Agreed-Upon Procedures Engagements

What Is an Agreed-Upon Procedures Engagement?

An agreed-upon procedures engagement is an attestation service where a CPA (referred to as the "practitioner" under SSAE 19) performs specific procedures agreed upon by the engaging party and reports factual findings. The CPA acts as a finder of fact — not an evaluator. No opinion is issued. No conclusion is drawn. The engaging party and other report users interpret the findings themselves.

Three parties are involved: the practitioner (CPA firm performing the work), the engaging party (who hires the CPA and agrees to the procedures), and the responsible party (who is responsible for the subject matter being examined). The engaging and responsible party are often the same organization, but not always — an investor might engage a CPA to perform procedures on a target company's financial records during an acquisition.

The scope is narrow and targeted by design. Unlike an audit, which examines financial statements comprehensively, an AUP focuses on specific areas, transactions, accounts, or compliance requirements defined in the engagement letter. This targeted scope is what makes AUPs faster and less expensive than audits while still providing independently verified information from a licensed CPA.

Key Takeaway: An agreed-upon procedures engagement provides targeted, independently verified findings on specific subject matter — the CPA reports facts without issuing an opinion, making AUPs faster and 20–40% less expensive than full audits for situations requiring focused verification.

What Changed Under SSAE 19?

SSAE 19 replaced the prior AUP guidance in SSAE 18 (AT-C Section 215) with four changes that significantly expanded the practicality and flexibility of agreed-upon procedures engagements:

1. No assertion required from the responsible party. Under SSAE 18, the CPA had to request a formal written assertion from the responsible party about the subject matter's compliance or accuracy. SSAE 19 eliminates this requirement — critical for M&A due diligence, where a target company may be unwilling to make formal assertions to the buyer's CPA.
2. General-use reports now permitted. SSAE 18 restricted AUP reports to specified users who had agreed to the procedures in advance. SSAE 19 allows general-use reports with language advising readers that the procedures may not be appropriate for their purposes. This makes findings shareable with investors, regulators, and other stakeholders without pre-engagement agreements.
3. Procedures can be developed during the engagement. The practitioner can now assist in developing procedures, and procedures can evolve as new information emerges. Under SSAE 18, all procedures had to be established before work began — a constraint that often forced expensive re-engagements.
4. Only the engaging party must acknowledge appropriateness. Instead of requiring all intended users to accept responsibility for the sufficiency of procedures — often impractical when government agencies were involved — only the engaging party must agree that the procedures are appropriate for the engagement's intended purpose.

Key Takeaway: SSAE 19's four changes — no assertion required, general-use reports, flexible procedure development, and engaging-party-only acknowledgment — removed the practical barriers that previously made AUPs cumbersome, particularly for M&A transactions and government compliance work.

When Should You Use Agreed-Upon Procedures?

AUPs work best when you need independently verified answers to specific questions — not comprehensive assurance on financial statements as a whole. Five scenarios account for the majority of AUP engagements.

M&A Due Diligence and Transaction Support

Buyers or sellers engage a CPA to verify specific financial data during acquisitions — revenue recognition accuracy, accounts receivable aging validity, inventory valuation, or customer concentration. AUPs verify targeted areas without the cost and timeline of a full audit. For government contractor acquisitions in the D.C. metro market, AUPs can verify DCAA compliance status, indirect cost rate calculations, and contract backlog accuracy.

Loan Covenant and Contract Compliance

Lenders or business partners require verification that specific financial covenants are met — debt-to-equity ratio, minimum working capital, or restricted cash balances. An AUP tests covenant compliance at a fraction of the cost of a full audit. Always verify with the lender whether an AUP satisfies their requirement — some covenants specifically require an audit or review.

Government Contract Compliance Verification

Government contractors can use AUPs to proactively test compliance with FAR requirements, cost allowability under FAR Part 31, or subcontracting plan compliance before a DCAA audit. Identifying and correcting issues in advance — rather than during an adversarial government audit — provides both cost savings and strategic advantage.

Internal Controls Testing

AUPs can test specific processes — cash handling, expense approvals, payroll accuracy, inventory management — without a comprehensive internal controls examination. Organizations that want targeted assurance on high-risk areas can scope an AUP to precisely those processes.

Grant and Regulatory Compliance

Nonprofits, healthcare organizations, and government-funded entities use AUPs to verify compliance with specific grant terms, royalty calculations, franchise fee computations, or regulatory reporting requirements when a [full single audit](link-target: When Does Your Business Need an Audit) isn't triggered.

Key Takeaway: AUPs are most valuable for M&A due diligence, loan covenant verification, government contract compliance testing, internal controls evaluation, and grant compliance — any situation requiring targeted CPA verification without the cost and scope of a full audit.

How Do Agreed-Upon Procedures Compare to an Audit?

AUPs occupy a distinct position within the spectrum of CPA assurance and attestation services. This comparison covers all four service levels:

The critical limitation: an AUP cannot substitute for an audit when a full audit is specifically required by regulation, statute, or contractual agreement. GAAP-compliant audited financial statements and agreed-upon procedures serve fundamentally different purposes — one provides comprehensive assurance, the other provides targeted facts. Always verify the exact language of your requirement before selecting a service level.

Key Takeaway: AUPs cost 20–40% of a full audit and complete in 1–4 weeks versus 6–16 weeks — but they provide factual findings only, not assurance, and cannot substitute for required audits.

What Does an AUP Report Include?

An AUP report is straightforward: no opinion, no conclusion, no recommendations. The practitioner describes the procedures performed and reports the factual findings for each.

Required report elements under SSAE 19 include: identification of the engaging party and responsible party, description of the subject matter examined, a statement that the procedures were appropriate for the engagement's intended purpose, description of each specific procedure performed, the related findings for each procedure, a statement confirming the practitioner's independence, and a caveat that the report may not be suitable for purposes other than those agreed upon.

What the report does not include: An opinion on financial statements, a conclusion about compliance or accuracy, or recommendations for corrective action. The CPA presents facts — the engaging party and other report users draw their own conclusions about what those facts mean.

Under SSAE 19, reports can be general-use (available to anyone) or restricted-use (limited to specified parties), at the practitioner's discretion. General-use reports include language advising readers that the procedures may not be appropriate for their specific purposes — a practical change that allows findings to be shared with boards, investors, and regulators without requiring each party to pre-approve the procedures.

Key Takeaway: An AUP report describes the procedures performed and factual findings obtained — no opinion, no conclusion, no recommendations — and under SSAE 19 can be issued for general use, making findings shareable with multiple stakeholders.

How Much Do Agreed-Upon Procedures Cost?

AUP costs in the Maryland and D.C. metro market range from $3,000 to $15,000 for most engagements, with complex multi-area procedures (such as M&A due diligence covering several financial statement areas) reaching $25,000 or more. This represents approximately 20–40% of what a full financial statement audit would cost for a comparable organization.

Cost drivers include the number of procedures defined, sample sizes for transaction testing, complexity and accessibility of the records being examined, and whether the engagement requires travel to multiple locations. Fixed-fee pricing is increasingly common under SSAE 19 because the scope is pre-defined — ask about fee structure before engaging.

ROI context: An AUP verifying loan covenant compliance ($3,000–$5,000) can prevent a covenant default that triggers loan acceleration. An AUP identifying DCAA compliance issues before a government audit ($5,000–$10,000) can prevent disallowed costs worth multiples of the engagement fee. The targeted nature of AUPs means you pay only for the specific verification you need.

Key Takeaway: Most AUP engagements cost $3,000–$15,000 and are completed in 1–4 weeks — roughly 20–40% of a full audit's cost, with ROI often exceeding the engagement fee through prevented covenant defaults or pre-identified compliance issues.