management representation letter agreed upon procedures

• SSAE 19: Agreed-Upon Procedures Engagements

By Charles Hall | Auditing

• You are here:

On December 19, 2019, the AICPA released SSAE 19, Agreed-Upon Procedures Engagements . AUPs provide you with the ability to provide assurance in a targeted manner (e.g.,  just for inventory). Though you’ve been able to perform AUPs for many years, the new guidance in SSAE 19 provides you with greater flexibility. See how below. 

Greater AUP Flexibility

CPAs will find the new agreed-upon procedures (AUP) standard (SSAE 19) more flexible that the preceding guidance (SSAE 18 AT-C section 215).

How is it more flexible?

• You no longer request an assertion from the responsible party
• You can issue general-use reports 
• Intended users are not required to take responsibility for the sufficiency of the procedures
• You can develop or assist in developing the procedures over the course of the engagement

And which of these do I like the best? No requirement for assertions.

Additionally, I like the option to develop AUP procedures as the engagement progresses. In the past, the client might review the draft AUP report (at the end of the engagement) and realize it doesn't meet their needs. Sometimes it's better for practitioners to develop procedures as they perform the AUP. SSAE 19 allows you to do just that.

So, if you develop new procedures, what must you do? Prior to issuance of the AUP report, obtain the engaging party's agreement regarding the procedures. Moreover, obtain their acknowledgement that the procedures are appropriate and that they satisfy the intended purpose of the engagement. In effect, the client reviews the procedures, agrees with them, and expresses satisfaction.

Definition of an Agreed-Upon Procedures Engagement

SSAE 19 defines an agreed-upon procedures engagement as "an attestation engagement in which a practitioner performs specific procedures on subject matter and reports the findings without providing an opinion or conclusion. The subject matter may be financial or nonfinancial information." The standard goes on to say "Because the needs of engaging party may vary widely, the nature, timing, and extend of the procedures may vary, as well."

Here’s a video overview of AUPs and this article.

Now, let's see what the AUP objectives are.

SSAE 19 Objectives

The objectives of an SSAE 19 engagement include:

• Applying specific procedures to subject matter
• Issuing a written practitioner's report that describes the procedures applied and the findings

Next, let's look at the structure of an AUP report.

AUP Report Structure

The structure of the AUP report should be as follows:

So, the CPA should state what was done and then provide the findings (results). The procedures and findings are placed in the body of the AUP report. 

The description of the procedures should be simple and clear.

Good AUP Procedure and Finding

Here's an example of a good AUP procedure and finding :

Procedure - We obtained the January 2022 check register and the January operating bank account statement. We compared check numbers 2850, 2892, 2933, 2935, 2972 to cleared checks agreeing the payee and the amount. 

Findings - No exceptions were noted.

Now, let's look at a poor example:

Poor AUP Procedure and Finding

Procedure - We scanned the company's 2022 bank statements and talked with the CFO. The books seemed to be in order with the exception of July errors.

Finding - Overall, the check disbursements appear to be okay after our general review.

In this poor example, we see general words or statements. What does the word  scanned mean? How about  seemed to be in order  ? Additionally, the finding is vague: okay after our general review .

SSAE 19 provides examples of acceptable and unacceptable wording.

Acceptable and Unacceptable AUP Wording

SSAE 19 calls the practitioner to clearly define procedures. Moreover, the standard states that practitioners should not perform procedures that are open to varying interpretations or that are vague. 

Unacceptable Terms

.A27 of the standard even provides examples of unacceptable AUP terms such as:

• General review

Acceptable Terms

.A27 also provides examples of acceptable AUP terms such as:

• Recalculate

In addition to proper wording, document your engagement in accordance with SSAE 19.

AUP Documentation

SSAE 19 calls for the following documentation:

• Written agreement with the engaging party regarding the appropriateness of the procedures performed for the intended purpose of the engagement
• The nature, timing, and extent or procedures performed
• The results of the procedures

You'll also need a written engagement letter (see paragraph .15 of SSAE 19 for an example) and a representation letter (see paragraph .27 of SSAE 19 for an example).

So what about dating the representation letter? The representation letter date should be the date of the AUP report. Additionally, the representation letter should address the subject matter and periods covered by the practitioner's findings.

By now you may be thinking, "Where can I find AUP report examples?"

SSAE 19 Illustrative AUP Report

SSAE 19 provides four illustrative AUP reports in its exhibit (see .A78). 

The four example AUP reports relate to:

• Statement of investment performance statistics
• Cash and accounts receivable
• Claims of creditors
• Procedures specified in regulation

If you're looking for a template to follow, see example 2. Why? The cash and accounts receivable procedures and findings are excellent. Build procedures and findings like these and you'll be in good shape.

I suggest you download SSAE 19 and keep these reports handy.

So, what about independence? Is that required?

Attestation Independence

The practitioner has to be independent in order to perform an AUP.  

One exception exists when the practitioner "is required by law or regulation to accept an agreed-upon procedures engagement and report on the procedures performed and findings obtained."

SSAE 19 Effective Date

The effective date of SSAE 19 is for AUP reports dated on or after July 15, 2021.

Early implementation is permitted.

If third party assurance is not needed, consider issuing a consulting report in lieu of an AUP report. See my article: AICPA Consulting Standards - The Swiss Army Knife .

About the Author

Charles Hall is a practicing CPA and Certified Fraud Examiner. For the last thirty-five years, he has primarily audited governments, nonprofits, and small businesses. He is the author of The Little Book of Local Government Fraud Prevention, The Why and How of Auditing, Audit Risk Assessment Made Easy, and Preparation of Financial Statements & Compilation Engagements. He frequently speaks at continuing education events. Charles consults with other CPA firms, assisting them with auditing and accounting issues.

Session expired

Please log in again. The login page will open in a new tab. After logging in you can close it and return to this page.

This site uses cookies to store information on your computer. Some are essential to make our site work; others help us improve the user experience. By using the site, you consent to the placement of these cookies. Read our  privacy policy  to learn more.

More flexibility for agreed-upon procedures

Ssae no. 19 makes changes to standards that may enhance practitioners’ ability to provide value to report users..

• Audit & Assurance
• Attestation

A greed - upon procedures provide practitioners with an important opportunity to use their skills and training to help clients with engagements that differ from both audits and consulting engagements.

A carefully constructed agreed - upon procedures engagement can enable a client to use a practitioner's expertise to gain comfort, for example, on certain types of transactions such as travel and credit card transactions; or tax credits available to condominium owners.

Practitioners may benefit from increased flexibility to perform agreed - upon procedures engagements under a standard issued by the AICPA Auditing Standards Board (ASB) in December 2019.

Statement on Standards for Attestation Engagements (SSAE) No. 19, Agreed-Upon Procedures Engagements , is effective for agreed - upon procedures reports dated on or after July 15, 2021, with early implementation permitted. SSAE No. 19 supersedes AT - C Section 215 of the same title in SSAE No. 18.

SSAE No. 19 also amends AT - C Section 105 of SSAE No. 18, Concepts Common to All Attestation Engagements .

SSAE No. 19 provides flexibility to practitioners with changes that are summarized in the chart, "Comparison of SSAE No. 18 and SSAE No. 19." The new standard:

• No longer requires the practitioner to request an assertion from the responsible party;
• Permits the development of procedures during the course of the engagement and allows practitioners to develop or help to develop these procedures as part of the agreed - upon procedures engagement;
• No longer requires intended users to take responsibility for the sufficiency of the procedures; instead, the engaging party acknowledges the appropriateness of the procedures for the intended purpose of the engagement before the practitioner issues the report (e.g., done in the representation letter); thus, the practitioner need not deal with the intended users; and
• Permits the practitioner to issue a general - use report but does not prohibit the issuance of a restricted - use report when the practitioner deems such a restriction appropriate.

SSAE No. 19 also requires new disclosures in the agreed - upon procedures reports that address the risk that some users could misunderstand the reports' content.

The new standard also more closely aligns these standards with the International Auditing and Assurance Standards Board's standards for agreed - upon procedures engagements. The new standard may provide practitioners with new engagement opportunities by:

• Removing the requirement that the practitioner request an assertion from the responsible party;
• Permitting the use of a general - use report by the practitioner;
• Eliminating the requirement for intended users to take responsibility for the sufficiency of the procedures; and
• Allowing procedures to be developed over the course of the engagement and permitting the practitioner to participate in development of those procedures as long as the engaging party acknowledges the appropriateness of the procedures before the practitioner's report is issued.

Comparison of SSAE No. 18 and SSAE No. 19

3 TYPES OF ATTESTATION ENGAGEMENTS

AT-C Section 105 defines an attestation engagement as an examination, review, or agreed-uponprocedures engagement performed under attestation standards related to subject matter or an assertion that is another party's responsibility. The three types of attestation engagements are:

• Examination engagement:  In this type of attestation engagement, the practitioner obtains reasonable assurance by obtaining sufficient appropriate evidence about measurement or evaluation of the subject matter against criteria in order to draw reasonable conclusions on which to base the practitioner's  opinion  about whether the subject matter is in accordance with (or based on) the criteria or the assertion is fairly stated in all material respects.
• Review engagement:  In this type of attestation engagement, the practitioner obtains limited assurance by obtaining sufficient appropriate review evidence about the measurement or evaluation of subject matter against criteria in order to express a  conclusion  about whether any material modification should be made to the subject matter in order for it to be in accordance with (or based on) the criteria or for the assertion to be fairly stated.
• Agreed-upon procedures engagement:  In an agreed-upon procedures engagement, a practitioner performs specific procedures on financial or nonfinancial subject matter or an assertion and reports the  findings  without providing an opinion or a conclusion. Findings are the factual results of the procedures performed. Findings can be objectively verified and described. Thus, procedures to be applied to the subject matter can be expected to result in reasonable, consistent findings.

All agreed-upon procedures engagements have an engaging party (who hires the practitioner), a responsible party (who is responsible for the subject matter), the practitioner, and the intended users. Often the engaging and the responsible party are the same; however, in other engagements, the engaging party and the responsible party may differ (see the sidebar "Example of Application of an Agreed-Upon Procedures Engagement").

CRITERIA FOR ACCEPTING SSAE ENGAGEMENTS

AT-C Section 105 requires a practitioner's independence when performing attestation engagements unless a law or regulation requires the practitioner to accept the engagement and report on the subject matter, e.g., compliance with SEC Due Diligence Form 15E,  Certification of Provider of Third-Party Due Diligence Services for Asset-Backed Securities . This is not changed by SSAE No. 19.

Also, the AICPA  Code of Professional Conduct 's   "Agreed-Upon Procedure Engagements Performed in Accordance With SSAEs"   interpretation (ET §1.297.020) modifies the independence requirements for agreed-upon procedures engagements. Among other things, this interpretation only requires the practitioner to be independent from the responsible party or parties when agreeing to issue reports in accordance with SSAEs.

As SSAE No. 19 explicitly permits practitioners to develop, or assist in developing, the procedures for an agreed-upon procedures engagement, the AICPA Professional Ethics Division discussed perceived independence issues raised by the addition of this explicit permission. The ethics division does not believe that this perceived independence issue raises any actual threats to independence. Because SSAE No. 19 requires the engaging party to agree to the procedures and acknowledge that the procedures are appropriate for the intended purpose of the engagement, this agreement and acknowledgment mitigate any perceived self-review and management participation threats, as the practitioner would not be the only one assessing the appropriateness of the procedures. 

The practitioner should also determine that the following four conditions exist in order to accept such engagements:

• Procedures can be designed, performed, and reported on per the provisions in SSAE No. 19;
• The engaging party agrees, or will be able to agree, to the procedures and will acknowledge that the procedures are appropriate for the intended purpose of the engagement;
• The procedures applied to the subject matter are expected to result in reasonably consistent findings; and,
• When applicable, the practitioner and engaging party agree to apply a (materiality) threshold that the engaging party establishes for reporting the exceptions.

Next, the practitioner and engaging party should agree in writing upon the engagement's terms (normally in an engagement letter), including that the engaging party will provide the practitioner, prior to the completion of the engagement, with a written agreement and acknowledgment that the procedures performed are appropriate for the intended purpose of the engagement as well as a representation letter upon completing the engagement. The acknowledgment regarding the appropriateness of the procedures may be included in the representation letter. The practitioner also assumes the risk that misapplying the agreed-upon procedures may cause inappropriate reported findings and assumes the risk of omitted or misreported findings. As in all engagements, adequate planning and supervision and applying due professional care in performing the procedures, accumulating the findings, and preparing the practitioner's report can lower the practitioner's risks.

REQUIREMENTS OF SSAE NO. 19

The agreed-upon procedures  practitioner's report  should, in part:

• Identify the engaging and responsible parties, and the subject matter to which the procedures were applied;
• State that the engaging party acknowledges that the procedures performed are appropriate to meet the intended purpose of the engagement (which should be described in the report);
• State that the practitioner's report may not be suitable for any other purpose;
• State that the procedures performed may not address all items of interest to a report user and may not meet the needs of all report users — making users responsible for determining the appropriateness of such procedures for their purposes;
• Describe the procedures performed;
• Describe the findings for each procedure performed;
• State that the practitioner was not engaged to and did not conduct an examination or review, which would result in the expression of an opinion or conclusion, respectively, on the subject matter;
• State that the practitioner does not express such an opinion or conclusion; and
• State that the practitioner is required to be independent of the responsible party and is required to meet the practitioner's other ethical responsibilities, in accordance with the relevant ethical requirements relating to the agreed-upon procedures engagement. (See the sidebar "Example of SSAE No. 19's Agreed-Upon Procedures Report.")

The practitioner's documentation for the agreed-upon procedures engagement is required to include the following items:

• The written agreement and acknowledgment from the engaging party regarding the appropriateness of the procedures performed for the intended purpose of the engagement;
• The nature, timing, and extent of the procedures performed; and
• The results of procedures performed and the evidence obtained.

FLEXIBILITY IS THE KEY

The flexibility associated with SSAE No. 19 could provide practitioners with new opportunities to use their skills to serve the public. Practitioners' expertise in rapidly evolving subject matters is highly valued in today's increasingly complex business environment.

By permitting general reports, enabling practitioners to have a role in developing procedures and eliminating the requirement for an assertion by a responsible party, the new standard enhances practitioners' ability to serve the public and users of agreed-upon procedures reports.

Example of application of an agreed-upon procedures engagement

A landlord engages a practitioner to perform agreed-upon procedures on a schedule of a commercial rental property's common-area maintenance expenses to submit to all related tenants. Prior to the issuance of SSAE No. 19, Agreed-Upon Procedures Engagements , if the tenants were intended to be permitted to use the report, the practitioner was required to get tenants to agree in advance to the procedures' sufficiency. Under SSAE No. 19, the practitioner need not get any tenants to agree to the sufficiency or appropriateness of the procedures performed. If the engaging party determines it is appropriate to obtain the agreement of the tenants to the appropriateness of the procedures, then the engaging party would do that as part of providing its acknowledgment to the practitioner. The practitioner could also issue a general-use report.

Example of SSAE No. 19's agreed-upon procedures report

Independent Accountant's Report

[Appropriate addressee]

We have performed the procedures enumerated below on the accompanying Statement of Investment Performance Statistics of XYZ Fund for the year ended December 31, 20X8. XYZ Fund is responsible for the Statement of Performance Statistics.

XYZ Fund has agreed to and acknowledged that the procedures performed are appropriate to meet the intended purpose of assisting users in understanding the Statement of Investment Performance Statistics of XYZ Fund for the year ended December 31, 20X8. This report may not be suitable for any other purpose. The procedures performed may not address all of the items of interest to a user of this report and may not meet the needs of all users of this report, and, as such, users are responsible for determining whether the procedures performed are appropriate for their purposes.

The procedures and the associated findings are as follows:

[Insert procedures and findings.]

We were engaged by XYZ Fund to perform this agreed-upon procedures engagement and conducted our engagement in accordance with attestation standards established by the AICPA. We were not engaged and did not conduct an examination or review engagement, the objective of which would be the expression of an opinion or conclusion, respectively, on the accompanying Statement of Investment Performance Statistics of XYZ Fund for the year ended on December 31, 20X8. Accordingly, we do not express such an opinion or conclusion. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you.

We are required to be independent of XYZ Fund and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements related to our agreed-upon procedures engagement.

[Additional paragraph(s) may be added to describe other matters.]

[Signature of the practitioner's firm]

[City and state where the practitioner's report is issued]

[Date of the practitioner's report]

About the authors

Alan Reinstein, CPA, CGMA, DBA , is the George R. Husband Endowed Professor of Accounting at the Mike Ilitch School of Business at Wayne State University in Detroit; Cathleen L. Miller, CPA, Ph.D. , is an associate professor of accountancy at the University of Michigan—Flint; and John Fleming, CPA, MBA , is a discussion leader and consultant at Kaplan Financial Education in Philadelphia. The authors would like to acknowledge the input of Abe Akresh, CPA, consultant; David Duprey, CPA, retired CFO of Comerica; and David Sinason, CPA, professor emeritus, Northern Illinois University.

To comment on this article or to suggest an idea for another article, contact Ken Tysiac, the JofA 's editorial director, at [email protected] or 919-402-2112.

AICPA resources

• " New Standard Adds Flexibility for Agreed-Upon Procedures ," JofA , Dec. 9, 2019

Center for Plain English Accounting

The Center for Plain English Accounting (CPEA) is the AICPA's national A&A resource center and assists members with accounting, auditing, attest, review, and compilation needs by sharing technical advice and guidance in a straightforward manner. For more information on the benefits of membership, visit aicpa.org/cpea .

Accounting Technical Information Hotline

1-877-242-7212 9 a.m.—8 p.m. ET, Monday—Friday The hotline is available for questions about accounting, auditing, and attest, including A&A implications of the pandemic. A live chat feature is also available to help you with questions.

SPONSORED REPORT

Be prepared for tax season early

Our expert tax report highlights the important issues that tax preparers and their clients need to address for the 2024 tax year. Stay informed and proactive with guidance on critical tax considerations before year-end.

Crafting the Perfect Agreed Upon Procedures Engagement Letter: A Comprehensive Template Guide

In the realm of financial and compliance auditing, the Agreed Upon Procedures (AUP) engagement stands out as a specialized service where an auditor performs specific tests and procedures, as agreed upon by the involved parties. This guide delves into the essence of crafting an AUP engagement letter, a foundational document that outlines the scope, responsibilities, and expectations of such engagements. Enhanced with authoritative .gov, .edu, and Wikipedia resources, this article aims to equip professionals with a solid framework and a deeper understanding of creating effective AUP engagement letters.

Understanding Agreed Upon Procedures Engagements

AUP engagements involve an auditor performing procedures of an audit nature to which the auditor, the entity, and any appropriate third parties have agreed and reporting on factual findings. The flexibility and focused nature of AUP engagements make them highly valuable across various contexts, from financial due diligence to compliance with regulations.

For foundational insights into AUP engagements, the American Institute of Certified Public Accountants (AICPA) offers guidelines and standards which can be accessed through their official site .

Key Elements of an AUP Engagement Letter

An effective AUP engagement letter should clearly articulate several critical components to ensure clarity and mutual understanding between the auditor and the client:

Introduction : A brief overview of the AUP engagement's purpose and its distinction from traditional audits.

Objectives and Scope : Detailed description of the procedures to be performed and the specific areas or aspects to be examined.

Responsibilities of the Parties : Clarification of the responsibilities of both the auditor and the client, including the provision of information and access to documents.

Expected Outcomes and Reporting : Explanation of the format and content of the report to be delivered upon completion of the procedures.

Timeline and Milestones : Timeline of the engagement, including any critical milestones or deadlines.

Fees and Payment Terms : Outline of the fee structure, payment terms, and any other financial arrangements.

The Public Company Accounting Oversight Board (PCAOB) , a nonprofit corporation established by Congress to oversee the audits of public companies, provides additional resources and standards relevant to AUP engagements.

Crafting an AUP Engagement Letter Template

Introduction.

Dear [Client Name],

We are pleased to present this engagement letter for the agreed-upon procedures (AUP) engagement to be performed by [Auditor's Name/Firm]. This letter outlines the scope and terms of our engagement.

Objectives and Scope

The objective of this AUP engagement is to conduct specific procedures, as mutually agreed upon by [all relevant parties involved], concerning [specific area/aspect]. These procedures are intended to [briefly state the purpose, e.g., verify compliance, assess financial metrics].

Responsibilities of the Parties

[Your Firm's Name] will perform the agreed-upon procedures as outlined in this letter. [Client Name] is responsible for providing all necessary information, documentation, and access to personnel as required to complete these procedures.

Expected Outcomes and Reporting

Upon completion of the agreed-upon procedures, we will provide a report detailing our findings. It is important to note that this report will not constitute an opinion or assurance on any of the information provided.

Timeline and Milestones

This engagement is expected to commence on [Start Date] and conclude by [End Date], subject to the timely receipt of all required information from [Client Name].

Fees and Payment Terms

The fees for this AUP engagement are estimated to be [Fee Amount], based on the anticipated scope of work. Payment terms are [specify terms, e.g., upon receipt of invoice].

[Your Name] [Your Position] [Your Firm's Name]

Create & Review Your Contracts 10x Quality and Ease

Lawyer-level AI handles all your contract needs, with real lawyers providing safeguarding support

An AUP engagement letter is a critical document that lays the foundation for a successful audit process, outlining the scope, expectations, and responsibilities of both parties. By adhering to the guidelines and template provided, auditors and clients can ensure a clear, effective agreement that supports the precise and targeted examination of agreed-upon areas. Utilizing authoritative resources, such as those from the AICPA, PCAOB, and educational institutions, further enhances the engagement letter's credibility and effectiveness.

Professionals embarking on AUP engagements are encouraged to consult these resources and consider legal or expert advice to tailor their engagement letters to specific circumstances and regulatory requirements, thereby ensuring compliance and achieving desired outcomes.

Create & Review All Your Contracts Online With LegalNow AI

© Copyright 2024 LegalNow - All Rights Reserved.