Advanced Audit and Assurance (International) · Reporting on other assignments

ISRS 4400 Agreed-Upon Procedures and ISRS 4410 Compilations

Updated 11 October 2026 · Fact-checked

An agreed-upon procedures (AUP) engagement under ISRS 4400 means you perform procedures agreed with the engaging party, and where relevant other specified parties, then report factual findings. A compilation under ISRS 4410 means you help management prepare financial information. Neither gives assurance. You express no opinion or conclusion on either.

Understand Agreed-Upon Procedures and Compilation Engagements

Most audit questions are about assurance. These two engagements are different. They are related services, and they give no assurance. The exam tests whether you can say this clearly and apply it to a scenario.

In an agreed-upon procedures engagement (ISRS 4400, Revised), you carry out specific procedures that have been agreed with the engaging party and, where relevant, other specified parties. You then report the factual findings. You do not give an opinion or a conclusion. Users draw their own conclusions from the findings. The report is not an audit report and should not read like one.

ISRS 4400 (Revised) does not require the practitioner to be independent. But the engagement terms and the report must state whether the practitioner is independent, and if not, that fact is disclosed. The procedures must be described in clear, objective terms, not vague words such as "review", "check generally" or "satisfy yourself". The findings must be factual and objective.

You do not apply materiality in determining the procedures or in evaluating the findings. Any sample sizes or thresholds are agreed and described objectively in the engagement terms and report. An example of an objectively described procedure is: "agree a sample of 25 invoices to dispatch notes and report any differences".

In a compilation engagement (ISRS 4410, Revised), you use your accounting and financial reporting expertise to help management prepare and present historical financial information. You collect, classify and summarise the data. You are not required to verify the information or obtain evidence on it. But you must still consider information that appears incorrect, incomplete or inconsistent, and raise it with management. The practitioner must comply with relevant ethical requirements, including the fundamental principles. You do not have to be independent, but the report should include a statement about your independence or otherwise, because the standard requires disclosure. The report states that the information was compiled and that no assurance is given.

The key contrast with an audit is that an audit gives reasonable assurance through an opinion. A review gives limited assurance through a negative-form conclusion. AUP and compilation give none. The risk to you is that a user wrongly relies on the work as if it were assurance. Clear scope, clear wording and a restricted-use or purpose statement manage that risk.

Key rules to remember

AUP outcome: Procedures agreed → performed → factual findings reported (no opinion, no conclusion); The user draws conclusions from the findings. The practitioner does not.
Compilation outcome: Management's data + practitioner's expertise → financial information; no assurance; The practitioner is not required to verify the data or obtain evidence on it. But you must consider information that looks incorrect, incomplete or inconsistent and raise it with management. The report states that no assurance is given.
Assurance spectrum: Audit = reasonable assurance; review = limited assurance; AUP and compilation = no assurance; Use this ladder to compare engagements in any written answer.
Independence in related services: Independence is not required, but the report includes a statement about the practitioner's independence or otherwise; Ethical requirements, including the fundamental principles, still apply.
Key AUP report content: Title, addressee, statement that the engagement was performed under ISRS 4400 (Revised), is not an assurance engagement and gives no opinion or conclusion, procedures performed, factual findings, independence statement, purpose and restriction on use, date, signature; Learn this as a checklist and apply it to the scenario.

How to solve Agreed-Upon Procedures and Compilation Engagements questions

Use this method for any question on AUP or compilation engagements, whether it asks for explanation, a report critique or advice to a client.

1Identify the engagement type from the facts: procedures on specific items point to AUP, and help preparing financial information points to compilation.
2State that neither engagement gives assurance, and say what that means: no opinion and no conclusion.
3Describe the scope: for AUP, the specific procedures agreed with the engaging party; for compilation, the information to be compiled and the framework used.
4Cover acceptance and the engagement letter: agree the purpose, the procedures or the information, who gets the report, and the form of the report.
5Address ethics and independence: apply the fundamental principles, and include a statement in the report about whether you are independent or not.
6Set out the report: findings only for AUP, or the compilation statement, with wording that the engagement is not an assurance engagement and that no opinion or conclusion is expressed, and any restriction on use.
7Link back to the scenario: name the users, the risk of misuse, and what you would do about it.
8Close with a clear answer to the requirement, such as advice to accept, change the wording or decline.

Quickest way: Four-question check: what, how much, who, so what

When to use it: Use this when you have about two minutes to plan a short requirement worth around 5 marks.

What is the work: agreed procedures or help preparing information?
How much assurance: none, so no opinion and no conclusion.
Who will use it and for what: this decides the restriction on use and the risk of misreliance.
So what for the practitioner: ethics, wording of the scope and report, and the engagement letter.

Common mistakes in Agreed-Upon Procedures and Compilation Engagements

Saying an AUP report gives a conclusion or a negative assurance statement.
Students mix it up with a review engagement, where limited assurance is given.
Fix: Write that an AUP report gives factual findings only. Users form their own conclusions.
Using vague procedures such as "review the receivables" in an AUP.
Students copy the language of audit and review work.
Fix: Describe each procedure in specific, objective terms that give the same result whoever performs them, for example "agree amounts to bank statements and report differences".
Saying the practitioner must always be independent.
Students carry the audit rule over to related services.
Fix: Say independence is not required by these standards, but the report includes a statement about whether the practitioner is independent. Ethical requirements still apply.
Testing the underlying data in a compilation.
Students treat compilation as a light audit.
Fix: A compilation does not require you to verify the information or obtain evidence on it. You still apply professional judgement, consider information that appears incorrect, incomplete or inconsistent, and raise it with management, but you give no assurance.
Leaving out the statement that the engagement is not an assurance engagement, or the purpose and restriction on use.
Students focus on the findings and forget the protective wording.
Fix: Always state that the engagement is not an assurance engagement and that no opinion or conclusion is expressed, and state who the report is for and why. This limits the risk of misreliance.
Giving a general definition without applying it to the scenario.
The exam rewards application, but students write textbook lists.
Fix: Name the client, the users and the risk in the scenario, and say what you would do about it.

Worked examples

Example 1

A lender asks your firm to perform procedures on a borrower's year-end receivables. The borrower's directors suggest the report should say that receivables are "fairly stated". Explain why this is inappropriate and set out what the report should contain. (6 marks)

Show the solution

Identify the engagement: specific procedures requested by a third party point to an agreed-upon procedures engagement under ISRS 4400.
Explain why "fairly stated" is inappropriate: that is an opinion or conclusion. An AUP engagement gives no assurance, so the report can only describe procedures and factual findings.
Note the risk: the lender might rely on the report as if it were assurance, and the firm could face a claim if the wording suggests otherwise.
Report contents: title and addressee, a statement that the engagement was performed under ISRS 4400 (Revised), that it is not an assurance engagement and that the firm expresses no opinion or conclusion, the procedures performed described in specific terms, the factual findings (including any exceptions and differences), and a statement on whether the firm is independent.
Add purpose and use: state the purpose of the report and restrict its use to the lender and the borrower, and give the date and signature.
Recommend: agree the procedures in the engagement letter before starting, and explain to the directors that if they want an opinion, a different engagement such as an audit is needed.

Answer: The wording "fairly stated" is a conclusion, which an AUP engagement cannot give. The report should set out the agreed procedures and the factual findings, state that the engagement is not an assurance engagement and that no opinion or conclusion is expressed, state whether the firm is independent, restrict use to the named parties, and be backed by a clear engagement letter.

Example 2

A small company asks your firm to prepare its annual financial statements from its bookkeeping records. The finance director asks whether your firm will be 'taking responsibility' for the numbers and whether the bank can rely on the statements as if they were audited. Advise the director. (6 marks)

Show the solution

Identify the engagement: helping management prepare financial information from its records is a compilation under ISRS 4410.
Responsibility: management remains responsible for the information, the records and the completeness and accuracy of what it provides. The firm uses its expertise to collect, classify and summarise.
Assurance: the firm is not required to verify the data or obtain evidence on it, though it must raise anything that looks incorrect, incomplete or inconsistent with management. The firm gives no assurance, so the bank cannot treat the statements as audited.
Ethics: the firm must comply with the fundamental principles. It does not have to be independent, but its report should include a statement about whether it is independent or not.
Report: it states that the information has been compiled, names the framework used, and says no assurance is given. The statements should be marked as compiled.
Advice: if the bank wants assurance, the company should ask for a review or an audit, which would give limited or reasonable assurance respectively.

Answer: The firm will compile the statements using its expertise but will not take responsibility for the underlying data, which remains with management. The compilation gives no assurance, so the bank cannot rely on it as an audit. If the bank wants assurance, the company needs a review or an audit.

Exam tips

Always state "no assurance" in your first or second sentence. This is the core point examiners look for.
Compare with audit and review using the assurance ladder when the question asks about differences.
When asked to criticise a draft report, check for opinion-style words, vague procedures, missing independence statement and missing restriction on use.
Apply the work to the users in the scenario. Professional skills marks reward commercial awareness and clear advice, not lists.
Do not state a requirement for independence as fact. Say the report includes a statement about whether the practitioner is independent.

Practice questions from Reporting on other assignments

Agreed-Upon Procedures and Compilation Engagements in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CA FinalSRS 4400 Agreed-Upon Procedures Engagements

Agreed-Upon Procedures and Compilation Engagements: frequently asked questions

What is the main difference between agreed-upon procedures and an audit?

An audit gives reasonable assurance through an opinion on the financial statements. An AUP engagement gives no assurance. The practitioner performs the agreed procedures and reports factual findings, and the users form their own conclusions.

Does a compilation engagement under ISRS 4410 give assurance?

No. The practitioner helps management prepare financial information using accounting expertise. The practitioner does not verify the data, and the report says that no assurance is given.

Must the practitioner be independent for an AUP or compilation engagement?

These standards do not require independence. However, the report includes a statement about whether the practitioner is independent, and for AUP the engagement terms cover this too. The ethical requirements, including the fundamental principles, still apply.

Who agrees the procedures in an AUP engagement?

The practitioner agrees the procedures with the engaging party, and the terms are set out in the engagement letter. The report should be used for its stated purpose, and its use may be restricted to the named parties.