Advanced Audit and Assurance (International) · Audit-related and assurance services

Agreed-Upon Procedures Engagements (ISRS 4400) for ACCA AAA

Updated 11 October 2026 · Fact-checked

An agreed-upon procedures (AUP) engagement under ISRS 4400 (Revised) is one where the practitioner performs procedures agreed with the engaging party and reports the factual findings. No assurance is given. Users form their own conclusions from the findings. In the exam, explain the scope, objectivity, the report content and the limits on use.

Understand Agreed-Upon Procedures Engagements (ISRS 4400)

An agreed-upon procedures engagement is a service where you carry out specific procedures that you and the engaging party have agreed, and you report what you found. You do not give an opinion. You do not give a conclusion. You give factual findings only.

The key point is that this is not an assurance engagement. In an audit or review, you gather evidence to support a conclusion that adds credibility to information. In an AUP, the users decide what the findings mean. They take the findings and draw their own conclusions. The value is that an independent person did the work and reported it objectively.

The procedures are set by the parties, not by you alone. Examples are agreeing a sample of invoices to bank receipts, checking royalty calculations to a contract, or confirming that a loan covenant ratio was computed from the ledger figures. Because the procedures are narrow, the findings only help the parties who agreed them.

ISRS 4400 (Revised) requires you to comply with relevant ethical requirements. Independence is not required for an AUP, because you give no assurance. But you must still be objective, and the report must include a statement that you are or are not independent. If you are required or choose to comply with independence requirements, for example those in the IESBA Code, the report should identify them.

The report describes the procedures and the findings in enough detail that readers understand exactly what was done. It states that the engagement was an AUP engagement performed under ISRS 4400 (Revised). It says you do not express an assurance conclusion and that the engagement is not an audit or review. It is addressed to the engaging party. Where appropriate, you may include a statement restricting use or distribution of the report, and you should consider whether to do so, because other readers may not understand the agreed scope.

Key rules to remember

Nature of the engagement: AUP = agreed procedures + factual findings, with no assurance conclusion; The practitioner does not express an opinion or a conclusion. Users draw their own conclusions.
Independence: Independence not required, but the report must state whether the practitioner is independent; Objectivity and the ethical requirements still apply. The report must say that you are or are not independent. If you comply with independence requirements (for example the IESBA Code), the report should identify them.
Procedures must be: Procedures = clearly described, objective and capable of consistent results; Avoid vague terms such as 'review', 'satisfy yourself' or 'read'. Use terms such as 'agree', 'recalculate', 'inspect', 'confirm'.
Findings must be: Findings = factual and objectively verifiable, including exceptions; Report every exception found. Do not interpret or conclude.
Report content: Report = title, addressee, procedures, findings, statement of no assurance, independence statement, any restriction on use, date and signature; Include a statement that the engagement was performed under ISRS 4400 (Revised) and that it is not an audit or review. Consider whether to restrict use or distribution.

How to solve Agreed-Upon Procedures Engagements (ISRS 4400) questions

Use this method for any AUP question, whether it asks for planning, a comparison with an audit or a critique of a report.

1Identify the requirement: planning, differences from audit, evaluating procedures, or reporting.
2Confirm the engagement type: there is no assurance, only factual findings. Say this early.
3Check acceptance: ethical requirements, competence, and whether the procedures are clear and the engaging party takes responsibility for their adequacy.
4Set the terms in the engagement letter: the procedures, the purpose, who will use the report, and any restrictions on distribution.
5Plan each procedure using precise wording, such as agree, recalculate, inspect or confirm, and set a sample basis if one is needed.
6Perform the procedures and record the exceptions factually, without drawing conclusions.
7Report the procedures and findings, state that no assurance is given and state the independence position and any restriction on use.
8Apply the facts to the scenario. Name the client, the users and the risks, and add professional scepticism about the scope.

Quickest way: Four-line AUP check

When to use it: Use this when time is short and the question asks you to evaluate or draft an AUP response.

State: no assurance, only factual findings, users draw conclusions.
Check the procedures: are they specific, objective and agreed in writing?
Check the report: findings, exceptions, no-assurance statement, independence statement, and whether use should be restricted.
Link to the scenario: who relies on it, and could they mistake it for an audit?

Common mistakes in Agreed-Upon Procedures Engagements (ISRS 4400)

Giving an opinion or a negative assurance conclusion in the AUP report.
Students copy the structure of a review report, which does give limited assurance.
Fix: Report only factual findings. State clearly that no assurance is provided.
Saying the practitioner must be independent.
Independence is required for audits and reviews, so students assume it applies everywhere.
Fix: Say independence is not required for an AUP, but the report must state whether the practitioner is independent. Objectivity is still needed.
Using vague procedure wording such as 'review the controls' or 'ensure accuracy'.
Students use audit language by habit.
Fix: Use precise terms such as agree to, recalculate, inspect and confirm, so that different practitioners would get the same result.
Omitting exceptions or interpreting them.
Students want to add value by commenting on what the findings mean.
Fix: Report every exception factually and leave the interpretation to the users.
Assuming anyone can rely on the report.
Students treat the report like a public audit report.
Fix: Address the report to the engaging party and consider restricting use or distribution where appropriate. Others may lack the context to interpret the findings.
Saying the practitioner decides the procedures alone.
In audits, the auditor decides the procedures.
Fix: Explain that the procedures are agreed with the engaging party, who is responsible for their sufficiency for its purposes.

Worked examples

Example 1

A lender asks your firm to confirm that a borrower's quarterly revenue figure in its covenant certificate agrees to the accounting records. The borrower's finance director suggests you 'audit the revenue and confirm it is fairly stated'. Explain how you would respond and what type of engagement is suitable. (6 marks)

Show the solution

The lender wants a specific check on one figure. A full audit of revenue is much wider than needed and would be more costly.
An agreed-upon procedures engagement under ISRS 4400 (Revised) fits. The procedures can be agreed with the lender as the engaging party, for example agreeing the certificate figure to the revenue ledger and recalculating the total.
Explain that the result would be factual findings only. The firm would not say revenue is fairly stated, because no assurance is given.
Explain the acceptance points: the firm must comply with ethical requirements and have the competence to do the work. The procedures must be clearly described and the engaging party must acknowledge that the procedures are appropriate for the engagement's purpose. This acknowledgement is normally recorded in the engagement letter.
Explain that the engagement letter would record the procedures, the purpose and the intended users, and that the firm would consider restricting use of the report to the lender and the borrower.
Explain that independence is not required, but the report must include a statement on whether the firm is independent. If the firm complies with independence requirements such as the IESBA Code, the report should identify them.

Answer: Recommend an AUP engagement under ISRS 4400 (Revised), not an audit. Agree specific procedures on the revenue figure, report the findings and any exceptions factually, give no assurance, state the independence position and consider restricting the report to the lender and the borrower.

Example 2

Your firm has drafted an AUP report for a franchisor on a franchisee's sales royalties. It says: 'We reviewed the royalty calculation and are satisfied that it is materially correct.' The report is addressed to 'whom it may concern'. Identify the problems and suggest corrections. (8 marks)

Show the solution

'We are satisfied that it is materially correct' is an assurance conclusion. An AUP gives no assurance, so this wording is not allowed. Replace it with the factual results of each procedure, including any exceptions.
'Reviewed' is vague and suggests a review engagement. Replace it with precise terms, for example 'agreed the monthly sales totals to the sales ledger' and 'recalculated the royalty at the contract rate'.
The report does not list the procedures performed. The report must describe each procedure and its findings so readers know what was done.
The report does not state that the engagement was an AUP engagement performed under ISRS 4400 (Revised), that the practitioner does not express an assurance conclusion, or that the engagement is not an audit or review. Add these statements.
There is no independence statement. Add a statement that the firm is or is not independent, and identify any independence requirements it complies with, such as the IESBA Code.
'Whom it may concern' is unsuitable. The report must be addressed to the engaging party (and any other identified intended users). Consider a restriction on use or distribution, because other readers may not understand the agreed scope.
Add the date and the firm's signature.

Answer: The report wrongly gives an assurance conclusion, uses vague wording, omits the procedures, the ISRS 4400 (Revised) reference, the no-assurance statement and the independence statement, and has an unsuitable addressee. Redraft it with the precise procedures, factual findings and exceptions, the required statements, an addressee who is the engaging party, and a considered restriction on use.

Exam tips

Open any AUP answer with 'no assurance, factual findings only'. This earns marks quickly and frames the rest of the answer.
Do not confuse AUP with review engagements. A review gives limited assurance. An AUP gives none.
When asked to compare with an audit, use headings: objective, assurance, independence, who decides procedures, report content, and users.
In scenario questions, name the specific procedures and the specific users. Generic answers earn fewer professional skills marks.
If the client wants a conclusion or opinion, advise on the right engagement type, and explain the cost and scope trade-offs.

Practice questions from Audit-related and assurance services

Agreed-Upon Procedures Engagements (ISRS 4400) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CA FinalSRS 4400 Agreed-Upon Procedures Engagements

Agreed-Upon Procedures Engagements (ISRS 4400): frequently asked questions

What is the difference between an AUP and an audit?

An audit gives reasonable assurance and an opinion on financial statements. An AUP applies only the procedures agreed and reports factual findings. Users draw their own conclusions, and the practitioner gives no assurance.

Does the practitioner need to be independent for an AUP under ISRS 4400?

Independence is not required, because no assurance is given. However, you must comply with relevant ethical requirements, including objectivity, and the report must include a statement that you are or are not independent. If you comply with independence requirements, such as the IESBA Code, the report should identify them.

Who decides the procedures in an AUP?

The procedures are agreed between the practitioner and the engaging party. The engaging party is responsible for deciding that they are sufficient for its purpose. The practitioner must be satisfied that they are clear and objective.

Should an AUP report restrict use or distribution?

Restriction is not mandatory, but you should consider including a statement restricting use or distribution where appropriate. Other readers may not understand the agreed scope and might mistake the findings for assurance.