On December 19, 2019, the AICPA released SSAE 19, Agreed-Upon Procedures Engagements. AUPs provide you with the ability to provide assurance in a targeted manner (e.g., just for inventory). Though you’ve been able to perform AUPs for many years, the new guidance in SSAE 19 provides you with greater flexibility. See how below.
Greater AUP Flexibility
CPAs will find the new agreed-upon procedures (AUP) standard (SSAE 19) more flexible that the preceding guidance (SSAE 18 AT-C section 215).
How is it more flexible?
- You no longer request an assertion from the responsible party
- You can issue general-use reports
- Intended users are not required to take responsibility for the sufficiency of the procedures
- You can develop or assist in developing the procedures over the course of the engagement
And which of these do I like the best? No requirement for assertions.
Additionally, I like the option to develop AUP procedures as the engagement progresses. In the past, the client might review the draft AUP report (at the end of the engagement) and realize it doesn't meet their needs. Sometimes it's better for practitioners to develop procedures as they perform the AUP. SSAE 19 allows you to do just that.
So, if you develop new procedures, what must you do? Prior to issuance of the AUP report, obtain the engaging party's agreement regarding the procedures. Moreover, obtain their acknowledgement that the procedures are appropriate and that they satisfy the intended purpose of the engagement. In effect, the client reviews the procedures, agrees with them, and expresses satisfaction.
Definition of an Agreed-Upon Procedures Engagement
SSAE 19 defines an agreed-upon procedures engagement as "an attestation engagement in which a practitioner performs specific procedures on subject matter and reports the findings without providing an opinion or conclusion. The subject matter may be financial or nonfinancial information." The standard goes on to say "Because the needs of engaging party may vary widely, the nature, timing, and extend of the procedures may vary, as well."
Now, let's see what the AUP objectives are.
SSAE 19 Objectives
The objectives of an SSAE 19 engagement include:
- Applying specific procedures to subject matter
- Issuing a written practitioner's report that describes the procedures applied and the findings
Next, let's look at the structure of an AUP report.
AUP Report Structure
The structure of the AUP report should be as follows:
- Procedures
- Findings
So, the CPA should state what was done and then provide the findings (results). The procedures and findings are placed in the body of the AUP report.
The description of the procedures should be simple and clear.
Good AUP Procedure and Finding
Here's an example of a good AUP procedure and finding:
Procedure - We obtained the January 2022 check register and the January operating bank account statement. We compared check numbers 2850, 2892, 2933, 2935, 2972 to cleared checks agreeing the payee and the amount.
Findings - No exceptions were noted.
Now, let's look at a poor example:
Poor AUP Procedure and Finding
Procedure - We scanned the company's 2022 bank statements and talked with the CFO. The books seemed to be in order with the exception of July errors.
Finding - Overall, the check disbursements appear to be okay after our general review.
In this poor example, we see general words or statements. What does the word scanned mean? How about seemed to be in order ? Additionally, the finding is vague: okay after our general review.
SSAE 19 provides examples of acceptable and unacceptable wording.
Acceptable and Unacceptable AUP Wording
SSAE 19 calls the practitioner to clearly define procedures. Moreover, the standard states that practitioners should not perform procedures that are open to varying interpretations or that are vague.
Unacceptable Terms
.A27 of the standard even provides examples of unacceptable AUP terms such as:
- General review
- Evaluate
- Examine
Acceptable Terms
.A27 also provides examples of acceptable AUP terms such as:
- Inspect
- Compare
- Agree
- Recalculate
In addition to proper wording, document your engagement in accordance with SSAE 19.
AUP Documentation
SSAE 19 calls for the following documentation:
- Written agreement with the engaging party regarding the appropriateness of the procedures performed for the intended purpose of the engagement
- The nature, timing, and extent or procedures performed
- The results of the procedures
You'll also need a written engagement letter (see paragraph .15 of SSAE 19 for an example) and a representation letter (see paragraph .27 of SSAE 19 for an example).
So what about dating the representation letter? The representation letter date should be the date of the AUP report. Additionally, the representation letter should address the subject matter and periods covered by the practitioner's findings.
By now you may be thinking, "Where can I find AUP report examples?"
SSAE 19 Illustrative AUP Report
SSAE 19 provides four illustrative AUP reports in its exhibit (see .A78).
The four example AUP reports relate to:
- Statement of investment performance statistics
- Cash and accounts receivable
- Claims of creditors
- Procedures specified in regulation
If you're looking for a template to follow, see example 2. Why? The cash and accounts receivable procedures and findings are excellent. Build procedures and findings like these and you'll be in good shape.
I suggest you download SSAE 19 and keep these reports handy.
So, what about independence? Is that required?
Attestation Independence
The practitioner has to be independent in order to perform an AUP.
One exception exists when the practitioner "is required by law or regulation to accept an agreed-upon procedures engagement and report on the procedures performed and findings obtained."
SSAE 19 Effective Date
The effective date of SSAE 19 is for AUP reports dated on or after July 15, 2021.
Early implementation is permitted.
If third party assurance is not needed, consider issuing a consulting report in lieu of an AUP report. See my article: AICPA Consulting Standards - The Swiss Army Knife.