Side-by-side comparison
| Dimension | Reasonable Assurance | Limited Assurance |
|---|---|---|
| Engagement type | Audit (ISA 200) or reasonable assurance engagement (ISAE 3000) | Review (ISRE 2400) or limited assurance engagement (ISAE 3000) |
| Conclusion wording | Positive: "In our opinion, the financial statements give a true and fair view..." | Negative: "Based on our review, nothing has come to our attention that causes us to believe..." |
| Primary evidence | Inspection, observation, external confirmation, recalculation, analytical procedures, inquiry | Primarily inquiry and analytical procedures |
| Risk assessment | Full risk assessment under ISA 315 required | Understanding the entity required, but no formal risk assessment at assertion level |
| Level of assurance | High (but not absolute) | Meaningful, but lower than reasonable assurance |
Key Points
- Reasonable assurance supports a positive opinion ("the financial statements give a true and fair view").
- Limited assurance supports a negative conclusion ("nothing has come to our attention").
- The evidence threshold is the core difference: reasonable assurance requires more work, not different work.
- Choosing the wrong engagement type cannot be fixed by doing more procedures after the fact.
When the distinction matters on an engagement
The distinction matters most at acceptance. Once you sign an engagement letter specifying reasonable assurance, you commit to the full ISA framework. There is no mechanism under ISA 200.5 to downgrade to limited assurance mid-engagement because the evidence turns out to be harder to obtain than expected. If you accepted a review engagement under ISRE 2400 and subsequently discover indicators of fraud or material misstatement, ISRE 2400.80 requires you to consider whether the matter can be resolved within the scope of a review. If it cannot, you face a scope limitation on your conclusion.
For sustainability reporting under the CSRD, this distinction is becoming particularly acute. The first wave of CSRD assurance engagements (from financial year 2024 onward) requires limited assurance under ISAE 3000. The European Commission has indicated that it intends to move to reasonable assurance in a later phase. Firms performing limited assurance now need to design their procedures with that transition in mind, because the documentation standards will tighten.
Worked example: Weidmann Maschinenbau GmbH
Client: German subsidiary of a listed group, FY2024, revenue €65M, reporting under HGB for statutory purposes. The parent group auditor requires a statutory audit (reasonable assurance). The subsidiary also prepares a sustainability report subject to limited assurance.
Reasonable assurance (statutory audit)
The auditor performs a full risk assessment under ISA 315 and identifies revenue as a significant risk. The team tests a sample of 40 invoices against delivery documentation and customer confirmations to obtain sufficient appropriate evidence that revenue of €65M is not materially misstated.
Documentation note: "ISA 200.5 requires reasonable assurance. Risk assessment completed per ISA 315.12. Revenue sample of 40 items selected, tested against shipping documents and confirmations. Conclusion: sufficient appropriate evidence obtained."
Limited assurance (sustainability report, same entity)
For the sustainability report, the engagement partner scopes the work under ISAE 3000.12(a)(v). The team performs inquiry of the sustainability officer on data collection methods and runs analytical procedures on reported Scope 1 and Scope 2 emissions against prior-year figures and industry benchmarks.
Documentation note: "ISAE 3000 limited assurance engagement. Procedures limited to inquiry and analytical procedures per ISAE 3000.49L. No detailed testing of underlying emissions data. Conclusion to be worded negatively per ISAE 3000.72L."
If the team applied only inquiry and analytical procedures to the statutory audit revenue balance (as they would in a review), the evidence would not meet ISA 200.5's threshold. The file would fail inspection. Conversely, if the team performed full substantive testing on the sustainability report, they would exceed the scope of a limited assurance engagement and could not issue a negative-form conclusion.
What reviewers get wrong
Firms sometimes describe a review engagement as providing "some" or "moderate" assurance. Neither term appears in ISRE 2400 or ISAE 3000. The correct term is "limited assurance," and it has a defined meaning: a level that is meaningful but lower than reasonable assurance (ISAE 3000.12(a)(v)). Imprecise language in the engagement letter creates expectation gaps with the client.
On CSRD-related engagements, teams have applied audit-level procedures to sustainability data without adjusting the conclusion wording. If the engagement letter specifies limited assurance, the conclusion must be negatively worded regardless of how much work was performed. Extra procedures do not convert a limited assurance engagement into a reasonable assurance engagement.
Key standard references
- ISA 200.5: Defines reasonable assurance as a high but not absolute level of assurance.
- ISRE 2400.11–12: Defines limited assurance in the context of review engagements.
- ISAE 3000.12(a)(ii) and 12(a)(v): Defines both assurance levels for non-financial subject matters.
- ISAE 3000.49L: Specifies procedures for limited assurance engagements.
Related terms
Related reading
Frequently asked questions
Can you upgrade a limited assurance engagement to reasonable assurance mid-engagement?
No. The engagement type is fixed at acceptance. ISA 200.5 sets the evidence threshold for reasonable assurance. If you accepted a review engagement under ISRE 2400, you need a new engagement letter under ISA 210 to perform an audit. The review procedures you already performed do not count toward audit evidence.
Does doing more work on a limited assurance engagement convert it to reasonable assurance?
No. Extra procedures do not change the engagement type. If the engagement letter specifies limited assurance, the conclusion must be negatively worded regardless of how much work was performed. The engagement type determines the conclusion wording, not the volume of procedures.