Non-Assurance Services Under Section 5600 — the Self-Review Prohibition

Non-Assurance Services explained: this guide covers what it means, who it applies to, the step-by-step process, documents required, fees, due dates and penalties in India — so you can stay compliant with confidence and avoid costly mistakes.

Section 5600 requires a firm to determine, before providing non-assurance services to a sustainability assurance client, whether they might create a self-review threat — and R5600.17 prohibits non-assurance services outright for a public interest entity, because such a threat cannot be eliminated or safeguarded.

When Section 5600 applies to non-assurance services

Paragraph 5600.2 acknowledges that firms and network firms might provide a range of non-assurance services to their sustainability assurance clients, consistent with their expertise. Paragraph 5600.5 accepts that no all-inclusive list is possible, given new business practices, the developing sustainability landscape, the evolution of financial markets and sustainability reporting, and changes in technology — so the conceptual framework and the general provisions apply wherever there is no specific subsection.

Paragraph 5600.5a sets the gateway. The section applies where a firm or network firm provides a non-assurance service to a sustainability assurance client and:

• (a) the results of the service will affect, or there is a risk that they will affect, the sustainability information on which the firm will express an assurance opinion, the records underlying that information, or the internal controls over sustainability reporting; or
• (b) the services might create an advocacy, self-interest, familiarity or intimidation threat.

Paragraph 5600.6 adds that circumstances affecting the sustainability information include where a firm or network firm uses technology to provide a non-assurance service.

Before accepting non-assurance services — R5600.9 and management responsibility

Paragraph R5600.9: before a firm or network firm accepts an engagement to provide a non-assurance service to a sustainability assurance client, the firm shall apply the conceptual framework to identify, evaluate and address any threat to independence that might be created.

Paragraph 5600.8 A1 flags the standing risk that runs through all non-assurance services: whenever such a service is provided, there is a risk that the firm will assume a management responsibility unless it is satisfied that R5400.21 has been complied with — and R5400.20 prohibits assuming one.

Paragraph 5600.10 A2 lists the factors for identifying and evaluating the threats, and they range widely — the nature, scope, intended use and purpose of the service; the manner of delivery including personnel and their location; the client's dependency on the service and its frequency; the legal and regulatory environment; whether the client is a public interest entity; the expertise of the client's own management and employees; the extent to which the client determines significant matters of judgment; whether the outcome will affect the sustainability information and, if so, the materiality of that effect and the degree of subjectivity involved; the impact on the systems generating that information or the internal controls; the degree of reliance that will be placed on the outcome in the assurance engagement; and the fee for the service.

The self-review determination — R5600.15

Paragraph 5600.14 A1 defines the concern: there might be a risk of the firm carrying out assurance procedures on its own or the network firm's work. A self-review threat is the threat that the firm will not appropriately evaluate the results of a previous judgment made or activity performed by someone in the firm as part of a non-assurance service on which the assurance team will rely.

Paragraph R5600.15: before providing a non-assurance service, the firm shall determine whether it might create a self-review threat by evaluating whether there is a risk that:

• (a) the results of the service will form part of or affect the sustainability information, the records underlying it, or the internal controls over sustainability reporting; and
• (b) in performing the assurance work, the assurance team will evaluate or rely on any judgments made or activities performed by the firm or network firm in providing the service.

Both limbs must be present. A service whose results touch the sustainability information but on which the assurance team will place no reliance does not satisfy limb (b) — and a service the team would rely on but which touches nothing in the information does not satisfy limb (a).

Non-assurance services for public interest entities — the flat prohibition

Paragraph 5600.16 A1 records that where the client is a public interest entity, stakeholders have heightened expectations regarding the firm's independence, and that those expectations are relevant to the reasonable and informed third party test.

Paragraph 5600.16 A2 then states the conclusion that drives the rule: where such a service creates a self-review threat, that threat cannot be eliminated, and safeguards are not capable of being applied to reduce it to an acceptable level.

Paragraph R5600.17: a firm or network firm shall not provide a non-assurance service to a sustainability assurance client that is a public interest entity if the provision might create a self-review threat in relation to the assurance work.

The advice and recommendations exception

Paragraph R5600.18: as an exception to R5600.17, a firm or network firm may provide advice and recommendations to a public interest entity client in relation to information or matters arising in the course of a sustainability assurance engagement, provided the firm:

• (a) does not assume a management responsibility; and
• (b) applies the conceptual framework to identify, evaluate and address threats other than self-review threats.

Paragraph 5600.18 A1 gives four examples — advising on sustainability reporting standards or policies and disclosure requirements; advising on the appropriateness of controls and the methods used in determining the information to be reported; proposing an adjustment arising from the engagement findings; and discussing findings on internal controls and recommending improvements.

Multiple non-assurance services, and what to do when safeguards run out

Paragraph R5600.13: where a firm provides multiple non-assurance services to the same client, it shall consider whether, in addition to the threats created by each service individually, the combined effect creates or impacts threats to independence. Paragraph 5600.13 A1 asks whether the combined effect increases the level of threat created by each service assessed individually, and whether it increases any threat arising from the overall relationship with the client. Where the firm is also the auditor, 5600.13 A2 directs it to R600.13 and 600.13 A1 in Part 4A.

Paragraph 5600.19 A3 gives the two standard safeguards — using professionals who are not assurance team members to perform the service, and an appropriate reviewer who was not involved in providing the service reviewing the assurance work or the service. Paragraph 5600.19 A2 adds that threats might also be addressed by adjusting the scope of the proposed service.

Paragraph 5600.19 A4 sets out what must happen where safeguards are not available. The firm shall:

• (a) adjust the scope of the proposed service to eliminate the circumstances creating the threats;
• (b) decline or end the service; or
• (c) end the sustainability assurance engagement.

Documenting non-assurance services

Paragraph 5600.28 A1 lists what documentation of the firm's conclusions under R5400.60 might include: the key elements of the firm's understanding of the service and whether and how it might impact the sustainability information; the nature of any threat, including whether the results will be subject to assurance procedures; the extent of management's involvement in providing and overseeing the service; any safeguards or other actions; the firm's rationale for determining that the service is not prohibited and that any threat is at an acceptable level; and the steps taken to comply with R5600.22 to R5600.24.

Practical checklist

• Run the R5600.15 determination before providing non-assurance services, not after.
• Test both limbs — effect on the information, records or controls, and reliance by the assurance team.
• Where the client is a public interest entity and both limbs are met, decline; no safeguard is available.
• Do not treat materiality as a defence to a prohibition.
• Run the Part 4A audit analysis separately where the firm is also the auditor.
• Confine reliance on R5600.18 to matters actually arising in the engagement.
• Assess the combined effect of multiple services, not only each one.
• Where safeguards are unavailable, adjust scope, decline, or end the assurance engagement.
• Document the six items in 5600.28 A1.

Common mistakes

• Determining the self-review question after the service has begun.
• Clearing non-assurance services through the Part 4A audit analysis and treating Section 5600 as satisfied.
• Arguing materiality against an express prohibition.
• Reading R5600.18 as a general advisory permission for public interest entity clients.
• Assessing each service in isolation and never testing the combined effect.
• Documenting the conclusion but not the rationale.