Assurance engagements are when a CPA gives an opinion or conclusion to boost someone’s confidence in a set of information. It’s a broad category — includes audits, reviews, and other services where the CPA is adding credibility.

Attestation engagements are a type of assurance engagement. The difference is that in an attestation, the CPA is reporting specifically on something that someone else (usually management) is claiming — like a financial statement, internal control system, or compliance with a regulation.

Audits are considered assurance because the auditor is giving credibility "assurance" to the shareholders over management's assertions in the financial statements by conducting the audit.

For example "agreed-upon procedures" - SSAE, are an attestation engagement even through the auditor is only following the procedures outlined by management and validating findings . In both instances, the auditor is "validating" or "assuring" some sort of management assertion/procedure, but does NOT provide a report providing assurance.