If you can articulate it clearly, you own the material.
---
Ready to Pass Your CPA Exam?Building the judgment to pass the AUD section comes from practice. VoraPrep is built to turn your weak areas into strengths. With over 9,500 practice questions, an adaptive learning engine that hones in on what you need to study, and Vory, your 24/7 AI tutor, you'll get the support you need.
Visit voraprep.com to get started and build the confidence you need to walk into the exam and pass.
Start Your Free 14-Day Trial at voraprep.com →