This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
Your first client wanted a set of financial statements by the end of the week. You had a laptop, a trial balance and nothing to put either of them in, so a friend who was a few years ahead of you sent over a folder of templates. Six years and forty clients later, that folder still runs your practice, and it is a fair bet that you have never read it from the first page as though you had written it yourself.
Where the folder came from
There is nothing wrong with templates. No one running a small practice drafts an engagement letter, a compilation report, a representation letter and a full set of statements from a blank page for each client, and no one should. Templates got you through the first year and they get you through February every year since. The difficulty arises when a template is used for years without anyone reading it with the care that would have gone into drafting it.
Most practices inherit theirs from a former employer, a course pack, a friend who was further along, or a software package that was installed and never customised. Whatever the source, the documents were written for someone else's engagements, under someone else's framework, in a year that has since passed. The report wording assumes a particular kind of engagement. The statements pack assumes a particular framework. The references to standards reflect whenever the author last checked them, which may have been some time ago.
The principle is a simple one. Your documents must be on par with your engagement. The engagement letter sets out the work you were engaged to do. The report records the work you did. The two should match, and neither should claim more than you delivered. A report issued under your name is your account of that work, and each sentence in it is a representation you are making to whoever reads it. If a compilation report says that you obtained evidence, or that you express an opinion or a conclusion on the statements, you have represented that you performed an audit or an independent review. A compilation report says the opposite. It records that you compiled the statements from information management provided, that management remains responsible for them, that you performed neither an audit nor a review, and that you express no assurance. CIBA's practical guide to compiling annual financial statements sets out what the report must say, and it is worth reading your own template against it.
It also pays to remember who reads these reports. It is seldom the client. It is the credit analyst at the bank where the client has applied for a bond on new premises, or the accountant acting for an incoming shareholder in a due diligence. Neither of them knows what you meant. They know what the page says, and if the page says audit or independent review, you will be asked to explain why there was neither.
The compilation report is only the most visible document in the folder. Next to it sits an engagement letter written for a different service, a representation letter that still names the firm your friend worked for at the time, and a statements pack that cites standards as they stood when its author last opened it. None of it is meant dishonestly, but the reader cannot see what you meant. A document that describes work you did not do reads as a misrepresentation, and the reader will treat it as one.
Fields that fill themselves in
Good templates automate. Client names, dates, framework references and signature blocks populate when the file is generated, and that is the whole point of having a template. It is also the point at which a practitioner working late in February stops controlling what the document says.
An auto-filled field is a decision you did not take. The framework name is carried forward from last year. The report date is whatever the export produced. The signature was placed by the workflow before the final version was opened. The Electronic Communications and Transactions Act gives that signature the same legal effect as one in ink, and the Act does not concern itself with whether you read what you signed. Your Code of Ethics does. Paragraph R113.1, professional competence and due care, asks whether you applied your mind before your name went on the document. Your signature tells the reader that you did. It says that you have read the statements and that you stand behind them, and a signature placed by software makes that statement whether or not it is true.
The practical rule is to sign last, by hand, once you have read the final version, and to treat every other field that commits you in the same way. Telling a disciplinary committee that the system signed the report is not an explanation. You configured the system, and the committee will hold you to what it produced.
The word "draft"
Practices under pressure rely on the word "draft" to buy time. The statements go out marked "Draft" or "Not yet approved by the directors", the client is asked to return a signed approval, and the file stays open until he does. The approval seldom arrives. By then the PDF is with his bank, his landlord or his attorney, and the label has gone with it.
The label protects less than you think. It tells the reader that the directors have not yet signed. It does not tell the reader that the figures are unreliable, that your work was incomplete, or that nobody may rely on the document, and the reader does not treat it that way. The reader turns to your compilation report, which says what you did and what you stand behind, and relies on that.
A disciplinary committee takes the same view. The word "draft" counts in mitigation and may reduce the sanction. It does not remove the breach, because the standard of competence and due care applies to what you prepared and released, not to what the client undertook to do with it afterwards. Once the document has left your office you have released it, whatever the heading says.
None of this means a draft may never leave your office. It must. The directors cannot approve statements they have not seen, and a review draft is the ordinary way of getting them approved. The distinction that matters is between a draft sent for review and a report released for use, and what separates the two is the compilation report. A review draft carries no signed report. The report is signed and dated on the final version, after the directors have approved the statements and signed the management acknowledgement. A draft that goes out with a signed report attached is a released report with the word "draft" on top, and that is the document the bank will rely on.
Three habits make the review draft safe. The covering email says that the statements are sent for review and approval, that they may change, and that they are not to be given to anyone else until approved. The engagement letter says the same, and CIBA's template engagement letter for compilations gives you the wording to start from. The signed report and the signed acknowledgement are issued together, on the approved version, and not before. If a client asks for something to show the bank before approval, the answer is to finish the approval, not to release the draft.
What a complaint tests
Practitioners often assume that a complaint needs a victim, so that if every client is satisfied and no one has lost money there can be no case. The bond was approved, the shareholder came in, and no harm was done.
That is not how professional competence and due care works. It is a conduct standard, not a claim for damages. The question before a disciplinary committee is whether you did the work as a competent member would have done it, not whether anyone can prove a loss. The absence of loss counts in your favour when the sanction is set. It does not decide whether there was a breach.
A folder that no one has checked since the first year can therefore end in a finding against your name and whatever sanction the committee considers fitting, in a year in which no client was out of pocket. The complaint seldom comes from a client. It usually comes from the professional on the other side who read your report properly and compared it with the work that was done.
A check before the next set goes out
If you are starting out, do this before the first client rather than after the fortieth. If you are six years in, do it this month. The test is the same for every document. It must match the engagement you performed, no more and no less. Run the following check on each template in the folder, whether borrowed, inherited or bought:
Origin. Establish who wrote it, for which engagement standard, and in which year. If you cannot answer all three, treat the template as unverified.
Engagement type. Read each paragraph of the report against the standard for the engagement you performed. A compilation report says that you compiled from management's information, that management is responsible, that there was no audit or review, and that you give no assurance. Any sentence about evidence, an opinion, a conclusion or assurance comes out.
Framework. The basis of preparation named in the report must match the policies and disclosures in the statements and the framework named in the engagement letter. The same framework should appear in all three places under the same name.
Responsibility paragraphs. Yours and management's, in the wording for a compilation and not for an audit.
Firm details. Your firm's name, your designation and your practice number, not those of the template's previous owner.
Signature. Switch off auto-sign and every auto-filled field that commits you. Sign last, by hand, after you have read the final version, and keep a one-line note on the file recording that you did.
Then fix the practice rather than only the file. Keep a template register with one line per template, recording its name, where it came from, the standard and version it follows, who owns it, when it was last reviewed and when it is next due. Review each template once a year against the standards it relies on as they stand at that date. Allow one person to edit templates, and retire old versions, keeping them only so that past files can be reconstructed.
The exercise takes an afternoon. A disciplinary process takes the better part of a year. A report that says exactly what you did is also the best answer to a client who questions the fee, because clients pay for work you are prepared to stand behind, and the report is where you say so.
👉 Join CIBA and we'll show you how to sign work you can stand behind, and charge for it.
Further Reading
Compiling Annual Financial Statements: A Practical Guide for the Compiler, Leana van der Merwe, 30 September 2026. The fifteen checks a compiler runs, including what the compilation report must say
The first building block of success: Terms of Engagement and how to get it right, Eszter Rapanos. What a compilation engagement letter must cover, with CIBA's downloadable template
Agreed-Upon Procedures: When You Need the Facts, Not an Audit. Why the engagement type changes what the report may say
Choose Your Path to Exclusive Insights
Stay ahead in the world of accounting with premium content designed for professionals like you. Access expert articles, industry trends, and essential resources. Become a CIBA member and claim your CPD hours from CIBA.
CIBA Member Access
R250.00 FREE!
100% Discount when you become a CIBA Member. Join now to claim your CPD Hours. Register here: https://accounts.myciba.org/register
Premium
R250.00
Every month
Trending
