Agreed-Upon Procedures (AUP) AUP is a standard that a company or client outlines when it hires an external party to perform an audit on a specific test or business process. AUP engagements are a special type of attest service that differs significantly from consulting services in purpose and reporting and performance requirements.
What is an agreed upon procedures attest engagement?
An agreed-upon procedures attest engagement is one in which a practitioner is engaged to issue a report of findings based on specific procedures performed on subject matter. The general, fieldwork, and reporting standards for attest engagements set forth in this section are applicable to agreed-upon procedures engagements.
What is an attestation and how does it work?
An attestation basically takes all the data and information that has been gathered and checks its validity based upon agreed-upon procedure engagements. An organization can also request attestation to be performed regarding compliance procedures, reviews on internal control functions,...
Are there practical alternatives to agreed upon procedures engagement?
Some consulting engagements may produce reports that resemble agreed-upon procedures reports (without the constraints of the attestation standards) and therefore may represent practical alternatives to a more onerous agreed-upon procedures engagement.
What is a statement of agreed upon procedures?
A statement that the procedures performed were those agreed to by the specified parties identified in the report .A statement that the agreed-upon procedures engagement was conducted in accordance with attestation standards established by the AICPA
What is agreed-upon procedure?
Why are specified parties responsible for the sufficiency of the agreed-upon procedures?
How to satisfy the requirements of a practitioner?
What is section 101?
What is a practitioner and the specified parties?
Why do specified parties assume responsibility for the sufficiency of the procedures?
What is the responsibility of a practitioner?
See 4 more
About this website
Agreed Upon Procedures | Explanation | vs Audit - Accountinguide
Agreed Upon Procedures vs Audit; Agreed Upon Procedures: Audit Engagement: The assurance provided varies based on the nature and scope of the agreed procedures
What is the difference between an audit and an attestation?
Answer (1 of 11): An audit is a form of attestation. An audit can be many things. A lot of people think its purely a financial statement or examination but you can have things such as performance audits, operational audits, etc. It isn’t just one thing. An attestation is when you are doing some...
AT Section 101 - Attest Engagements | PCAOB
Footnotes (AT Section 101—Attest Engagements): fn 1 For a definition of the term practice of public accounting, see Definitions [ET section 92.25].. fn 2 See section 301, Financial Forecasts and Projections, paragraph .02, for additional guidance on applicability when engaged to provide an attest service on a financial forecast or projection.
New attestation standard clarifies work effort of review engagements
The AICPA Auditing Standards Board (ASB) issued a new standard Wednesday that is designed to make it clear that the objective of a review engagement is to obtain limited assurance about whether any material modifications should be made to the subject matter in order for it to be in accordance with (or based on) the criteria.
What is agreed-upon procedure?
An agreed-upon procedures engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. fn 2 Because the specified parties require that findings be independently derived, the services of a practitioner are obtained to perform procedures and report his or her findings. The specified parties and the practitioner agree upon the procedures to be performed by the practitioner that the specified parties believe are appropriate. Because the needs of the specified parties may vary widely, the nature, timing, and extent of the agreed-upon procedures may vary as well; consequently, the specified parties assume responsibility for the sufficiency of the procedures since they best understand their own needs. In an engagement performed under this section, the practitioner does not perform an examination or a review, as discussed in section 101, and does not provide an opinion or negative assurance. fn 3 (See paragraph .24.) Instead, the practitioner's report on agreed-upon procedures should be in the form of procedures and findings. (See paragraph .31.)
Why are specified parties responsible for the sufficiency of the agreed-upon procedures?
Specified parties are responsible for the sufficiency (nature, timing, and extent) of the agreed-upon procedures because they best understand their own needs. The specified parties assume the risk that such procedures might be insufficient for their purposes. In addition, the specified parties assume the risk that they might misunderstand or otherwise inappropriately use findings properly reported by the practitioner.
How to satisfy the requirements of a practitioner?
To satisfy the requirements that the practitioner and the specified parties agree upon the procedures performed or to be performed and that the specified parties take responsibility for the sufficiency of the agreed-upon procedures for their purposes, ordinarily the practitioner should communicate directly with and obtain affirmative acknowledgment from each of the specified parties. For example, this may be accomplished by meeting with the specified parties or by distributing a draft of the anticipated report or a copy of an engagement letter to the specified parties and obtaining their agreement. If the practitioner is not able to communicate directly with all of the specified parties, the practitioner may satisfy these requirements by applying any one or more of the following or similar procedures.
What is section 101?
The general, fieldwork, and reporting standards for attestation engagements as set forth in section 101, together with interpretive guidance regarding their application as addressed throughout this section, should be followed by the practitioner in performing and reporting on agreed-upon procedures engagements.
What is a practitioner and the specified parties?
The practitioner and the specified parties agree upon the procedures performed or to be performed by the practitioner.
Why do specified parties assume responsibility for the sufficiency of the procedures?
Because the needs of the specified parties may vary widely, the nature, timing, and extent of the agreed-upon procedures may vary as well; consequently, the specified parties assume responsibility for the sufficiency of the procedures since they best understand their own needs.
What is the responsibility of a practitioner?
The responsibility of the practitioner is to carry out the procedures and report the findings in accordance with the general, fieldwork, and reporting standards as discussed and interpreted in this section. The practitioner assumes the risk that misapplication of the procedures may result in inappropriate findings being reported. Furthermore, the practitioner assumes the risk that appropriate findings may not be reported or may be reported inaccurately. The practitioner's risks can be reduced through adequate planning and supervision and due professional care in performing the procedures, determining the findings, and preparing the report.
What is an agreed-upon procedure?
Agreed-upon procedures or other attest services, however, are generally performed at the request or for the benefit of a third-party user. Ordinarily, there is little point in choosing the more rigid structure of an agreed-upon procedures engagement when there is no third-party user. Consulting services also typically “employ ...
Why can't an agreed-upon procedures engagement be performed?
An agreed-upon procedures engagement cannot be performed because the CPA is not independent, or because there is no assertion of a responsible party.
What is the difference between consulting and agreed-upon procedures?
The most significant distinction between consulting services and agreed-upon procedures is that an agreed-upon procedures engagement, as an attest service, results in a written report that is typically intended to add credibility to an assertion of the responsible party, usually management, to benefit a third-party user.
What is the difference between attest and consulting?
Another important distinction between attest and consulting services is that independence is required for attest services, but not for consulting services, although maintaining objectivity is (CS 100.09, fn. 4). In addition, consulting reports may be written or oral; agreed-upon and other attest reports must always be written.
What is an attester?
the attester, who performs procedures and issues a report intended to add credibility to the assertion; and
How many parties are involved in asserting a claim?
Note that the asserter might be the client or another party, in which case four parties are involved.
What are the requirements for a professional engagement?
These apply to all professional engagements, and specifically include requirements to 1) employ competency, integrity, objectivity, and due professional care; 2) obtain sufficient relevant data to afford reasonable support for any conclusions or recommendations; and 3) plan and supervise engagement performance adequately.
How does proper supervision affect attest procedures?
Proper planning and supervision contribute to the effectiveness of attest procedures. Proper planning directly influences the selection of appropriate procedures and the timeliness of their application, and proper supervision helps ensure that planned procedures are appropriately applied.
When a practitioner undertakes an attest engagement for the benefit of a government body or agency, is it oblige?
When a practitioner undertakes an attest engagement for the benefit of a government body or agency and agrees to follow specified government standards , guides, procedures, statutes, rules, and regulations, the practitioner is obliged to follow those governmental requirements as well as the applicable attestation standards.
How are attestation and quality control related?
Attestation standards relate to the conduct of individual attest engagements; quality control standards relate to the conduct of a firm's attest practice as a whole. Thus, attestation standards and quality control standards are related and the quality control policies and procedures that a firm adopts may affect both the conduct ...
What is an assertion in a statement?
An assertion is any declaration or set of declarations about whether the subject matter is based on or in conformity with the criteria selected.
Why is the use of the report restricted?
Although suitable criteria exist, use of the report is restricted because the criteria are available only to specified parties. (See paragraph .34.) A written assertion has been obtained from the responsible party.
Why should work performed by each assistant be reviewed?
The work performed by each assistant should be reviewed to determine whether it was adequately performed and to evaluate whether the results are consistent with the conclusion to be presented in the practitioner's report.
Why is the presumption of independence stressed?
Presumption is stressed because the possession of intrinsic independence is a matter of personal quality rather than of rules that formulate certain objective tests.
What is an agreed-upon procedure?
Agreed-upon procedures engagement is a type of engagement which auditor performs certain procedures that are agreed upon in advance. In this engagement, the auditor and specified parties agree that the auditor will perform specific procedures and report the findings.
Who performs the work based on the procedures agreed upon by auditors and specified parties?
Auditors perform the work based on the procedures agreed upon by auditors and specified parties, e.g. the client and other third party.
Do auditors give opinions on subject matter?
Unlike an audit, auditors do not give an opinion on subject matters in the agreed-upon procedures. Auditors only report of findings based on the agreed procedures performed on the subject matter. Hence, the clients need to make their own conclusion on the subject matter.
Do auditors perform an examination?
In the agreed-upon procedures, auditors do not perform an examination or a review like in an audit or a review engagement. Hence, the reporting should be in the form of procedures and findings.
Is the use of the report in the agreed-upon procedures strictly for the specified parties?
Also, the use of the report in the agreed-upon procedures is strictly for the specified parties. It is not for the public or any related stakeholders that are not the specified parties of the agreement.
What is an attestation for an accountant?
An attestation basically takes all the data and information that has been gathered and checks its validity based upon agreed-upon procedure engagements. An organization can also request attestation to be performed regarding compliance procedures, reviews on internal control functions, and reporting on financial forecasts, projections or pro forma data.
What is the difference between attestation and auditing?
One of the things to keep in mind to differentiate each of these services is that audits are performed to discover data, risks, or compliance issues that may not have been known before the audit took place, and attestation is to evaluate and review how true the data or information is when compared to a stated purpose, internal control or system.
What is auditing?
Audits are evaluations and investigations regarding a specific aspect of your organization. During the course of an audit, information and data is gathered that can help spot a weakness in operational controls in your financial department, potential workplace dangers, or certain IT risks that can affect the security of your company. Audits can come in many forms: 1 Accounting audits 2 Compliance audits 3 Human resource or safety policy audits 4 Operational audits 5 IT procedures audits
When do companies need assurance?
When companies do business with other organizations, trying to raise money from outside investors, or are even engaging in merger deals, they need to be reassured that the data and information presented is accurate and credible. This instance is when assurance services come into play. Assurance work provided by a certified public accountant aims to substantiate the data that is presented. The accountant will give their opinion regarding the information that can be used by the company to make a decision.
Who can perform an audit?
An audit can be performed internally by a manager or supervisor, or you can be obtained as an external audit from a third-party firm.
Why do organizations need audits?
For example: an organization may want to discover whether their operations are in compliance with a certain set of government regulations for their industry. An audit may be performed to look for gaps in their compliance procedures as an issue may be discovered. Then the organization can seek an attestation to the reported information.
What is agreed-upon procedure?
An agreed-upon procedures engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion as a result of a need or needs of the specified parties. fn 2 Because the specified parties require that findings be independently derived, the services of a practitioner are obtained to perform procedures and report his or her findings. The specified parties and the practitioner agree upon the procedures to be performed by the practitioner that the specified parties believe are appropriate. Because the needs of the specified parties may vary widely, the nature, timing, and extent of the agreed-upon procedures may vary as well; consequently, the specified parties assume responsibility for the sufficiency of the procedures since they best understand their own needs. In an engagement performed under this section, the practitioner does not perform an examination or a review, as discussed in section 101, and does not provide an opinion or negative assurance. fn 3 (See paragraph .24.) Instead, the practitioner's report on agreed-upon procedures should be in the form of procedures and findings. (See paragraph .31.)
Why are specified parties responsible for the sufficiency of the agreed-upon procedures?
Specified parties are responsible for the sufficiency (nature, timing, and extent) of the agreed-upon procedures because they best understand their own needs. The specified parties assume the risk that such procedures might be insufficient for their purposes. In addition, the specified parties assume the risk that they might misunderstand or otherwise inappropriately use findings properly reported by the practitioner.
How to satisfy the requirements of a practitioner?
To satisfy the requirements that the practitioner and the specified parties agree upon the procedures performed or to be performed and that the specified parties take responsibility for the sufficiency of the agreed-upon procedures for their purposes, ordinarily the practitioner should communicate directly with and obtain affirmative acknowledgment from each of the specified parties. For example, this may be accomplished by meeting with the specified parties or by distributing a draft of the anticipated report or a copy of an engagement letter to the specified parties and obtaining their agreement. If the practitioner is not able to communicate directly with all of the specified parties, the practitioner may satisfy these requirements by applying any one or more of the following or similar procedures.
What is section 101?
The general, fieldwork, and reporting standards for attestation engagements as set forth in section 101, together with interpretive guidance regarding their application as addressed throughout this section, should be followed by the practitioner in performing and reporting on agreed-upon procedures engagements.
What is a practitioner and the specified parties?
The practitioner and the specified parties agree upon the procedures performed or to be performed by the practitioner.
Why do specified parties assume responsibility for the sufficiency of the procedures?
Because the needs of the specified parties may vary widely, the nature, timing, and extent of the agreed-upon procedures may vary as well; consequently, the specified parties assume responsibility for the sufficiency of the procedures since they best understand their own needs.
What is the responsibility of a practitioner?
The responsibility of the practitioner is to carry out the procedures and report the findings in accordance with the general, fieldwork, and reporting standards as discussed and interpreted in this section. The practitioner assumes the risk that misapplication of the procedures may result in inappropriate findings being reported. Furthermore, the practitioner assumes the risk that appropriate findings may not be reported or may be reported inaccurately. The practitioner's risks can be reduced through adequate planning and supervision and due professional care in performing the procedures, determining the findings, and preparing the report.
Introduction and Applicability
Agreed-Upon Procedures Engagements
- .03
An agreed-upon procedures engagement is one in which a practitioner is engaged by a client to issue a report of findings based on specific procedures performed on subject matter. The client engages the practitioner to assist specified parties in evaluating subject matter or an assertion … - .04
As a consequence of the role of the specified parties in agreeing upon the procedures performed or to be performed, a practitioner's report on such engagements should clearly indicate that its use is restricted to those specified parties.fn 4 Those specified parties, including the client, are h…
Standards
- .05
The general, fieldwork, and reporting standards for attestation engagements as set forth in section 101, together with interpretive guidance regarding their application as addressed throughout this section, should be followed by the practitioner in performing and reporting on ag…
Conditions For Engagement Performance
- .06
The practitioner may perform an agreed-upon procedures attest engagement provided that— 1. The practitioner is independent. 2. One of the following conditions is met. 2.1. The party wishing to engage the practitioner is responsible for the subject matter, or has a reasonable basis for pr…
Agreement on and Sufficiency of Procedures
- .07
To satisfy the requirements that the practitioner and the specified parties agree upon the procedures performed or to be performed and that the specified parties take responsibility for the sufficiency of the agreed-upon procedures for their purposes, ordinarily the practitioner should c…
Subject Matter and Related Assertions
- .08
The subject matter of an agreed-upon procedures engagement may take many different forms and may be at a point in time or covering a period of time. In an agreed-upon procedures engagement, it is the specific subject matter to which the agreed-upon procedures are to be app… - .09
An assertion is any declaration or set of declarations about whether the subject matter is based on or in conformity with the criteria selected. A written assertion is generally not required in an agreed-upon procedures engagement unless specifically required by another attest standard (fo…
Establishing An Understanding with The Client
- .10
The practitioner should establish an understanding with the client regarding the services to be performed. When the practitioner documents the understanding through a written communication with the client (anengagement letter), such communication should be addressed to the client, an…
Responsibility of The Specified Parties
- .11
Specified parties are responsible for the sufficiency (nature, timing, and extent) of the agreed-upon procedures because they best understand their own needs. The specified parties assume the risk that such procedures might be insufficient for their purposes. In addition, the specified p…
Practitioner's Responsibility
- .12
The responsibility of the practitioner is to carry out the procedures and report the findings in accordance with the general, fieldwork, and reporting standards as discussed and interpreted in this section. The practitioner assumes the risk that misapplication of the procedures may result … - .13
The practitioner should have adequate knowledge in the specific subject matter to which the agreed-upon procedures are to be applied. He or she may obtain such knowledge through formal or continuing education, practical experience, or consultation with others.fn 5
Procedures to Be Performed
- .15
The procedures that the practitioner and specified parties agree upon may be as limited or as extensive as the specified parties desire. However, mere reading of an assertion or specified information about the subject matter does not constitute a procedure sufficient to permit a prac… - .16
The practitioner should not agree to perform procedures that are overly subjective and thus possibly open to varying interpretations. Terms of uncertain meaning (such as general review, limited review, check, or test) should not be used in describing the procedures unless such term…