What Is an Agreed Upon Procedures Engagement?

A board may not need another full financial statement audit to answer a narrow but consequential question: Were restricted grant funds spent as required? Did a housing entity calculate tenant files correctly? Does a school district’s purchasing process follow its own policy? An agreed upon procedures engagement is designed for these situations. It provides independent, clearly reported findings on specific procedures selected to address a defined compliance, reporting, or control concern.

The distinction matters. A well-designed engagement can give management, the board, a lender, or a funding agency reliable evidence about a discrete area without expanding the work into an audit of the organization’s full financial statements. The value comes from precision. The procedures must be specific enough that the intended users understand what was tested, how it was tested, and what the CPA found.

What an agreed upon procedures engagement does

In an agreed upon procedures engagement, the engaging party and the CPA establish procedures in advance. The CPA performs those procedures and reports factual findings. The report does not provide an audit opinion, a review conclusion, or assurance that every exception in the population has been identified.

For example, a nonprofit receiving a major restricted grant may ask for testing of a specified sample of disbursements. The procedures might compare invoices, approvals, payroll records, and program documentation against the grant agreement and approved budget. If a transaction lacks required support, the report describes that exception. If the transaction meets the stated procedure, the report says so.

That limited form of reporting is not a weakness. It is the point of the engagement. An AUP report gives decision-makers transparent findings they can evaluate in light of the purpose of the work, rather than a broad conclusion that may not address the question driving their concern.

When agreed upon procedures are the right fit

An agreed upon procedures engagement is often appropriate when the question is narrow, the needed testing is known or can be defined, and the users need independent evidence rather than general financial assurance. It can be particularly useful for regulated and institutionally accountable organizations facing a request from a funder, regulator, board committee, investor, or lender.

Common applications include testing grant expenditures against award terms, verifying attendance or enrollment data tied to funding, examining procurement compliance, testing payroll allocations to programs, reviewing cash disbursement controls, or confirming compliance with debt covenants. HUD-funded housing organizations may need focused procedures around tenant eligibility, rent calculations, reserve activity, or program-specific records. Municipalities and school districts may use them to examine selected purchasing, payroll, or revenue processes. Closely held businesses may need procedures directed at revenue, inventory, or covenant calculations for a lender.

The right choice depends on the underlying requirement. Some grantors prescribe the exact procedures and reporting format. In other cases, management and the board have latitude to define the work. If a federal award triggers a Single Audit requirement, agreed upon procedures cannot simply substitute for the audit required under Uniform Guidance. Likewise, where a lender requires audited financial statements, a targeted AUP engagement will not meet that requirement. It can, however, supplement an audit by addressing a specific risk that deserves closer attention.

AUP versus audit, review, and internal audit work

A financial statement audit provides an opinion on whether financial statements are presented fairly, in all material respects, under the applicable financial reporting framework. Its scope is determined through professional standards, risk assessment, and the auditor’s judgment. It is broad by design.

A review provides limited assurance through inquiry and analytical procedures. A compilation presents financial information without providing assurance. An agreed upon procedures engagement is different from each of these because its scope is not intended to support a conclusion on the financial statements or a defined subject matter as a whole.

Internal audit work may also examine controls and compliance, often on an ongoing basis and for management’s use. An AUP engagement can complement that work when an independent CPA’s report is needed for external parties or when governance leaders want an objective examination of a defined concern. The appropriate service depends on what the recipient needs to rely on and what question the organization needs answered.

Defining procedures that produce useful findings

The most important work in an AUP engagement happens before testing begins. Vague procedures produce vague findings. A request to “test compliance” is too broad to be meaningful. A request to “select 25 expenditures from the specified grant period and compare each invoice, approval, and cost allocation to the grant agreement” can be performed and reported with clarity.

Management should begin by identifying the decision the report must support. Is the board assessing whether a control failure is isolated or recurring? Is a funder requiring verification before releasing funds? Is a lender evaluating a particular covenant calculation? That decision shapes the population, period, documents, sample methodology, and exception criteria.

Effective procedures typically address four elements:

• The population or records subject to testing, including the applicable period.
• The exact action the CPA will perform, such as inspecting, recalculating, confirming, or comparing.
• The criteria against which results will be measured, such as a grant agreement, policy, regulation, or loan covenant.
• The form of finding to be reported when the expected documentation or condition is absent.

The procedures should be understandable to the parties who will use the report. Technical precision is essential, but so is operational realism. If a requirement calls for a written approval, the organization should not assume that a verbal practice will be treated as equivalent. If documentation is maintained across multiple systems, that should be addressed in the scope rather than discovered after fieldwork begins.

Responsibilities of management and governance

An AUP engagement does not transfer responsibility for compliance or internal control to the CPA. Management remains responsible for maintaining records, following program requirements, designing controls, and providing complete information. Boards and audit committees retain their governance responsibility to ask whether exceptions reveal a broader risk.

That is why the report should prompt discussion, not merely be filed away. A single missing approval may reflect an administrative lapse. Repeated missing approvals across locations, programs, or months may indicate that the control is not operating as intended. The report states the findings; management and those charged with governance determine the corrective response.

For organizations with public funding, this distinction is especially important. A finding can affect reimbursement, future funding, monitoring results, and reputation. Prompt remediation may include clarifying ownership, revising a policy, retraining staff, reconciling records, or expanding internal monitoring. The response should be proportionate to the facts, but it should be documented.

Preparing for the engagement

Preparation improves both efficiency and the usefulness of the final report. Before fieldwork, designate a knowledgeable internal contact who can coordinate records and explain the relevant process. Gather governing agreements, policies, prior monitoring reports, system reports, reconciliations, and supporting documentation for the testing period.

It is also prudent to identify known exceptions before the engagement begins. Early disclosure does not eliminate the need to report an exception if it falls within the procedures. It does allow management and the CPA to distinguish between an isolated historical issue, a corrected process weakness, and an unresolved compliance exposure.

Organizations should resist the urge to make the scope so narrow that it cannot answer the real question. A report that tests only whether invoices exist may be insufficient if the actual concern is whether costs were allowable, properly allocated, and approved. Conversely, an overly broad request can create unnecessary cost and delay. Partner-level discussion at the planning stage helps align the procedures with the decision at hand.

Reading the report with the right perspective

AUP reports are intentionally direct. Each procedure is followed by the corresponding finding, including exceptions. Readers should consider both what was found and what was not tested. If the procedures cover a sample, the report does not make a statement about every transaction unless every transaction was examined. If the procedures address documentation, they may not assess the effectiveness of the entire control environment.

This clear boundary makes the engagement valuable to boards, finance leaders, and external stakeholders. It provides credible evidence without implying a level of assurance the work was not designed to provide. For organizations operating under close regulatory scrutiny, that honesty is a governance strength.

The best agreed upon procedures engagement is not the one with the longest report. It is the one that gives the people responsible for stewardship a precise, independent basis for their next decision.