Agreed-Upon Procedures Engagements: Examples and When to Use Them

10/5/2026

An agreed-upon procedures engagement answers a narrower question than an audit, and that is exactly why clients and third parties ask for one. A lender does not want an opinion on the financial statements; it wants to know whether the borrower's covenant calculation ties to the general ledger. A franchisor does not want a review of the franchisee's books; it wants someone independent to check reported sales against the register data. An AUP gives them that: specific procedures, performed by an independent CPA, with the findings reported as facts and no opinion attached.

For a CPA firm, AUP work is a useful service line. It is usually scoped tightly, it recurs, it draws on skills audit staff already have, and since the 2021 changes to the standard it is more flexible than it used to be. It also has traps: procedures that sound like an audit, reports that read like assurance, and engagement letters that leave the appropriateness of the procedures unresolved.

This post covers what an AUP engagement is under the AICPA standard, agreed-upon procedures examples from the work firms actually do, when an AUP is the right tool (and when it is not), and what the engagement letter and report need to cover.

What an Agreed-Upon Procedures Engagement Is

In an AUP engagement, the CPA performs specific procedures on a subject matter and reports the findings. There is no opinion and no conclusion. The users of the report draw their own conclusions from the findings.

For non-issuers, the governing standard is AT-C section 215, Agreed-Upon Procedures Engagements, in the AICPA attestation standards (SSAEs). The current version of AT-C 215 came from SSAE No. 19, effective for AUP reports dated on or after July 15, 2021. Engagements under Government Auditing Standards incorporate the AICPA attestation standards and add their own requirements, and AUP work for public-company issuers falls under PCAOB standards; confirm which framework applies before you scope the work.

Key features of the engagement under SSAE No. 19, as summarized by the AICPA's Journal of Accountancy:

The engaging party acknowledges that the procedures are appropriate for the intended purpose. That acknowledgment must be in hand before the report is issued and is often included in the representation letter.
No written assertion from the responsible party is required. Under the earlier standard, the practitioner had to request one.
Procedures can be developed during the engagement, and the practitioner can develop or help develop them, as long as the engaging party acknowledges their appropriateness.
The report can be general use. The practitioner may still restrict use when that is appropriate, but restriction is no longer automatic.
The practitioner must be independent of the responsible party.

Engaging party, responsible party, and users

Three roles show up in every AUP, and keeping them straight prevents most scoping problems:

The engaging party hires the CPA and acknowledges that the procedures are appropriate. It can be the entity itself, a lender, a franchisor, a grantor or a regulator.
The responsible party is responsible for the subject matter, for example the borrower whose covenant calculation is being tested.
The users read the report. The report itself tells them the procedures may not address everything they care about and that they are responsible for deciding whether the procedures suit their purposes.

Under the current standard, the engaging party and the responsible party can be different. That flexibility is what makes AUPs workable for third-party requests.

Agreed-Upon Procedures Examples

The procedures in each example below are illustrations. In a real engagement, the procedures are whatever the engaging party acknowledges as appropriate, worded precisely enough that the findings are objectively verifiable.

Grant and program compliance

Grantors and funding agencies often want an independent check on how money was spent without paying for a full compliance audit. Typical procedures:

Select a sample of expenditures charged to the grant and compare each to invoices, proof of payment and the approved budget category.
Compare payroll charged to the grant against timesheets or effort reports for the named personnel.
Recompute indirect cost charges using the rate stated in the grant agreement.
Compare reported matching contributions to supporting documentation.

Where the work falls under Government Auditing Standards, the additional Yellow Book requirements apply.

Royalty, franchise and license fee checks

Licensors and franchisors rely on what licensees report. An AUP lets them verify it:

Compare gross sales reported to the franchisor for selected months to point-of-sale reports and the general ledger.
Recompute the royalty and advertising fee due under the rate in the agreement and compare to amounts paid.
Compare units sold, as reported on royalty statements, to shipping or inventory records.

These engagements often recur annually, and the procedures carry forward with small changes.

Payroll and benefit contributions

Union benefit funds, multiemployer plans and some regulators use AUPs to check employer contributions:

Compare hours reported on contribution remittance reports to payroll registers for selected periods.
Trace selected employees from payroll records to the contribution reports to identify unreported workers.
Recompute contributions using the rates in the collective bargaining agreement.

The procedures resemble a payroll audit, and staff who have done payroll audit work adapt quickly. The webinar How to Do a Payroll Audit: A Former Auditor's Expert Advice covers that side of the work.

Debt covenant testing

Lenders frequently want compliance with financial covenants checked between audits, or for borrowers that are not audited at all:

Agree the amounts in the borrower's covenant compliance certificate to the general ledger or the financial statements.
Recompute each covenant ratio using the definitions in the loan agreement.
Compare the computed ratios to the thresholds in the agreement and report any differences.

The loan agreement's definitions (EBITDA, debt, fixed charges) control the computation. The procedures should quote or reference them instead of using the firm's own definitions.

Other common uses

Commercial lease common-area maintenance (CAM) charges, where tenants or landlords want the expense pool and allocation checked. The Journal of Accountancy lists this as an example.
Travel and credit card transactions, such as checking a sample of executive expense reports against policy and receipts.
Tax credit and incentive verification, where an owner needs eligible amounts checked before claiming them.
Sales or claims data for rebate programs, insurance claims and litigation settlements.
Regulatory filings where a state agency asks for an independent check of specific figures.

When an AUP Is the Right Tool, and When It Is Not

An AUP fits when the user:

has a specific question that can be answered with defined procedures;
is willing to draw its own conclusions from factual findings; and
needs a report faster and at lower cost than an examination or audit.

An AUP is the wrong tool when:

The user needs assurance. If a lender needs comfort that the financial statements as a whole are fairly stated, that is an audit or a review. An AUP on selected accounts does not provide it, however many procedures are added.
Nobody can define the procedures. If the engaging party wants the CPA to "look into the inventory" without saying what that means, the engagement may be better framed as a consulting engagement, an examination, or a forensic investigation.
The findings would depend on judgment. Procedures like "evaluate whether the reserves are reasonable" call for a conclusion. AUP findings need to be stated in factual, objectively verifiable terms.
Independence is impaired. An AUP is an attest engagement. If the firm performs services that impair independence with respect to the responsible party, it cannot issue the report.

Financial due diligence for an acquisition is a common gray area. Many firms do it as a consulting engagement rather than an AUP precisely because buyers want analysis and judgment, not just findings. The M&A due diligence post covers that side of the work.

The Agreed-Upon Procedures Engagement Letter

Like other attestation engagements, an AUP should start with a written agreement with the engaging party. Without reproducing any template, these are the subjects an AUP engagement letter typically needs to address:

The parties. Who the engaging party is, who the responsible party is, and, if relevant, who the intended users are.
The subject matter. What the procedures will be applied to, with periods and dates.
The nature of the engagement. That it is an AUP engagement under the AICPA attestation standards, that the practitioner will report findings, and that no examination or review will be performed and no opinion or conclusion expressed.
The procedures, or how they will be developed, together with the engaging party's acknowledgment that they are appropriate for the intended purpose. Under SSAE No. 19 that acknowledgment can come later, but it must be obtained before the report is issued.
Any materiality threshold for reporting exceptions agreed with the engaging party. Under the current standard, the engaging party sets the threshold, and the report describes it.
The representation letter the engaging party (and the responsible party, where different) will be asked to provide.
Use of the report, including whether it will be restricted.
Fees, timing, access to records and personnel, and the practice provisions found in any engagement letter, such as dispute resolution and termination.

The most common failure is item 4. A letter that says "procedures to be agreed" and never gets the acknowledgment in writing leaves the firm exposed if a user later claims the work was insufficient.

The AUP Report

The report is short, and its wording is controlled by AT-C 215. Based on the Journal of Accountancy's summary of SSAE No. 19, it includes, among other elements:

identification of the engaging party, the responsible party and the subject matter;
a statement that the engaging party acknowledged the procedures as appropriate;
statements that the report may not be suitable for any other purpose and that the procedures may not address all items of interest to users;
the procedures and the related findings;
a statement that the practitioner was not engaged to perform, and did not perform, an examination or review, and does not express an opinion or conclusion; and
a statement about independence and ethical requirements.

Findings are written as facts: "We compared the amount on line 4 of the certificate to the general ledger balance in account 2100 and found no differences," not "the amount appeared reasonable." Words that suggest assurance ("fairly," "reasonable," "verified" in a loose sense) do not belong in findings.

Building an AUP Practice

AUP work sits comfortably next to audit, review and peer-review-ready quality management. Firms that do it well:

Keep a library of procedure sets for recurring engagement types (covenant certificates, royalty reports, grant expenditures), adapted for each engagement.
Have someone senior review the wording of every procedure before fieldwork starts. Most problems in AUP reports start in procedures that were too vague to produce objective findings.
Track independence for AUP responsible parties alongside audit and review clients.
Include AUP engagements in quality reviews. They are attest engagements and fall within the scope of peer review; our peer review checklist applies to them.

Staff with a sound grounding in audit evidence, sampling and controls pick up AUP work quickly. Our posts on internal controls over financial reporting and audit red flags cover the underlying skills, and engagements that touch service organizations draw on the material in the Certified AICPA SOC Report Analyst program.

Train the Team Behind the Service Line

AUP engagements are one of the simplest ways for a firm with audit skills to serve lenders, franchisors, grantors and regulators without the cost of a full audit. They work when the procedures are well defined, the findings are factual, and the engagement letter gets the engaging party's acknowledgment in writing.

To strengthen the audit fundamentals AUP work depends on, browse the audit training courses and internal auditing training courses.

Frequently Asked Questions

What are some examples of agreed-upon procedures?

Common examples include checking grant expenditures against invoices and the approved budget, comparing franchisee sales reported to a franchisor against point-of-sale data and recomputing royalties, checking employer contributions to a union benefit fund against payroll records, recomputing a borrower's debt covenant ratios from the general ledger using the loan agreement's definitions, and testing common-area maintenance charges under a commercial lease. In each case the CPA performs defined procedures and reports factual findings. Users draw their own conclusions; the CPA expresses no opinion.

What standard governs agreed-upon procedures engagements?

For non-issuers, AICPA AT-C section 215, Agreed-Upon Procedures Engagements, as issued in SSAE No. 19 and effective for reports dated on or after July 15, 2021. Engagements performed under Government Auditing Standards also follow the additional Yellow Book requirements, and work for public-company issuers falls under PCAOB standards. Because the framework decides the report wording and independence rules, confirm which one applies when you accept the engagement, before you draft the engagement letter.

Is an agreed-upon procedures engagement an audit?

No. An audit results in an opinion on whether financial statements are fairly presented, based on sufficient appropriate evidence. An AUP results in a report of findings from specific procedures, with no opinion or conclusion. The report says the practitioner was not engaged to perform an examination or review. That makes AUPs faster and cheaper for narrow questions, but it also means a user who needs assurance on the financial statements as a whole should not rely on an AUP report.

What goes in an agreed-upon procedures engagement letter?

A written agreement with the engaging party that identifies the parties and the subject matter, states that the work is an AUP engagement with no opinion or conclusion, sets out the procedures (or how they will be developed), and records the engaging party's acknowledgment that the procedures are appropriate for the intended purpose. It should also cover any agreed materiality threshold for reporting exceptions, the representation letter, how the report may be used, and fees, timing and access. Draft your own wording rather than copying a published template.

Does the CPA need to be independent for an AUP engagement?

Yes. An AUP is an attestation engagement, so the practitioner must be independent of the responsible party. Under the AICPA's independence guidance, the focus is on the responsible party rather than every user of the report. A firm that provides services impairing independence with respect to that party cannot issue the AUP report and should consider a consulting engagement instead. Track AUP responsible parties in the firm's independence system alongside audit and review clients.

Can an agreed-upon procedures report be shared with anyone?

Under SSAE No. 19, an AUP report can be issued for general use, which was not allowed under the earlier standard, where use was automatically restricted. The practitioner can still add a restriction when appropriate, for example when the procedures were designed for one party's needs. Even a general-use report states that it may not be suitable for any other purpose and that the procedures may not address every item of interest, so readers outside the original engagement need to judge whether it meets their needs.