Agreed-Upon Procedures Engagements Under AT-C 215 and SSAE 19

An agreed-upon procedures (AUP) engagement is an attestation engagement in which a CPA performs specific procedures and reports the findings, without giving an opinion or a conclusion. The users of the report decide for themselves what the findings mean. In the US the requirements sit in AT-C 215, Agreed-Upon Procedures Engagements, as revised by SSAE No. 19, together with the common concepts in AT-C 105.

AUPs are flexible and typically narrower in scope than an audit or review. They are also easy to get wrong: vague procedures, judgment-laden findings and reports that look like an opinion. This guide covers how they work and how to keep them clean. It paraphrases the standards and is not a substitute for AT-C 215.

How an AUP differs from an audit or review

The core difference is the level of assurance. An audit gives reasonable assurance and expresses an opinion. A review gives limited assurance and a conclusion. An AUP gives no assurance: the practitioner reports what was done and what was found.

Because there is no opinion, the procedures and findings carry the whole weight of the report. They must be specific and objective.

Independence still applies

An AUP is an attestation engagement, so the practitioner must generally be independent. For AUP engagements under the SSAEs, the AICPA Code (ET 1.297.020) requires independence from the responsible party. AT-C 105 allows an exception only where a law or regulation requires the practitioner to accept the engagement and report. The report includes a statement about independence.

What SSAE 19 changed

SSAE No. 19 is effective for AUP reports dated on or after July 15, 2021, with early implementation permitted. It made AUPs more flexible. The main changes:

Agreement from users is no longer required

Before SSAE 19, the specified parties had to agree to the procedures and take responsibility for their sufficiency. Under SSAE 19, the engaging party acknowledges that the procedures are appropriate for the intended purpose. Other users do not need to sign off.

Written assertion no longer required

The responsible party is no longer required to provide a written assertion about the subject matter. The practitioner still requests written representations.

General-use reports are allowed

An AUP report can be a general-use report. The practitioner may still restrict its use, for example when the procedures are tailored to a specific user's needs and could be misunderstood by others, and in that case the report includes an alert restricting its use.

Procedures can be developed during the engagement

The practitioner may assist in developing the procedures, and procedures may be developed or modified over the course of the engagement. The engaging party must acknowledge the appropriateness of the procedures before the report is issued.

Combining with other engagements

An AUP can be performed alongside another engagement for the same client, such as an audit or review, as long as each engagement meets its own requirements and the reports are kept distinct.

The parties

• Engaging party. The party that engages the practitioner and acknowledges that the procedures are appropriate. Often the same as the responsible party, but not always.
• Responsible party. The party responsible for the subject matter, such as a borrower whose covenant calculations are examined.
• Intended users. Those who will use the report, which may include a lender, a franchisor, a regulator or a buyer.

When the engaging party is not the responsible party, the practitioner considers how to get the representations and access needed, and the report identifies both parties.

Writing procedures

Procedures must be specific

The procedures must be described in enough detail that a reader understands exactly what was done. Avoid terms that suggest assurance or that are too vague, such as:

• "general review," "limited review," "check," "test" without a description
• "evaluate," "analyze" or "verify" without defining what was done

Better wording uses concrete verbs: compare, agree, recalculate, inspect, inquire, foot, trace.

Weak vs strong procedure

Weak (illustrative): "Review the accounts receivable aging for reasonableness."

Strong: "Obtain the accounts receivable aging as of December 31, 2026 from management. Foot the aging and compare the total to the general ledger balance in account 1200. For the 25 largest customer balances, compare the balance per the aging to the customer subledger."

The strong version can be repeated by someone else and leaves nothing to judgment.

Findings must be factual

Findings describe the results of each procedure without opinion. "No exceptions were found" or a list of the exceptions works. "Receivables appear fairly stated" does not, because it implies a conclusion the practitioner has not earned.

If a threshold for reporting exceptions is agreed, for example differences over $500, the report states the threshold.

Steps in an AUP engagement

1. Acceptance and engagement letter

Before accepting, the practitioner considers whether the procedures are appropriate for the purpose, whether the subject matter can be measured consistently, and whether the practitioner is independent. The engagement letter identifies the engaging and responsible parties, the subject matter, the nature of the engagement, the procedures (or how they will be developed), and the restrictions on use if any.

2. Obtain acknowledgment of appropriateness

The engaging party acknowledges in writing, often in the engagement letter, that the procedures are appropriate. If procedures change, update the acknowledgment before issuing the report.

3. Perform the procedures

Perform exactly the agreed procedures. If something comes to the practitioner's attention outside the procedures, such as evidence of fraud, consider whether to report it and whether the engagement can continue.

4. Obtain written representations

Request written representations from the responsible party, and from the engaging party where AT-C 215 calls for them when it is a different party, covering matters such as that all relevant information was provided and that the responsible party is responsible for the subject matter. AT-C 215 lists the representations. If the responsible party refuses, consider the effect on the report and whether to withdraw.

5. Document

Documentation follows AT-C 105 and AT-C 215: the procedures performed, the findings, the representations and the acknowledgment from the engaging party. The documentation principles in AU-C 230 are a useful parallel for what a reviewer will expect to see.

6. Report

Issue the report with the elements AT-C 215 requires (see below).

Report structure

An AUP report under AT-C 215 typically contains:

1. Title that includes the word "independent."
2. Addressee, usually the engaging party.
3. Identification of the subject matter and the responsible party, and a statement that the responsible party is responsible for it.
4. Identification of the engaging party and a statement that it has agreed to and acknowledged that the procedures are appropriate for the intended purpose.
5. A statement that the report may not be suitable for any other purpose.
6. The procedures and findings, often in a numbered list.
7. A statement that the engagement was performed in accordance with attestation standards established by the AICPA.
8. A statement that the practitioner was not engaged to and did not conduct an examination or review, and does not express an opinion or conclusion; and that if additional procedures had been performed, other matters might have come to the practitioner's attention.
9. A statement that the practitioner is required to be independent and to meet other ethical responsibilities.
10. An alert restricting use, when applicable.
11. The practitioner's signature, city and state, and date.

Procedures and findings are often presented as a two-column table: the procedure on the left, the finding on the right.

Typical uses for AUPs

• Debt covenant compliance. Recalculating covenant ratios from the client's financial statements for a lender.
• Franchise and royalty reporting. Agreeing reported sales to the franchisee's records.
• Grant and contract compliance. Agreeing expenditures charged to a grant to invoices and timesheets.
• Payroll and benefit plan contributions. Comparing contributions remitted to payroll records for a union or multiemployer plan.
• Acquisition support. Specific procedures on a target's revenue or working capital in a transaction.
• Regulatory filings. Procedures required by a state agency or industry regulator.
• Internal audit-type work. Procedures on specific controls or processes for a board or audit committee.

Some uses look like they need an audit or review but can be handled by an AUP if the user agrees. The reverse also happens: a user who wants assurance should not be given an AUP report and left to assume it carries an opinion.

Common pitfalls

• Procedures with judgment built in. Words like "reasonable" or "appropriate" in the procedure push the practitioner into a conclusion.
• Findings that read like an opinion. "The schedule is accurate" instead of "the amounts agreed with no exceptions."
• Missing engaging party acknowledgment when procedures changed during the engagement.
• Using materiality. AUPs do not apply materiality unless a reporting threshold is agreed and disclosed.
• Report referencing the wrong standard or old pre-SSAE 19 wording, such as language about specified parties taking responsibility for sufficiency.
• Skipping independence. Nonattest services for the responsible party, such as bookkeeping, can impair independence for the AUP unless the AICPA Code's nonattest services requirements are met.

FAQ

Is an agreed-upon procedures report an opinion?

No. The practitioner reports procedures and findings only and expresses no opinion or conclusion. Users draw their own conclusions from the findings.

Do all users have to agree to the procedures under SSAE 19?

No. Under AT-C 215 as revised by SSAE 19, the engaging party acknowledges that the procedures are appropriate. Other intended users do not have to sign off.

Can an AUP report be general use?

Yes. SSAE 19 allows general-use AUP reports. The practitioner may choose to restrict use, for example when the procedures are designed for a specific party, and then includes an alert restricting use.

Is materiality used in an AUP engagement?

Not in the audit sense. The engaging party and the practitioner may agree on a threshold for reporting exceptions, and that threshold is described in the report.

Does the practitioner have to be independent for an AUP?

Yes, in general. An AUP is an attestation engagement, and under the AICPA Code (ET 1.297.020) the practitioner must be independent of the responsible party, subject to the narrow exception in AT-C 105 where law or regulation requires the engagement.

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

Sources

• AICPA, SSAE No. 19, Agreed-Upon Procedures Engagements (AT-C Section 215), effective for AUP reports dated on or after July 15, 2021
• AICPA, AT-C Section 105, Concepts Common to All Attestation Engagements
• AICPA Code of Professional Conduct, ET 1.297.020 (agreed-upon procedures engagements performed under SSAEs) and ET 1.295 (nonattest services)
• Journal of Accountancy, SSAE No. 19: Flexibility for agreed-upon procedures (Sept. 2020): https://www.journalofaccountancy.com/issues/2020/sep/ssae-no-19-flexibility-for-agreed-upon-procedures/

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error