Agreed-upon procedures (AUP)

Definition

An agreed-upon procedures (AUP) engagement is an attestation engagement under AT-C 215. The practitioner carries out procedures agreed with the engaging party, and with other specified parties where there are any, then reports factual findings. The report gives no opinion, conclusion or assurance on the subject matter. It describes the procedures performed and what was found. Since SSAE No. 19 the report is not required to be restricted to the parties who agreed the procedures, although it may carry a use restriction where that is appropriate.

Why it matters in an audit or review

AUP work is how lenders, franchisors, grantors, and regulators get targeted checks without a full audit. The risk is in the procedures themselves. If they are vague, such as asking a practitioner to 'verify' a balance, the report cannot say what was done. The practitioner must be independent under the AICPA Code and must not report beyond what the procedures support.

Example

Illustrative: a franchisor asks for royalty reporting to be checked. The procedures read: obtain the franchisee's monthly sales reports, agree each to the general ledger, and recompute the 6% royalty. The report lists the months tested and any differences found, without concluding on whether royalties were fairly stated.

Common mistakes

Using vague or conclusion-implying words such as 'review', 'ensure' or 'satisfactory' in the procedures. An AUP report cannot give a conclusion.

FAQ

Is an AUP the same as a review?

No. A review gives limited assurance through a conclusion. An AUP gives findings only and no assurance.

Sources

• AICPA, AT-C Section 215, Agreed-Upon Procedures Engagements (SSAE No. 19)
• AICPA, AT-C Section 105, Concepts Common to All Attestation Engagements
• AICPA Code of Professional Conduct, independence interpretation for agreed-upon procedures engagements (ET 1.297)