What are AUP engagements?
As the name suggests a type of assurance engagement that focusses on factual findings, and as such is probably the simplest form of assurance. The practitioner is asked to verify a question of fact, and their work simply answers that question.
IFAC notes that:
...the objective of an AUP engagement is to carry out procedures of an audit nature to which the practitioner, the entity, and any appropriate third parties have agreed and to report on factual findings. These engagements may entail the practitioner performing certain procedures concerning individual items of financial data (for example, accounts payable, accounts receivable, purchases from related parties, and sales and profits of a segment of an entity), a financial statement (for example, a balance sheet) or even a complete set of financial statements.
Covering specific parts of financial statements or specific transactions makes sense. But there is more:
While directed toward engagements regarding financial information, ISRS 4400 [the international AUP standard] may provide useful guidance for engagements regarding non-financial information, provided the auditor has adequate knowledge of the subject matter in question and reasonable criteria exist on which to base their findings.
In practice, AUP engagements are especially useful to verify to funders that their money has been spent as specified - for much less cost and effort than an Audit or Review Engagement. Other examples might be:
- Due diligence when buying or selling a business
- Verifying cash balances
- Checking security balances
- Income tax provisions
- Accounts receivable/payable processes
- Special reviews of loan portfolios
- Reviews of internal control and environmental management systems
- Royalty agreements compliance
- Employer compliance/payroll audits
- Purchasing department compliance
What standards are these based on?
In NZ we used to base our AUP work on APS-1 (revised) - Agreed-Upon Procedures Engagements to Report Factual Findings issued by the NZICA. However, ISRS (NZ) 4400 is effective for agreed-upon procedures engagements for which the terms of engagement are agreed on or after 1 January 2022. Early adoption is permitted. This is based on the IAASB’s ISRS 4400, Engagements to Perform Agreed-Upon Procedures Regarding Financial Information.
Why would we use these?
AUP engagements have the potential to be much more focussed than audit or compliance assurance work. Factual findings exclude all concepts of risk assessment, materiality, expressing an opinion and extended testing. They are radically different from risk based auditing. The client is assured that they are getting exactly what they ask for and no more. So potentially there should be a large market for this kind of work.
IFAC notes that:
AUP engagements have the potential to be an attractive and fast growing service offering to SMEs. Clients may not need an audit, but may greatly benefit from an AUP engagement to satisfy banking or vendor needs.
What does the work involve?
The interesting part of an AUP engagement is that we must take off our auditors hat - and stop constantly evaluating risk and materiality, and instead just concentrate on doing what we agreed to do in the engagement letter - nothing more and nothing less.
The ICAEW says that:
The procedures and tests should be sufficiently detailed so as to be clear and unambiguous, and discussed and agreed in advance with the engaging parties so that the factual findings are useful to them and, depending upon the engagement, others to whom the report is made available. The practitioner’s report does not express a conclusion, and therefore it is not an assurance engagement in the technical sense.
In Audit Assistant we have templates called Agreed Upon Procedures (2021) - For use in engagements in which the auditor agrees with the client to perform specific procedures with respect to financial information (may be adapted to cover engagements involving non-financial information) reporting on the factual findings resulting from those procedures that have been performed.
Subscribers to our auditing packages may access this content from under the "other" tab.
There are two options: one where the AUP is likely to be an annual job, and the other where is it is a one-off job. In the second case, the date entered on setup is the "appointment date" rather than "year ending". Otherwise, the two are identical, and of course, may be swapped over if the nature of the engagement changes.
An important party of the planning work is to determine who the users are. This is likely to be either the engaging entity, possibly a different responsible party, plus a third party (for instance the funding suppliers), or the entity plus a regulator or representative of a group of users. These users must be identified and addressed in the engagement letter and the final report and the report is specifically restricted to these users.
Our templates include an engagement letter, report, and a range of confirmation letters and work-papers to fit many common agreed-upon procedures.
Our report expresses the procedures and our findings. For example:
