AUP vs Review vs Audit: Choosing the Engagement a Lender Asks For

A client forwards a loan agreement and writes: "The bank wants something from you." The words in the agreement decide the engagement. A request for audited statements is an audit. A request for reviewed statements is a review. A request for a recalculation of a covenant, a borrowing base or a sales figure is an agreed-upon procedures (AUP) engagement. Offering the wrong one fails the client at the worst moment, either by delivering less than the agreement requires or by delivering more work than the lender asked for.

This post is the decision guide. The mechanics of AUP reports are in agreed-upon procedures under AT-C 215. The three financial statement services are compared in compilation vs review vs audit.

Start with what the lender needs to know

Lenders ask for one of two things, and the engagement follows from which:

1. Assurance on the financial statements as a whole. The lender wants someone independent to say the statements are reliable. That is an audit (opinion, reasonable assurance) or a review (conclusion, limited assurance).
2. A specific number checked. The lender wants the debt service coverage ratio, the receivables aging total or the royalty base verified against records. That is AUP territory, because the procedures can name the number and the records.

Read the agreement for the exact term. "Audited," "reviewed," "compiled" and "agreed-upon procedures" each map to a defined service. "Certified" and "verified" do not, and need a call to the lender to find out what they mean.

What each engagement delivers

A review report's conclusion concerns the financial statements, and a review does not include a conclusion on covenant compliance. A compilation helps management present statements and gives the lender no assurance on them. Neither replaces an audit where the agreement requires one.

Covenant compliance with an audit

When a loan agreement requires audited statements and also covenant compliance, the auditor can report on compliance with covenants that relate to accounting matters under AU-C 806. The form is negative assurance: nothing came to the auditor's attention indicating noncompliance with the identified covenants, as they relate to accounting matters. Two limits apply. The assurance is unavailable when the auditor expresses an adverse opinion or disclaims an opinion on the statements. And it reaches only covenants the audit tests; a covenant to maintain insurance or facilities is outside it.

When AUP is the right answer

An AUP fits when the lender or other party can say, in advance, which procedures would satisfy it. Common cases are covenant recalculations from client-prepared statements, agreeing reported sales to records, and comparing contributions or draws to supporting documents.

SSAE 19 changed how these engagements work, for AUP reports dated on or after July 15, 2021:

• The engaging party acknowledges the procedures. Before the report is issued, the engaging party agrees to and acknowledges that the procedures are appropriate for the intended purpose. That acknowledgment can sit in the engagement letter, an addendum or the representation letter. Intended users no longer accept responsibility for sufficiency.
• The practitioner can help write the procedures. The practitioner, the engaging party, the intended users or any combination can develop them, and they can change during the engagement.
• No assertion is required from the responsible party.
• General-use reports are permitted. The practitioner can still restrict use where professional judgment calls for it.

Accept the engagement only when four things hold: the procedures can be designed, performed and reported under SSAE 19; the engaging party agrees, or will agree, to them and acknowledges their appropriateness; they are expected to produce reasonably consistent findings; and, if a reporting threshold applies, it is agreed.

Independence and parties

The practitioner must be independent for an AUP engagement, and under the AICPA Code the independence requirement runs to the responsible party. If the firm keeps the borrower's books, the nonattest services rules in ET 1.295 apply, as in any attest engagement.

Identify three roles in the engagement letter. The responsible party is accountable for the subject matter, such as the borrower. The engaging party engages the CPA and acknowledges the procedures; this is the client or the lender. The intended users are those who will read the report.

What an AUP cannot do

• It cannot express an opinion, conclusion or assurance. The report states that the practitioner was not engaged to and did not perform an examination or review and expresses no opinion or conclusion. The lender draws its own conclusions from the findings.
• It cannot satisfy an agreement that requires audited or reviewed statements. An AUP on the covenant calculation does not make the statements audited or reviewed.
• It cannot rely on judgment words. Findings are factual results. "The ratio appears reasonable" is a conclusion; "the recalculated ratio was 1.18, agreeing to the schedule provided" is a finding.
• It cannot reach beyond the procedures. If the lender later asks whether the borrower is compliant with the agreement overall, the procedures did not address it. A new question needs new procedures, agreed and acknowledged before the work.
• It does not apply audit materiality. Where the parties agree on a threshold for reporting exceptions, the report states it.

Restrictions on use

Every AUP report carries a statement on its suitability for other purposes and tells users they are responsible for judging whether the procedures meet their needs. Whether to go further and restrict the report to named parties is the practitioner's call under SSAE 19. Restrict use when the procedures were tailored to one lender's covenant definitions and would mislead someone applying them to a different purpose. Leave the report general-use when the procedures are standard and the subject matter is easy to understand. Either way the engagement letter records the decision.

A practical decision path

1. The agreement says audited: perform an audit, and ask whether the lender also wants AU-C 806 covenant reporting.
2. The agreement says reviewed: perform a review, and tell the lender covenant testing is not part of it.
3. The agreement says compiled or internally prepared: perform a compilation or preparation, and tell the lender the work carries no assurance.
4. The agreement names a calculation or schedule: scope an AUP, get the lender's procedures in writing, and have the engaging party acknowledge them.
5. The agreement is silent or says "verified": call the lender before quoting a fee.

Sources

• Journal of Accountancy, SSAE No. 19: Flexibility for agreed-upon procedures (September 2020): https://www.journalofaccountancy.com/issues/2020/sep/ssae-no-19-flexibility-for-agreed-upon-procedures/
• Journal of Accountancy, AICPA ASB issues standard on agreed-upon procedures (December 2019): https://www.journalofaccountancy.com/news/2019/dec/aicpa-asb-standard-agreed-upon-procedures-201922560.html
• Grant Thornton, AICPA issues standard on agreed-upon procedures (January 2020): https://www.grantthornton.com/insights/articles/audit/2020/snapshot/january/aicpa-issues-standard-agreed-upon-procedures
• AICPA, SSARS No. 25 At a Glance (review conclusion, limited assurance): https://assets.ctfassets.net/rb9cdnjh59cm/37wTF1wRjO6Gg0XZmCAfg5/3eb4c95d450c4c45a693b25690e10ab5/ssars-25-at-a-glance.pdf

CORAA prepares ready-to-review audit files for US CPA firms from QuickBooks books; you review and sign. See /us.

AU-C references are to AICPA Professional Standards, paraphrased here; read the standard itself before relying on a requirement. This page is guidance, not professional advice. Report an error