What are Agreed-Upon Procedures?
ISRS 4400.22 requires the practitioner and the engaging party to agree on the specific procedures before any work begins. The practitioner performs exactly what has been agreed — no more, no less — and reports the factual findings. There is no assurance expressed (ISRS 4400.A26): the report states what the practitioner did and what they found, and the intended users draw their own conclusions from those findings.
The engagement letter under ISRS 4400.25 must list every procedure in sufficient detail that the engaging party and intended users understand what will be done. Vague descriptions like “review the revenue” do not qualify. The procedure must be testable and specific: “recalculate the revenue balance per the general ledger and agree to the trial balance as at 31 December 2025.”
The report format under ISRS 4400.32 presents findings procedure by procedure. Each finding is factual. “The debt-to-equity ratio calculated from the audited financial statements is 2.09:1; the covenant threshold is 2.5:1” is a finding. “The company complies with the covenant” is a conclusion, and including it in the report violates the standard.
Key Points
- Procedures must be agreed before work begins under ISRS 4400.22. The engaging party defines the scope.
- No assurance is expressed — ISRS 4400.A26 prohibits conclusions or opinions in the report.
- Findings must be factual, not evaluative. Report what you found, not what it means.
- Vague procedures produce scope disputes — every procedure in the engagement letter must be specific and testable.
Why it matters in practice
The most frequent error in agreed-upon procedures engagements is drifting into conclusions. The practitioner performs the procedures as agreed but then adds evaluative language to the report: “based on the above, the controls appear to be operating effectively.” That single sentence converts a factual findings report into an assurance report, which the engagement was never designed to support.
Engagement letters with vague procedures are the second most common problem. When the letter says “review the revenue recognition policies,” neither the practitioner nor the engaging party has a clear understanding of what will actually be done. The result is either too much work (the practitioner effectively performs an audit procedure) or too little (the practitioner reads the policy and reports that it exists). Both outcomes lead to scope disputes.
ISRS 4400.25 exists to prevent this. Every procedure must be described in terms that leave no ambiguity about what the practitioner will do, what documents they will examine, and what calculations they will perform. The engaging party owns the judgment about whether those procedures are sufficient for their purposes.
Key standard references
- ISRS 4400.22: Requires procedures to be agreed with the engaging party before the engagement begins.
- ISRS 4400.25: Engagement letter must describe each procedure in sufficient detail.
- ISRS 4400.32: Report format presenting factual findings procedure by procedure.
- ISRS 4400.A26: Prohibits the expression of assurance in the report.
Related terms
Frequently asked questions
Can the practitioner express a conclusion in an agreed-upon procedures report?
No. ISRS 4400.A26 prohibits expressing assurance. The practitioner reports factual findings only. Writing 'the company complies with the covenant' is a conclusion. The correct finding is: 'the debt-to-equity ratio calculated from the audited financial statements is 2.09:1; the covenant threshold is 2.5:1.'
Who decides what procedures to perform?
The engaging party decides. ISRS 4400.22 requires the procedures to be agreed before any work begins. The practitioner does not exercise judgment about what procedures are appropriate — that judgment belongs to the engaging party and intended users.