Compilation vs Review vs Audit Under SSARS: Three Levels of Service, Three Reports, and What Each One Assures

An accountant who is not independent of a client may still compile that client's financial statements. AR-C 80 asks only that the compilation report say so, in a final paragraph, and leaves it to the accountant whether to explain why. A review is the opposite: independence is an unconditional requirement, and an accountant whose independence becomes impaired part way through one has to withdraw.

That asymmetry follows from what each engagement claims. A compilation claims nothing, so a reader told the accountant is not independent has lost nothing that was on offer. A review claims limited assurance, and assurance from someone who is not independent is not assurance.

Below all of it sits a fourth engagement most candidates skip. A preparation engagement under AR-C 70 produces no report and does not require the accountant to decide whether they are independent at all. A Gulf reader arrives fluent in ISRS 4410 and ISRE 2400, which helps with the shape and hurts with the detail: SSARS draws the independence line elsewhere, and lets a review that runs out of evidence end in only one way where the international standard offers two.

Four engagements, not three

The AICPA's Accounting and Review Services Committee issues Statements on Standards for Accounting and Review Services, codified as AR-C sections. AR-C 60 carries the general principles; the three service sections sit on top of it, AR-C 70 for preparation, AR-C 80 for compilation, AR-C 90 for review. An audit is not a SSARS engagement at all and lives in the AU-C sections.

Engagement	Standard	What the accountant does	What the reader gets
Preparation	AR-C 70	Prepares the statements from management's records under a specified framework	No report. A legend on each page saying no assurance is provided
Compilation	AR-C 80	Reads the statements for obvious material misstatement and reports	A report, and no assurance
Review	AR-C 90	Analytical procedures and inquiries, plus more if something looks wrong	Limited assurance, as a negative conclusion
Audit	AU-C sections	Risk assessment, work on controls where relevant, substantive evidence	Reasonable assurance, a high but not absolute level, as an opinion

The preparation engagement has no analogue in most candidates' working life, and AR-C 70 defines it by what it is not. Paragraph .03 calls it a nonattest service and says it does not require a determination about whether the accountant is independent. Paragraph .04 says it does not require the accountant to verify what management provided. Paragraph .06 gives the objective in a line: prepare the statements pursuant to a specified financial reporting framework.

What stops it being mistaken for something more is a legend. Paragraph .14 requires a statement on each page indicating, at a minimum, that "no assurance is provided". If that is impossible, there are exactly three exits: a disclaimer making clear that no assurance is provided, a compilation under AR-C 80 instead, or withdrawal with the reasons given to management. There is no fourth option in which the statements go out unmarked.

One boundary moved recently. SSARS No. 27, issued in April 2025, rewrote that scope so that statements prepared inside a consulting services engagement under CS section 100, where preparing them is not the primary objective, need not be brought under AR-C 70, though applying it is not precluded. It takes effect for periods ending on or after 15 December 2026, so both versions are currently live in the codification.

What each level actually assures

Be precise with the three words, because the exam is. An audit gives reasonable assurance, which the AICPA's attestation standards define as a high but not absolute level of assurance. A review gives limited assurance, which AR-C 90 defines as a level less than the reasonable assurance obtained in an audit but at an acceptable level as the basis for the conclusion expressed in the report. A compilation gives none.

None means none. A compilation does not provide "negative assurance", and the phrase is worth unlearning, because the negative wording belongs to the review. With nothing to modify, AR-C 90 .68 prescribes the sentence: "Based on our review, we are not aware of any material modifications that should be made to the accompanying financial statements for them to be in accordance with [the applicable financial reporting framework]." The compilation report says something different in kind: that the accountant did not audit or review the statements, was not required to verify what management provided, and does not express an opinion, a conclusion, nor provide any assurance.

The compilation: nothing to verify

AR-C 80 .02 is the sentence the section hangs from: because a compilation is not an assurance engagement, it does not require the accountant to verify the accuracy or completeness of the information provided by management or otherwise gather evidence to express an opinion or a conclusion. Paragraph .04 puts the objective as applying accounting and financial reporting expertise to assist management in presenting the statements, and reporting, without undertaking to obtain or provide any assurance.

That is not the same as doing nothing. Paragraph .13 requires the accountant to read the statements in light of the applicable framework and the significant accounting policies adopted, and consider whether they appear appropriate in form and free from obvious material misstatement. Where the records or explanations are incomplete, inaccurate or unsatisfactory, .14 sends the accountant back to management; where the statements need revision or are misleading, .15 requires the revisions to be proposed; and .16 requires withdrawal if management will not provide what was asked for, or will not revise and the accountant will not disclose the departure in the report.

A compilation therefore obliges the accountant to notice, not to verify. The exam likes the gap between those two verbs.

Independence in a compilation, and the final paragraph

AR-C 80 .07 says the accountant must determine whether the accountant is independent of the entity. In SSARS drafting, "must" marks an unconditional requirement and "should" marks a presumptively mandatory one, so the determination is never optional. What is optional is the outcome. Paragraph .22 says that when the accountant is not independent, the accountant should indicate that lack of independence in a final paragraph of the report, and .23 adds that an accountant who elects to give the reasons must give all of them. The standard's own illustration is one sentence: "We are not independent with respect to XYZ Company."

This is the rule that most reliably catches an auditor trained on the international code, because the international code does not get you there. ISRS 4410 records in A21 that the IESBA Code's independence provisions for audit, review and other assurance engagements do not extend to compilations, leaving the question to national codes, laws or regulations. The AICPA arrives at the same starting point and then adds a requirement the IESBA Code does not: disclose the impairment in the report.

Nothing here weakens independence where it is required. What impairs it, and who counts as a covered member, is a separate and much larger body of rules, set out in Independence Under the AICPA Code. The compilation rule sits on top of those, and is not an exemption from them.

The review: limited assurance from inquiry and analytical procedures

AR-C 90 .07 gives two objectives: obtain limited assurance, primarily by performing analytical procedures and inquiries, as a basis for reporting whether the accountant is aware of any material modifications that should be made; and report on the statements as a whole. "Primarily" is doing real work there. Paragraph .05 requires an accountant who becomes aware of a matter suggesting material misstatement to design and perform whatever additional procedures the circumstances need, so a review does not stop when the inquiries stop.

The requirements that most often surprise candidates who think of a review as an audit with the hard parts removed:

Requirement	AR-C 90	Why it matters
Independence, without exception	.10	The accountant must be independent, and must withdraw if independence is impaired mid-engagement. No disclosure alternative.
Materiality is determined	.19 to .20	Set for the statements as a whole, applied in designing procedures and evaluating results, revised if new information would have changed it.
Understanding of the industry and the entity	.21 to .23	Analytical procedures without an expectation are decoration, and the expectation comes from here.
Written representations	.58 to .63	They are review evidence. If management will not provide them, the accountant withdraws.
No disclaimer	.48	If sufficient appropriate review evidence cannot be obtained, the accountant withdraws.

That last row is the sharpest difference from an audit. An auditor who cannot obtain evidence still has a report to issue: a qualified opinion or a disclaimer, depending on pervasiveness, on the grid set out in Audit Opinions: Unmodified, Qualified, Adverse and Disclaimer. An accountant reviewing under SSARS has no such report. The only modifications AR-C 90 recognises run off misstatement, not off scope: a qualified conclusion when the matter is material but not pervasive, an adverse conclusion when it is material and pervasive, each preceded by a basis paragraph under a heading that names it.

One scope point closes the section. AR-C 90 .02 does not apply to a review of interim financial information where the latest annual statements were audited by the accountant or a predecessor, the accountant is engaged for the current year audit, and the interim information uses the same framework; that engagement goes to AU-C 930. ISRE 2400 .02 splits the same way, excluding a review performed by the entity's independent auditor.

That split is where a Gulf reader most often meets a review. A Saudi listed issuer publishes interim financial statements within 30 days of the period end under the Capital Market Authority's continuing obligations, prepared under the standards adopted by SOCPA, and the Authority's rules elsewhere call them "reviewed interim financial statements". That is an auditor's interim review, not the standalone review of a private company AR-C 90 and ISRE 2400 are written for.

The international standards side by side

Point	SSARS	IAASB
Compilation	AR-C 80	ISRS 4410 (Revised), a related service, not assurance
Review	AR-C 90	ISRE 2400 (Revised), a limited assurance engagement
Preparation as a named engagement	Yes, AR-C 70, with no report	No separate standard; ISRS 4410 covers assisting management with preparation
Independence in a compilation	Must be determined; lack of it disclosed in a final paragraph	The IESBA independence provisions do not extend to compilations; national codes may add requirements
Compilation report	Short, with the "did not audit or review" statement	Longer: describes what a compilation entails and states that no audit opinion or review conclusion is expressed
Review with insufficient evidence	Withdraw	Disclaim a conclusion, or withdraw where law or regulation allows

The two compilation standards are close enough that a Gulf practitioner will recognise nearly every requirement. Two differences are worth carrying into the exam: the disclosure of impaired independence, a SSARS invention, and the disclaimed review conclusion, an IAASB option with no SSARS equivalent. Agreed-upon procedures sit outside this table because the AICPA puts them in its attestation standards, as AT-C 215, rather than in SSARS; the IAASB covers them in ISRS 4400 (Revised), and agreed-upon procedures engagements compares the two, including the independence rule on which they split.

What AUD tests here, and at what level

The AUD introduction names three families of engagement, and accounting and review service engagements, meaning preparation, compilation and review, are the third. The SSARS and their interpretations are on the AUD reference list, so they are examinable source material, not background.

The content sits in Area IV, Forming Conclusions and Reporting, which is 10 to 20% of AUD, as group C. The tasks are narrow and the skill levels are the point: identify the factors an accountant should consider when performing a preparation engagement, and when reporting on a compilation and on a review, all at Remembering and Understanding; determine the appropriate form and content of the report for a compilation and for a review, at Application. Nothing in the group is written at Analysis or Evaluation. AUD's Evaluation band, the one that makes the section hard, sits in the risk and evidence areas instead.

So this is cheap material: decidable, finite, and best learned as a precise vocabulary of required report statements. Treat it the way you treat the opinions grid, secure it completely, and spend the recovered time on Areas II and III.

Where to practise this

Reporting questions are answered from wording, so practice with full explanations is worth more here than rereading the standard. Prepito's AUD course covers Area IV with practice questions, timed simulations and mistake review in English, and the section is mapped in the CPA AUD study guide.

CPA questions and written explanations are in English. Prepito’s interface is available in English and Arabic, and the AI tutor can respond in either language.

If you are sitting the SOCPA Fellowship instead, or as well, the same material is examined through the international standards: see Audit in the SOCPA Fellowship, or the CPA programme for the qualification as a whole.

---

Sources: AICPA Statements on Standards for Accounting and Review Services (Clarified), AR-C sections 60, 70, 80 and 90, AICPA Attestation Standards (Clarified), AT-C sections 100 to 300 for the definition of reasonable assurance, AICPA on SSARS No. 27, Uniform CPA Examination Blueprints effective 1 January 2026, ISRS 4410 (Revised), ISRE 2400 (Revised), Capital Market Authority Rules on the Offer of Securities and Continuing Obligations. Paragraph numbers are those of the current codification; SSARS are amended regularly and two versions of a section can be in force at once while an amendment phases in, so check the effective date attached to any paragraph you rely on, and confirm the Blueprint for your testing window.