Positive assurance is a direct opinion from an auditor that a company’s financial statements are fairly presented; negative assurance is a softer conclusion from a reviewer stating that nothing came to their attention suggesting the statements need material modification. The difference between positive and negative assurance comes down to how much work the accountant performed and, therefore, how much confidence a lender, regulator, or investor can place in the numbers. Positive assurance comes from a full audit. Negative assurance comes from a review engagement, which is substantially less in scope.
What Positive Assurance Actually Says
Positive assurance is the product of a financial statement audit. When the auditor is satisfied, the report contains an affirmative statement: the financial statements “present fairly, in all material respects, the financial position of the company” in conformity with the applicable reporting framework, such as GAAP.1Public Company Accounting Oversight Board. AS 3101 – The Auditor’s Report on an Audit of Financial Statements When the Auditor Expresses an Unqualified Opinion That’s a declarative, on-the-record assertion. Professional standards call this “reasonable assurance,” acknowledging that no audit can guarantee perfection but that the confidence level is high.
When the auditor can’t reach that conclusion, the opinion gets modified. Three modifications are possible: a qualified opinion (the statements are fair except for a specific issue), an adverse opinion (the statements are materially misstated), or a disclaimer of opinion (the auditor couldn’t gather enough evidence to form any conclusion).2Public Company Accounting Oversight Board. AS 3105 – Departures from Unqualified Opinions and Other Reporting Circumstances Any of these signals trouble and typically triggers follow-up from regulators or lenders.
What Negative Assurance Actually Says
Negative assurance is a step down. Instead of declaring the statements fairly presented, the practitioner states that nothing came to their attention suggesting the statements need material modification. The PCAOB defines negative assurance as “a statement by accountants that, as a result of performing specified procedures, nothing came to their attention that caused them to believe that specified matters do not meet a specified standard.”3Public Company Accounting Oversight Board. AS 6101 – Letters for Underwriters and Certain Other Requesting Parties
The distinction is subtle but important. Positive assurance says “we checked thoroughly and it looks right.” Negative assurance says “we did some work and didn’t find anything wrong.” One is an affirmation. The other is the absence of a red flag. A reader relying on negative assurance should understand that the practitioner performed fewer procedures, so a material misstatement could exist without being caught.
How the Procedures Differ
The gap in assurance levels is really a gap in scope. What the practitioner actually does on the engagement drives the confidence they can offer.
Audit Procedures
An audit involves hands-on verification. The auditor inspects physical assets, confirms account balances with outside parties like banks and customers, tests samples of transactions against supporting documents, evaluates whether internal controls are designed and operating effectively, and challenges management’s accounting estimates. The auditor also assesses fraud risk and designs procedures to address it. This work can take weeks or months depending on the size of the organization.
Review Procedures
A review rests on two things: inquiry and analytical procedures. The practitioner asks management questions about how the financial statements were prepared, what accounting policies were applied, and whether any unusual transactions occurred. The practitioner also runs analytical procedures, comparing current data against prior periods and expected trends to spot anything that looks off.4Public Company Accounting Oversight Board. AS 4105 – Reviews of Interim Financial Information
What a review does not include is telling. The practitioner does not test accounting records through inspection, observation, or confirmation. They do not evaluate whether internal controls are effective. They do not obtain corroborating evidence for the answers management gives them.4Public Company Accounting Oversight Board. AS 4105 – Reviews of Interim Financial Information That’s where the time and cost savings come from, and it’s also why the resulting assurance level is lower.
When Each Level Is Required
The choice isn’t always up to the company. Regulators, lenders, and other stakeholders often dictate which level they need.
Public Company Annual Filings
Every company with securities registered under the Securities Exchange Act must file annual reports with the SEC that include financial statements certified by independent public accountants.5Office of the Law Revision Counsel. 15 U.S. Code 78m – Periodical and Other Reports Those statements must be audited by a firm registered with the PCAOB. If the firm isn’t registered, the SEC treats the financial statements as “not audited” and considers any 10-K or registration statement containing them to be substantially deficient.6U.S. Securities and Exchange Commission. Financial Reporting Manual Topic 4 – Independent Accountants’ Involvement Positive assurance is non-negotiable for public company annual filings.
Public Company Quarterly Filings
Quarterly reports don’t require a full audit. Accountants perform a review of the interim financial information instead, producing negative assurance. The review report states explicitly that the work performed is “substantially less in scope than an audit” and that the accountant does not express an opinion on the financial statements as a whole.4Public Company Accounting Oversight Board. AS 4105 – Reviews of Interim Financial Information
Organizations Spending Federal Funds
Any non-federal entity that spends $1,000,000 or more in federal awards during a fiscal year must undergo a Single Audit.7eCFR. 2 CFR 200.501 – Audit Requirements A Single Audit is a positive assurance engagement: the auditor issues an opinion on whether the entity’s financial statements are fairly presented and a separate opinion on whether the entity complied with the requirements of its major federal programs.8Office of Inspector General (HHS-OIG). Single Audits FAQs Entities below the threshold are exempt from that federal requirement.
Private Companies and Lenders
Private companies negotiate their assurance level with their bank. Smaller credit facilities may only require reviewed statements. Larger loans often call for audited statements. The decision usually comes down to the size of the credit line and how much risk the lender is willing to accept. Companies that outgrow their original loan terms sometimes face a sudden jump in accounting costs when a lender upgrades the assurance requirement.
Negative Assurance in Comfort Letters
Outside of review engagements, negative assurance plays a specific role in securities offerings. When a company issues new securities, the underwriter faces potential liability under Section 11 of the Securities Act if the registration statement contains material misstatements.9Office of the Law Revision Counsel. 15 USC 77k – Civil Liabilities on Account of False Registration Statement To build a due diligence defense, the underwriter requests a comfort letter from the company’s accountants.
In that letter, the accountant may provide negative assurance on unaudited interim financial information included in the registration statement, confirming that nothing came to their attention suggesting the interim numbers need material modification. The accountant can only provide this negative assurance if they first conducted a review of the interim information in accordance with PCAOB standards.3Public Company Accounting Oversight Board. AS 6101 – Letters for Underwriters and Certain Other Requesting Parties
Cost, Time, and Liability Consequences
Audit fees for small to mid-sized private companies commonly run several times higher than review fees for the same entity, and the engagement takes considerably longer to complete. The difference comes from the sheer volume of work: confirming balances, testing transactions, evaluating internal controls, and documenting everything in enough detail to support the opinion.
The fee gap tracks a liability gap. When an auditor provides positive assurance on financial statements included in a registration statement, they become an “expert” under Section 11. If the registration statement later contains material misstatements, purchasers can sue the auditor, whose only defense is proving they conducted a reasonable investigation and had reasonable grounds to believe their portion of the statement was accurate.9Office of the Law Revision Counsel. 15 USC 77k – Civil Liabilities on Account of False Registration Statement The limited scope and hedged language of negative assurance reduce that exposure. The practitioner is still accountable for performing the review competently, but they aren’t on the hook for the same breadth of assurance.
For companies weighing options, the question is rarely which they’d prefer and almost always what their lender, regulator, or investor requires. Paying for an audit when a review would satisfy everyone wastes money. Skipping an audit when a loan covenant or regulatory filing demands one creates problems that cost far more than the audit itself.
What About Compilations and Agreed-Upon Procedures
Two other engagements sit below negative assurance and are sometimes confused with it. In a compilation, the accountant assembles financial statements from information management provides, without performing any verification, and expresses no opinion or conclusion. In an agreed-upon procedures engagement, the accountant performs only the specific procedures the client and intended users agree on in advance and reports factual findings without providing an opinion or negative assurance.10Public Company Accounting Oversight Board. AT Section 201 – Agreed-Upon Procedures Engagements Neither engagement produces positive or negative assurance, so if a lender or regulator has asked for one of those, a compilation or AUP report will not satisfy the request.