Assurance is an independent accountant's conclusion, based on evidence, that increases the confidence users can place in information prepared by someone else. In UK standards an assurance engagement comes in two strengths: reasonable assurance, a high but not absolute level that ends in a positive opinion (an audit is the best-known example), and limited assurance, a lower level that ends in a "nothing has come to our attention" conclusion. The Financial Reporting Council (FRC) sets the UK standards for both.
The formal definition
The FRC's assurance standard, ISAE (UK) 3000, defines an assurance engagement as one in which a practitioner aims to obtain sufficient appropriate evidence "to express a conclusion designed to enhance the degree of confidence of the intended users other than the responsible party" about the subject matter information. Three ideas sit inside that sentence:
- A responsible party. The party responsible for the underlying subject matter, usually the directors or management who prepared the figures or statement;
- Intended users. The people the practitioner expects to use the report, such as shareholders, lenders, a regulator or customers;
- Criteria. The benchmarks the subject matter is measured against, for example FRS 102 for a set of accounts or a stated methodology for carbon emissions.
Without suitable criteria there is nothing to measure against, and the work cannot be an assurance engagement. That is why a vague request to "check the numbers" first has to be turned into a defined subject matter, a set of criteria and a named audience.
Reasonable assurance and limited assurance
ISA (UK) 200 describes reasonable assurance as "a high, but not absolute, level of assurance". It is not absolute because most audit evidence is "persuasive rather than conclusive". Under ISAE (UK) 3000 a reasonable assurance conclusion is expressed in a positive form: the information is prepared, in all material respects, in accordance with the criteria.
In a limited assurance engagement the procedures are narrower and the engagement risk is greater, but the level of assurance must still be "meaningful", which the standard explains as enhancing users' confidence "to a degree that is clearly more than inconsequential". The conclusion is negatively worded: based on the procedures performed, nothing has come to the practitioner's attention to suggest the information is materially misstated.
| Reasonable assurance | Limited assurance | |
|---|---|---|
| Level of assurance | High, not absolute | Meaningful, lower |
| Typical work | Risk assessment, controls testing, detailed substantive testing | Narrower procedures, often enquiry and analytical review |
| Form of conclusion | Positive opinion | Negative ("nothing has come to our attention") |
| Common examples | Statutory audit, some regulatory reports | Interim reviews under ISRE (UK) 2410 |
Attestation and direct engagements
ISAE (UK) 3000 also classifies engagements by who does the measuring. In an attestation engagement, someone other than the practitioner measures or evaluates the subject matter, and the practitioner concludes on whether that information is free from material misstatement. A typical example is a company producing a report and the accountant giving assurance on it. In a direct engagement, the practitioner does the measurement and presents the result in or alongside the assurance report.
Where you meet assurance in practice
- Statutory audit. The reasonable assurance engagement on annual accounts, carried out under the ISAs (UK). A company that qualifies as small is exempt from audit under section 477 of the Companies Act 2006; for financial years beginning on or after 6 April 2025 small generally means meeting at least two of turnover not more than £15 million, balance sheet total not more than £7.5 million and no more than 50 employees;
- Interim reviews. A review under ISRE (UK) 2410, whose scope is "substantially less" than an audit, so no audit opinion is given;
- Controls reports. Reports on a service organisation's controls, such as AAF reports, which customers and their auditors rely on;
- Sustainability information. ISSA (UK) 5000 covers assurance on sustainability reporting for periods beginning on or after 15 December 2026;
- Other information. Grant claims, KPIs, regulatory returns and similar, usually under ISAE (UK) 3000.
A small company that is exempt can still be made to have an audit. Under section 476, members holding at least 10% of the nominal value of the issued share capital (or of any class of it) can require one by notice, given during the financial year and no later than one month before its end.
What assurance is not
Assurance is often confused with work that produces no conclusion at all. Preparing accounts, a bookkeeping review or "agreed-upon procedures", where the accountant reports factual findings and users draw their own conclusions, are not assurance engagements. ISAE (UK) 3000 also excludes engagements where any opinion is merely incidental, the report is restricted to specified users, both sides have agreed in writing that it is not an assurance engagement and the report does not present it as one.
Nor is assurance a guarantee. Even a reasonable assurance report rests on evidence that is persuasive rather than conclusive, and it covers the subject matter only to the extent of materiality.
Changes coming in December 2026
The FRC has issued ISAE (UK) 3000 (Revised September 2026), effective for assurance reports dated on or after 15 December 2026. ISSA (UK) 5000 uses the same date but tests it differently: it applies to sustainability information reported for periods beginning on or after 15 December 2026, or as at a date on or after 15 December 2026. If you are commissioning assurance now for a report that will be signed after mid-December 2026, ask which version the practitioner will apply.
The definitions above come from the FRC's assurance standards (ISAE (UK) 3000, ISRE (UK) 2410 and ISSA (UK) 5000), ISA (UK) 200, and sections 382, 476 and 477 of the Companies Act 2006. For more on audit itself, see our guide to external audits.
If you need an audit or a specific assurance report for a lender, funder or customer, our audit and assurance team can help define the scope and criteria first. For sustainability reporting, see our ESG assurance service.