An agreed-upon procedures (AUP) engagement under SRS 4400 is one where the CA performs procedures that the CA and the engaging party have agreed, and reports the procedures and the factual findings. It is not an audit, a review or an assurance engagement: no opinion and no assurance conclusion is expressed, and the users draw their own conclusions from the findings.
Facts checked: 10 October 2026. The description of an AUP engagement, the acceptance rules, the independence position and the report elements were read in the ICAI exposure draft of SRS 4400 (Revised), July 2023, as reproduced on TaxGuru. That is a secondary copy of a draft. I could not open the ICAI site and could not confirm a final issued SRS 4400 (Revised) or its Indian effective date, and the date field in the draft is blank. The international standard, ISRS 4400 (Revised), applies to engagements whose terms are agreed on or after 1 January 2022 (IAASB). Read the current text on icai.org before you quote a paragraph or a date.
AUP, review and audit compared
| Point | Audit (SAs) | Review (SRE 2400/2410) | AUP (SRS 4400) |
|---|---|---|---|
| Assurance | Reasonable | Limited | None |
| Output | Opinion | Conclusion | Procedures and factual findings |
| Who decides the work | The auditor | The practitioner | Practitioner and engaging party agree it |
| Governing standard family | Standards on Auditing | Standards on Review Engagements | Standards on Related Services |
An AUP is also different from an assurance engagement under SAE 3000, where the practitioner gathers evidence to reach a conclusion on a subject matter against criteria. In an AUP the practitioner reaches no conclusion. If the client wants a conclusion, the engagement is not an AUP. Compare the wider field in types of audit in India.
Acceptance and terms
The draft requires the CA to apply the ICAI Code of Ethics (objectivity is the core requirement) and to decline or stop if the procedures look inappropriate for the stated purpose. The engaging party acknowledges that the procedures are appropriate for that purpose. The engagement letter should record:
- the purpose, the subject matter and the information it relates to;
- each procedure, worded so that it can be performed and verified (not "review", "satisfy", "ensure");
- the sources of information and who provides access;
- the intended users, and any restriction on use or distribution;
- the report format, the fee and the timing.
The engagement letter template is a starting point, but AUP terms need the procedures listed in a schedule.
Independence
Per the draft, independence is not a requirement of an AUP engagement under the Code, but it applies where law, regulation, another professional requirement or the engagement terms impose it, and the report must say whether independence requirements applied. A bank, a regulator or a grant-maker often asks for an independent CA, so check the request letter. Where a firm is the statutory auditor and the AUP is for the same entity, document that threat review in the file.
Typical Indian uses
- Lender and bank requests on stock, debtors, drawing power or covenant data, where the lender wants facts rather than an opinion.
- Grant, CSR and fund utilisation statements where the funder specifies the checks.
- Regulatory or scheme submissions where a CA-certified factual statement is asked for (confirm the specific format the authority prescribes).
- Franchise, royalty and revenue-share confirmations between private parties.
Worked example (invented facts)
Facts. Lender: Meridian Finance Ltd. Borrower: Kaveri Foods Pvt Ltd. Purpose: verify the debtors list used in the drawing power statement at 30 September 2026. Debtors per statement: ₹4.80 crore across 62 parties.
| # | Agreed procedure | Finding |
|---|---|---|
| 1 | Agree the total on the statement to the debtors ledger | Agrees, ₹4.80 crore |
| 2 | Recompute ageing from invoice dates for all 62 parties | 3 parties re-aged; ₹6.4 lakh moved from the 0-90 day bucket to above 90 days |
| 3 | For 10 parties selected by the lender, trace the oldest open invoice to the dispatch record | 9 agreed; 1 invoice (₹1.1 lakh) has no dispatch record |
| 4 | Agree receipts after year end up to the report date for those 10 parties | ₹38.2 lakh received, listed by party |
Note that the findings state what was found, with no word like "satisfactory" and no suggestion of what the lender should do.
Sample report structure
- Title and addressee (the engaging party and named users)
- Subject matter and purpose
- Statement that the engagement was performed under SRS 4400 (Revised) and that the procedures were agreed
- Independence statement
- Statement that the engagement is not an audit, review or assurance engagement and no opinion or conclusion is expressed
- Procedures and findings (tabular, with exceptions stated)
- Statement that the practitioner makes no representation on the appropriateness of the procedures
- Restriction on use and distribution
- Signature, membership number, firm registration number, date, place
Checklist
- Confirm in writing that the user wants findings, not an opinion.
- List the procedures in the letter; reject vague verbs.
- State the sample basis (the AUP can specify selection by the user).
- Record the independence position.
- Keep working papers showing each procedure performed.
- Report every exception, however small.
- Restrict use to the named parties.
Frequently asked questions
Is an AUP report an audit report?
No. It gives procedures and factual findings only. There is no opinion and no assurance conclusion.
Who decides the procedures?
The CA and the engaging party agree them, and the engaging party acknowledges they suit the purpose. Other users may also agree. The CA does not accept procedures that look inappropriate.
Do we need to be independent?
Not under the Code on the draft's reading, unless law, regulation or the terms require it. The report must say whether independence requirements apply.
Can the report be given to anyone?
Restricting use to the engaging party and named users is the usual approach, because others may misread findings without knowing the purpose.
How is this different from a certificate?
A certificate often states a conclusion. A properly done AUP states only what was done and found. Where the requester wants a conclusion, a different engagement is needed.
If you are scoping the engagement, start with the engagement letter template and the overview of types of audit in India.
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error