A mid-tier firm in Rotterdam signs a new engagement: a review of the annual financial statements for a private holding company. The partner asks who on the team has done an ISRE 2400 engagement before. Nobody raises a hand. The audit team assumes it’s a lighter version of an audit, skips the understanding-of-the-entity requirements in ISRE 2400.39, and delivers a file with four inquiry memos and no analytical procedures. The partner sends it back. In our experience, this is the most common failure pattern on the first ISRE 2400 a team attempts: treat it like a small audit, get half the procedures wrong, and find out at quality review.
The standard’s test is simpler than that, but stricter than people think. ISRE 2400 (Revised), effective for periods ending on or after 31 December 2013, requires the practitioner to obtain limited assurance (primarily through inquiry and analytical procedures) that the historical financial statements as a whole are free from material misstatement, then express a negative-form conclusion under ISRE 2400.14. The file should tell a story: from your understanding of the entity, through the inquiry and analytics you ran, to the conclusion you signed.
Key takeaways
- How to scope and plan a review engagement under ISRE 2400 (Revised), including the understanding-of-the-entity requirements in paragraphs 39-44
- When and how to perform additional procedures under ISRE 2400.50 if inquiry and analytics surface something unexpected
- How to document your work so it survives a quality review, with specific paragraph references at each step
- What the negative-form conclusion report looks like and what triggers a modified conclusion under ISRE 2400.64-66
What ISRE 2400 (Revised) actually requires from you
ISRE 2400 (Revised) applies when a practitioner who is not the entity’s independent auditor performs a review of historical financial statements. If you are the entity’s auditor and you’re reviewing interim financials or other historical information, ISRE 2410 applies instead. The scope distinction matters because ISRE 2410 assumes you already have audit-based knowledge of the entity. ISRE 2400 assumes you do not.
The practitioner’s objective under ISRE 2400.14 is to obtain limited assurance, primarily by performing inquiry and analytical procedures, about whether the financial statements as a whole are free from material misstatement. You then express a conclusion in negative form: “nothing has come to our attention that causes us to believe that the financial statements are not prepared, in all material respects, in accordance with [framework].”
This is not a vague mandate to “do some inquiries and sign.” The standard has 90 paragraphs of requirements and application material. It requires you to understand the entity and its environment (ISRE 2400.39-44), design and perform procedures responsive to that understanding (ISRE 2400.45-49), perform additional procedures when something looks wrong (ISRE 2400.50-52), obtain written representations from management (ISRE 2400.61-62), and form a conclusion based on the evidence obtained (ISRE 2400.63). At firms like ours, the partners who reject ISRE 2400 work most often do it because the file reads as though the team waved through the analytics with “appears reasonable. Waive further pursuit.”
How the review differs from an audit (and from a compilation)
The level of assurance is the core difference. An audit under the ISAs provides reasonable assurance (a high but not absolute level). A review under ISRE 2400 provides limited assurance (a meaningful level, but less than reasonable). A compilation under ISRS 4410 provides no assurance at all.
In practical terms, the distinction shows up in the procedures. An audit requires the practitioner to identify and assess risks of material misstatement, then design and perform further audit procedures (tests of controls, substantive procedures) responsive to those assessed risks. ISRE 2400 does not require a formal risk assessment. Instead, ISRE 2400.45 requires the practitioner to design and perform inquiry and analytical procedures to address all material items in the financial statements, focused on areas where material misstatements are likely to arise based on the practitioner’s understanding.
No transaction testing. No confirmation letters. Inventory observations don’t happen either. Your evidence comes primarily from two sources: what management tells you in response to structured inquiry, and what your analytical procedures reveal about the plausibility of the numbers.
But “limited” does not mean “superficial.” ISRE 2400.A13 makes clear that the evidence must be sufficient and appropriate to support the practitioner’s conclusion. If your inquiries and analytics raise questions you can’t resolve, ISRE 2400.50 requires you to design and perform additional procedures until you can either resolve the matter or determine that the financial statements may be materially misstated.
Planning the engagement: acceptance through understanding
Engagement acceptance and terms
Before you accept, ISRE 2400.27-30 requires you to confirm that the preconditions for a review exist. Management must acknowledge its responsibility for preparing the financial statements in accordance with the applicable framework, for the internal control it considers necessary, for providing the practitioner with access to all relevant information, and for making available all records and documentation the practitioner requests. If management won’t accept these responsibilities, you don’t have a valid review engagement.
ISRE 2400.31-33 requires an engagement letter setting out the terms. The standard includes an illustrative letter in Appendix 1. Get the letter signed before you start work. If your firm also performs compilation or other non-assurance services for the entity, the engagement letter should clearly distinguish what the review covers.
Understanding the entity
ISRE 2400.39 requires you to obtain an understanding of the entity and its environment, and of the applicable financial reporting framework, sufficient to identify areas where material misstatements are likely to arise. This is not the same as the ISA 315 requirement for an audit (where you must understand internal control in detail and identify and assess risks). But it is not optional, and it is not a formality.
Paragraph 40 specifies the minimum: the relevant industry, the entity’s nature (operations, ownership, governance, how it is financed), the entity’s accounting system and accounting records, and the entity’s selection and application of accounting policies. If the entity operates in a sector with specific accounting requirements (real estate investment or construction contracts), you need to understand how those requirements affect the financial statements.
The output of this work is your basis for designing procedures. If you don’t understand the entity, you can’t identify where material misstatements are likely. If you can’t identify where they’re likely, your inquiry and analytical procedures won’t be directed at the right areas. The file will look thin, and a quality reviewer will notice.
Running the review: from inquiry through additional procedures
Inquiry
ISRE 2400.46 requires inquiry of management and others within the entity, as appropriate. The standard does not prescribe a fixed list of questions (the extant standard had one; the revised standard removed it deliberately). Instead, the inquiries should be designed based on your understanding of the entity and directed at areas where material misstatements are likely.
In practice, this means structured conversations with the financial controller or whoever prepares the financial statements. You’re asking about: significant transactions during the period, changes in accounting policies, related party transactions, contingencies and commitments, subsequent events, and any fraud or suspected fraud. Document what you asked and what you were told. A memo that says “we made inquiries of management” without recording the substance of those inquiries will not survive review.
ISRE 2400.47 also requires you to read the financial statements and consider whether anything in them appears inconsistent with the understanding you’ve obtained. This is an active exercise, not a read-through.
Analytical procedures
ISRE 2400.46 requires analytical procedures. These are evaluations of financial information through analysis of plausible relationships among both financial and non-financial data (the definition mirrors ISA 520 ). At a minimum, compare the current-period financial statements to the prior period. Calculate ratios. Look for movements that are inconsistent with your understanding of the entity’s operations during the period.
If the entity’s revenue grew 15% but its industry contracted, you have a question. A 40% drop in depreciation with no asset disposals is another. If trade payables doubled while purchasing volume stayed flat, that’s a third. Each question generates either a satisfactory explanation from management (which you document) or additional procedures.
ciferi’s ISA 520 Analytical Review Calculator can structure this work for you, even on a review engagement. The analytical procedure logic is the same; the difference is what happens with the results.
Additional procedures
When inquiry or analytics produce results that cause you to believe the financial statements may be materially misstated, ISRE 2400.50 requires you to design and perform additional procedures. These could include more targeted inquiries, supporting reconciliations, document inspection, or even substantive testing of the balance in question.
The standard is clear: you cannot ignore an indication of misstatement and still issue an unmodified conclusion. Paragraphs 51-52 state that if additional procedures do not resolve the matter, you must consider the effect on your conclusion. This is where review engagements start to feel like audits for specific balances, and where the documentation requirement intensifies.
Materiality in a review engagement
ISRE 2400 (Revised) does not use the term “materiality” in the same prescriptive way as ISA 320 does for audits. But ISRE 2400.A4 makes clear that the practitioner’s consideration of materiality is in relation to the financial statements as a whole, and the standard’s objective (paragraph 14) references whether the financial statements “are free from material misstatement.” You need a materiality figure to evaluate the significance of misstatements identified and to design procedures responsive to the areas where material misstatement is likely.
In our practice, we set a materiality level for the review engagement using the same benchmarks we would use in an audit (revenue, total assets, profit before tax, or equity), applying the same or similar percentages. The key difference is that ISRE 2400 does not require you to set a separate performance materiality the way ISA 320.11 does. You’re not aggregating individual testing results across multiple substantive procedures. Your mat figure functions as a single threshold against which you evaluate the results of inquiry and analytics.
Document your mat determination in the planning memo. State the benchmark used, the percentage applied, the resulting figure, any qualitative factors that led you to adjust it, and the basis for concluding the figure is appropriate. A quality reviewer will expect to see this before they look at any of the procedures.
Forming the conclusion and the practitioner’s report
ISRE 2400.63-86 governs the conclusion and reporting. The practitioner’s report follows a prescribed format set out in paragraphs 86-87, with illustrative reports in Appendix 2 of the standard.
An unmodified conclusion states (in negative form) that nothing has come to the practitioner’s attention that causes the practitioner to believe the financial statements are not prepared, in all material respects, in accordance with the applicable framework. The wording matters. “Negative assurance” is the older term; the standard uses “limited assurance” and the conclusion is expressed in negative form. Don’t use the old phrasing in your report.
ISRE 2400.64-66 addresses modified conclusions. You modify when you conclude that the financial statements are materially misstated (qualified or adverse conclusion) or when you’re unable to obtain sufficient appropriate evidence (disclaimer of conclusion). A qualified conclusion describes the matter giving rise to the modification and its effects (or possible effects) on the financial statements. An adverse conclusion states that the financial statements are materially and pervasively misstated.
One scenario catches practitioners off guard: the scope limitation imposed by management. If management restricts access to information or refuses to provide written representations (ISRE 2400.61-62), you cannot complete the engagement in accordance with the standard. ISRE 2400.73-74 requires you to consider whether withdrawal from the engagement is appropriate, or whether a disclaimer of conclusion is the right response. Nobody enjoys having that conversation with the client, but signing a clean conclusion when access has been blocked is how files get flagged. Document the circumstances and your reasoning either way.
Worked example: Van Houten Holding B.V.
Van Houten Holding B.V. is a private Dutch holding company with two operating subsidiaries (commercial real estate management and facility services). Revenue: €28M. Framework: Dutch GAAP (RJ). Year-end: 31 December 2024. The practitioner is not the entity’s auditor.
1. Acceptance and engagement letter
The engagement partner confirms preconditions under ISRE 2400.27-30. Management signs the engagement letter acknowledging its responsibilities. The letter specifies Dutch GAAP (RJ) as the applicable framework and references ISRE 2400 (Revised).
Documentation note: Signed engagement letter filed. Acceptance checklist completed per ISQM 1 requirements.
2. Understanding the entity
The team documents: Van Houten holds two subsidiaries, one generating rental income (€18M) and one providing facility services (€10M). Rental contracts are long-term (5-10 year terms). Facility services revenue is project-based. The company has a €12M term loan with ING, covenanted on a debt service coverage ratio of 1.2x. Accounting policies are stable; no changes from prior year. One property was acquired in Q3 2024 for €4.2M.
Documentation note: Understanding memo filed under ISRE 2400.39-44. Key accounting policies documented. Industry: commercial real estate and facility services.
3. Inquiry
The team conducts structured inquiry with the financial controller. Key topics covered: the Q3 property acquisition and its accounting treatment, covenant compliance at year-end, any related party transactions (the sole shareholder also owns a construction company that performed renovations on two properties), subsequent events (none identified by management), and any known or suspected fraud (none reported).
Documentation note: Inquiry memo filed. Each question and the response documented. Related party transaction flagged for analytical follow-up.
4. Analytical procedures
Rental income increased 8% year-on-year. Two new tenants were signed in January and April 2024, consistent with the increase. Facility services revenue declined 6%, which management explains by the loss of one large contract (€0.8M annual value) in Q2. The team verifies the explanation is consistent with the contract register. Depreciation increased 14%, consistent with the €4.2M property acquisition and the entity’s depreciation policy (40-year straight-line on buildings). Trade receivables aged over 90 days: €310K, up from €180K. Management attributes this to a single facility services client with a payment dispute.
The €310K aged receivable raises a question. The practitioner considers whether the provision for doubtful debts (currently €45K) is adequate.
Documentation note: Analytical review workpaper filed. Expectations and variances documented with explanations. Aged receivable flagged for additional procedure.
5. Additional procedure on aged receivable
Under ISRE 2400.50, the team performs an additional procedure. The practitioner inspects correspondence between Van Houten and the client and obtains management’s assessment of recoverability. Management provides evidence that €220K of the €310K is expected to be recovered based on an ongoing mediation. The practitioner concludes that an additional provision of approximately €45K (bringing total to €90K) would be appropriate. Management agrees to adjust.
Documentation note: Additional procedure workpaper filed under ISRE 2400.50. Adjustment of €45K to doubtful debt provision recorded. Matter resolved.
6. Written representations and conclusion
Management provides written representations under ISRE 2400.61-62, confirming responsibility for the financial statements, completeness of information provided, disclosure of all known related party transactions, and that all events occurring after the date of the financial statements have been considered. The practitioner reviews the financial statements as adjusted and forms an unmodified conclusion.
Documentation note: Management representation letter filed. Practitioner’s report issued with unmodified conclusion per ISRE 2400.86.
The file contains: signed engagement letter, acceptance checklist, understanding memo, inquiry memo, analytical review workpaper, one additional procedure workpaper, management representation letter, and the practitioner’s report. A quality reviewer would see a clear thread: understanding drives the procedures and procedures support the conclusion.
Practical checklist for your next ISRE 2400 engagement
- Confirm the engagement falls under ISRE 2400 (you are not the entity’s auditor) and not ISRE 2410 (you are the entity’s auditor). This determines which standard governs and whether you can rely on prior audit knowledge (ISRE 2400.2).
- Get the engagement letter signed before performing any procedures. Include explicit references to management’s responsibilities and the applicable framework (ISRE 2400.31-33).
- Document your understanding of the entity in a standalone memo covering industry, operations, financing, and accounting policies (ISRE 2400.39-44). Do not treat this as a formality; it drives every procedure that follows.
- Design inquiries directed at the areas where your understanding suggests material misstatements are likely. Document each question, the respondent, their answer, and your assessment of whether the response is consistent with the financial statements (ISRE 2400.46).
- Perform analytical procedures on all material items. For each variance that exceeds your expectation, document the explanation obtained and your assessment of whether it resolves the matter (ISRE 2400.46).
- If any inquiry or analytical result causes you to believe the financial statements may be materially misstated, perform additional procedures under ISRE 2400.50. Do not leave unresolved items in the file.
- Obtain written representations from management covering the matters in ISRE 2400.61-62 before issuing your report.
- The single most important thing: your file should show a visible thread from the understanding of the entity, through the procedures performed, to the conclusion. If a reviewer cannot trace that thread, the file is not ready.
Common mistakes
- Treating the review as a lighter compilation rather than a distinct assurance engagement. The NBA’s quality reviews have flagged files where the practitioner performed no analytical procedures at all, issuing a limited assurance conclusion based solely on management inquiry. ISRE 2400.46 requires both inquiry and analytical procedures.
- Failing to perform additional procedures when analytics surface unexplained variances. ISRE 2400.50 is not discretionary. If you see a balance that doesn’t make sense given your understanding of the entity and management can’t explain it, you must do more work before you can conclude.
- Omitting the understanding-of-the-entity memo entirely. Without it, a reviewer cannot determine whether your procedures were appropriately designed or whether you considered the right areas. ISRE 2400.39 makes the understanding a precondition for the procedures, not an optional extra.
- Inquiry memos written so thinly that the reviewer can’t see what was actually asked. We’ve seen files where the inquiry section reads “discussed with finance team, no issues identified” for an entire engagement. That isn’t evidence. It is a one-line confirmation that someone had a meeting.
Related content
- Limited assurance. Explains the concept of limited assurance as it applies across ISRE 2400 and ISAE 3000 engagements, and how it differs from reasonable assurance in an audit.
- ISA 520 Analytical Review Calculator. The analytical procedure logic used in a review engagement mirrors the ISA 520 framework. This calculator structures the expectation-versus-actual comparison for each financial statement line.
- ISRE 2410: How to perform an interim review as the entity’s auditor. If you are the entity’s auditor performing a review of interim or other historical financial information, ISRE 2410 applies instead. This companion post covers the differences.
Related ciferi content
Related guides:
Put audit concepts into practice with these free tools:
Frequently asked questions
What is the difference between a review under ISRE 2400 and an audit under the ISAs?
An audit provides reasonable assurance (high but not absolute) through risk assessment, tests of controls, and substantive procedures. A review under ISRE 2400 provides limited assurance primarily through inquiry and analytical procedures. No transaction testing, confirmation letters, or inventory observations are performed. However, if inquiries and analytics raise unresolved questions, ISRE 2400.50 requires additional procedures until the matter is resolved.
When does ISRE 2400 apply instead of ISRE 2410?
ISRE 2400 applies when the practitioner performing the review is not the entity's independent auditor. If you are the entity's auditor and you are reviewing interim or other historical financial information, ISRE 2410 applies instead. The distinction matters because ISRE 2410 assumes you carry forward audit-based knowledge, while ISRE 2400 assumes you have none.
Does a review engagement under ISRE 2400 require a materiality determination?
ISRE 2400 does not prescribe materiality in the same way as ISA 320 , but the standard's objective references whether financial statements are free from material misstatement. In practice, most firms set a materiality level using the same benchmarks as an audit (revenue, total assets, profit before tax, or equity). The key difference is that ISRE 2400 does not require a separate performance materiality.
What triggers a modified conclusion under ISRE 2400?
Under ISRE 2400.64–66, you modify your conclusion when you conclude that the financial statements are materially misstated (qualified or adverse conclusion) or when you are unable to obtain sufficient appropriate evidence (disclaimer of conclusion). If management restricts access to information or refuses to provide written representations, you must consider withdrawal or a disclaimer.
Further reading and source references
- IAASB Handbook 2024: The authoritative source for the complete ISRE 2400 (Revised) text.
- ISRE 2410: Review of interim financial information performed by the independent auditor of the entity.
- ISRS 4410 (Revised): Compilation engagements, providing no assurance.
- ISA 520 : Analytical procedures in an audit context, with the same expectation-versus-actual logic applied in review engagements.