What are agreed-upon procedures?
A bank asks the client's practitioner to confirm a covenant calculation. The engagement letter (EL) says "review the debt-to-equity ratio." Three months later the bank reads the report and asks why it does not say whether the client passed. The practitioner replies that the engagement was factual findings only. The bank replies that they paid for a compliance answer. This argument lands in partner inboxes more often than anyone would like, and it traces back to scoping. AUP (agreed-upon procedures) work is literally ticking and bashing by nature, but the engagement letter scope is where files go wrong. In our experience, the procedures themselves are rarely the issue. The language that defines them is.
ISRS 4400.22 requires the practitioner and the engaging party to agree on the specific procedures before any work begins. The practitioner performs exactly what has been agreed (no more, no less) and reports the factual findings. No assurance is expressed under ISRS 4400.A26. The report states what the practitioner did and what they found, and the intended users draw their own conclusions.
The engagement letter under ISRS 4400.25 must list every procedure in sufficient detail that the engaging party and intended users understand what will be done. Vague descriptions like “review the revenue” do not qualify. The procedure must be testable and specific: “recalculate the revenue balance per the general ledger and agree to the trial balance (TB) as at 31 December 2025.”
The report format under ISRS 4400.32 presents findings procedure by procedure. Each finding is factual. “The debt-to-equity ratio calculated from the audited FS is 2.09:1; the covenant threshold is 2.5:1” is a finding. “The company complies with the covenant” is a conclusion, and including it in the report violates the standard.
| Dimension | AUP — ISRS 4400 | Audit — ISA 200 | Review — ISRE 2400 |
|---|---|---|---|
| Assurance level | None | Reasonable | Limited |
| Who defines the scope | Engaging party | Practitioner (per ISAs) | Practitioner (per ISRE) |
| Output | Factual findings only | Opinion on FS | Negative assurance conclusion |
| Report language | "We found X" | "The FS present fairly" | "Nothing has come to our attention" |
| Procedures | Only those agreed | Risk-based, full scope | Primarily inquiry and analytical |
Key Points
- Procedures must be agreed before work begins under ISRS 4400.22. The engaging party defines the scope.
- No assurance is expressed. ISRS 4400.A26 prohibits conclusions or opinions in the report.
- Findings must be factual, not evaluative. Report what you found, not what it means.
- Vague procedures produce scope disputes. Every procedure in the engagement letter must be specific and testable.
Why it matters in practice
Nobody enjoys scoping AUP engagements, but skipping the precision is how files get flagged. We've seen this on about half the ISRS 4400 engagements that cross a quality review desk: the practitioner performs the procedures as agreed, then slips evaluative language into the report. “Based on the above, the controls appear reasonable. Waive further pursuit” is the kind of line that converts a factual findings report into an assurance report the engagement was never designed to support.
Engagement letters with vague procedures are the second most common problem. When the EL says “review the revenue recognition policies,” neither the practitioner nor the engaging party has a clear understanding of what will actually be done. The result is either too much work (the practitioner effectively performs an audit procedure) or too little (the practitioner reads the policy and reports that it exists). Both outcomes lead to scope disputes.
ISRS 4400.25 exists to prevent this. Every procedure must be described in terms that leave no ambiguity about what the practitioner will do, what documents they will examine, and what calculations they will perform. The engaging party owns the judgment about whether those procedures are sufficient for their purposes.
Identify the engaging party and intended users
The engaging party is usually the client, but intended users may include a bank, regulator, or counterparty. ISRS 4400.21 requires the practitioner to understand who will rely on the report before agreeing the procedures.
Agree specific, testable procedures with the engaging party
Per ISRS 4400.22, procedures must be agreed before any work begins. Replace vague language like “review the revenue” with testable actions: “recalculate the revenue balance per the general ledger and agree to the trial balance as at 31 December 2025.”
Document the scope in the engagement letter
ISRS 4400.25 requires the engagement letter to describe each procedure in sufficient detail. If the procedure cannot be performed from the wording alone, rewrite it before signing.
Perform the procedures — exactly as agreed
No more, no less. If additional procedures become necessary during the work, re-agree the scope in writing with the engaging party before performing them.
Report factual findings procedure by procedure
ISRS 4400.32 sets the report format. Each procedure is stated, followed by the factual finding. No conclusions, no opinions, no evaluative language. The report ends at the findings.
Key standard references
- ISRS 4400.22: Requires procedures to be agreed with the engaging party before the engagement begins.
- ISRS 4400.25: Engagement letter must describe each procedure in sufficient detail.
- ISRS 4400.32: Report format presenting factual findings procedure by procedure.
- ISRS 4400.A26: Prohibits the expression of assurance in the report.
Related terms
Related reading
Frequently asked questions
Can the practitioner express a conclusion in an agreed-upon procedures report?
No. ISRS 4400.A26 prohibits expressing assurance. The practitioner reports factual findings only. Writing 'the company complies with the covenant' is a conclusion. The correct finding is: 'the debt-to-equity ratio calculated from the audited financial statements is 2.09:1; the covenant threshold is 2.5:1.'
Who decides what procedures to perform?
The engaging party decides. ISRS 4400.22 requires the procedures to be agreed before any work begins. The practitioner does not exercise judgment about what procedures are appropriate — that judgment belongs to the engaging party and intended users.