What it means
Every attestation involves three parties: the responsible party who makes an assertion, the practitioner who examines it, and the intended users who need to rely on it. The practitioner does not make the claim themselves; they report on somebody else's claim after gathering evidence about it.
That triangle is what separates an attestation from a simple opinion or a marketing statement. An audit of financial statements is the best known form of attestation, but the family is much wider.
Practitioners also perform examinations of control environments, reviews that give a lower level of assurance, and agreed-upon procedures where the user specifies exactly what should be tested. Each produces a different report and each carries a different weight.
The level of assurance is the detail that matters most and the one non-specialists most often skip. A reasonable assurance engagement involves extensive testing and produces a positive statement that the subject matter is fairly stated.
A limited assurance engagement involves less work and produces a negative statement saying nothing came to the practitioner's attention suggesting a problem. In everyday business life attestations show up whenever trust has to cross an organisational boundary.
A software vendor gives enterprise customers a service organisation control report so they do not each have to audit the vendor's security. A franchisee's royalty return, a landlord's service charge account and a borrower's covenant certificate are often attested for the same reason.
Getting an attestation is a project with a cost, and the cost scales with scope, evidence quality and how well the responsible party has documented its own claim. Organisations that keep clean records, define their metrics precisely and test their own controls first pay noticeably less.
Organisations that treat the practitioner as the person who will tidy up the numbers pay a great deal more. The important nuance is that an attestation is not a guarantee and its value stops at the edge of its scope.
A report covering security controls at a data centre says nothing about the vendor's financial health, and a report covering the year to December says nothing about what happened in March. Reading the scope paragraph is not optional.
In practice
Real-world examples.
Example
A healthcare analytics vendor pursues a service organisation control report covering security and availability so that hospital customers can complete procurement without running their own audits. The report costs the vendor around $70,000 a year and removes roughly six weeks from a typical enterprise sales cycle. The sales director treats it as a cost of doing business rather than a compliance chore.
Example
A coffee franchisor requires each franchisee turning over more than $1,000,000 to submit an accountant's attestation on the gross sales figure used to calculate royalties. Before the requirement came in, disputed royalty figures were absorbing days of head office time each month. Afterwards the disputes largely disappeared.
Example
A manufacturer with a $30,000,000 term loan must send its bank a quarterly compliance certificate showing its leverage and interest cover. Once a year the bank asks for an accountant's attestation on the underlying calculations rather than accepting management's word alone. The finance team schedules the work alongside the annual audit to keep the fee down.
Case study
Seen in the real world.
Brightloom Software is an illustrative, fictional workforce planning company invented to show how attestation changes a commercial conversation. Brightloom kept losing large deals at the security review stage because each prospective customer wanted to run its own questionnaire and site visit, and the process was taking between two and four months. The chief executive initially saw an independent controls attestation as an expensive piece of paperwork.
The finance and engineering teams spent five months tightening access controls, documenting change management and evidencing their backup testing before a practitioner examined the environment and issued a report. The first year cost about $95,000 including internal time, which felt steep against a $40,000 external fee estimate that had ignored the preparation.
In the following twelve months of this fictional scenario, Brightloom closed four enterprise contracts where the report replaced a bespoke review, and the average security review shrank to eleven days. The lesson worth taking is that most of the cost sat in getting the underlying claim right, not in the attestation itself.
Watch out
Common mistakes.
- Treating any attestation report as equivalent to an audit. Reviews and agreed-upon procedures give far less assurance than an audit, and the report wording says so plainly if you read it.
- Accepting a report without checking the period it covers. A report covering a twelve-month window that ended fourteen months ago tells you very little about current conditions.
- Assuming the practitioner is responsible for the underlying claim. The responsible party makes the assertion and remains accountable for it; the practitioner only reports on whether it is fairly stated.
Questions
People also ask.
Who can issue an attestation?
Typically a licensed accounting firm or another suitably qualified independent professional, and the qualification required depends on the subject matter and the standard being applied.
Is an attestation the same as a certification?
No, a certification usually means an organisation met a defined standard, whereas an attestation is an independent professional's conclusion on a specific assertion.
How long does an attestation stay useful?
Usually until the next reporting period, since users generally want a current report and most engagements are repeated annually.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%Related