An Overview of Agreed-Upon Procedures Findings

In the world of professional auditing and assurance services, an Agreed-Upon Procedures (AUP) engagement is a specialized service that provides stakeholders with independent, factual reports. Unlike a full financial audit, which results in an opinion on the financial statements as a whole, an AUP engagement is designed to address specific, targeted inquiries defined by the client and the practitioner.

Defining Agreed-Upon Procedures

An AUP engagement occurs when a practitioner is engaged to perform specific tests or checks on certain subject matter and to report the findings objectively. The procedures are clearly defined in an engagement letter, and the focus is restricted solely to those actions. Consequently, no assurance or opinion is expressed by the practitioner; instead, the report summarizes the factual findings resulting from the procedures performed.

The Nature of AUP Findings

The "Findings" section is the core component of the final report. Because an AUP engagement is not an audit or a review, the practitioner does not look for errors in the general sense, nor do they evaluate the overall effectiveness of internal controls. Instead, the findings serve as an objective account of what occurred during the execution of the agreed-upon steps.

Findings in an AUP report generally follow these characteristics:

• Factual and Objective: The report describes exactly what the practitioner observed during the testing process without interpretation or subjective analysis.
• Specificity: Each finding relates directly back to one of the procedures outlined in the engagement agreement. If a procedure requested a count of assets, the finding reports the exact count found.
• Neutral Tone: Findings are presented without judgment. For example, rather than stating "The process failed," the report would state "The check of internal invoices revealed that three out of ten invoices lacked the required secondary signature."
• Completeness: All exceptions identified during the testing must be reported, regardless of their perceived size or importance to the user.

Common Scenarios for AUP Engagements

Organizations often utilize AUPs when they need clarity on specific financial or operational data points. Typical scenarios include:

• Due Diligence: An investor may require confirmation of specific revenue streams before completing a merger or acquisition.
• Regulatory Compliance: A government entity may require a report on the use of grant funds to ensure money was spent on designated categories.
• Covenant Compliance: Lenders may require evidence that a borrower is maintaining specific debt-to-equity ratios or insurance coverage levels.
• Third-Party Oversight: Royalty agreements or profit-sharing arrangements often involve an AUP to verify that calculations made by a partner are accurate based on sales data.

The Importance of Clear Documentation

Because the findings are intended for a specific group of stakeholders who understand the scope and limitations of the work, clarity is paramount. If the practitioner identifies an "exception"a deviation from the expected outcomethe finding should explicitly state the nature of that exception, the sample size tested, and the frequency of the occurrence. This allows the primary user of the report to draw their own conclusions and determine what subsequent actions, if any, are necessary.

Limitations and Expectations

It is essential for stakeholders to understand that the absence of findings does not equate to a guarantee of perfection. An AUP engagement is limited to the procedures explicitly agreed upon. If a procedure was not included in the scope, any issues related to that area will remain undiscovered. Furthermore, findings in an AUP engagement should not be misconstrued as an audit opinion. The reader is responsible for determining whether the findings provided are sufficient for their decision-making process.

In summary, Agreed-Upon Procedures provide a surgical, targeted approach to verification. By providing factual findings based on pre-defined steps, practitioners enable stakeholders to gain transparency into specific areas of interest, helping to manage risks and verify the accuracy of vital business data.