The AICPA’s Attestation Standards Section
AT 101, Attest Engagements (AT 101)
enables practitioners to report on subject
matter other than historical financial
statements. It permits practitioners to
report directly on subject matter such as
data or information or to report on an
assertion about the subject matter. The
approach in CICA Handbook Section 5025
is similar in this respect. Several sections of
this paper explore the application of these
standards. In addition, TSP section 100
Trust Services Principles, Criteria and
Illustrations for Security, Availability,
Processing Integrity, Confidentiality and
Privacy (AICPA, Technical Practice Aids)
5
provides reporting guidance for situations
in which a practitioner is reporting on the
effectiveness of controls over the system
that processes or stores the information,
rather than on the information itself. New
attestation standards are unlikely to be
necessary in order for a practitioner to
report on the integrity of information, but
new guidance by the profession will likely
be needed.