An example of an AICPA agreed-upon procedures report follows a predictable shape: an independent accountant’s title, a paragraph identifying the subject matter and the parties, a disclaimer that no opinion is being expressed, a numbered list of procedures each followed immediately by its factual findings, a statement of the engagement’s intended purpose, and the practitioner’s signature and date. The content changes with every engagement; the skeleton, set by AT-C section 215 as amended by SSAE No. 19, does not.
A Sample Report on a Loan Covenant Engagement
The illustration below uses a hypothetical quarterly covenant test to show how the pieces fit together on the page. It is a framework built from the requirements in SSAE No. 19, not a template to copy verbatim, since every report must be tailored to its own engagement.
Independent Accountant’s Report on Applying Agreed-Upon Procedures
To the Board of Directors of ABC Corporation and First National Bank:
We have performed the procedures described below, which were agreed to by ABC Corporation and First National Bank, on ABC Corporation’s compliance with certain financial covenants of the credit agreement dated January 15, 2025, for the quarter ended September 30, 2025. ABC Corporation is responsible for compliance with the credit agreement.
We are required to be independent of ABC Corporation and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements relating to our agreed-upon procedures engagement.
We were engaged to perform this agreed-upon procedures engagement and conducted our engagement in accordance with attestation standards established by the AICPA. We were not engaged to and did not conduct an examination or review engagement, the objective of which would be the expression of an opinion or conclusion, respectively, on compliance with the credit agreement. Accordingly, we do not express such an opinion or conclusion. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you.
The procedures and associated findings are as follows:
Procedure 1: We recalculated the debt-to-equity ratio reported on the quarterly compliance certificate using the general ledger balances as of September 30, 2025, and compared it to the maximum ratio of 3.0:1 specified in Section 4.2 of the credit agreement.
Finding: The debt-to-equity ratio recalculated from general ledger balances was 2.7:1. The ratio reported on the compliance certificate was 2.7:1. No differences were noted. The recalculated ratio did not exceed the 3.0:1 maximum.
Procedure 2: We compared the EBITDA figure reported on the compliance certificate to the sum of the relevant income and expense accounts in the general ledger for the quarter ended September 30, 2025.
Finding: The EBITDA figure on the compliance certificate was $1,200,000. The sum of the relevant general ledger accounts was $1,150,000, a variance of $50,000.
We were engaged by ABC Corporation, which acknowledged that the procedures performed are appropriate for the intended purpose of the engagement, which is to assist the specified parties in evaluating ABC Corporation’s compliance with the financial covenants described above. This report is intended solely for the information and use of the Board of Directors of ABC Corporation and First National Bank and is not intended to be, and should not be, used by anyone other than these specified parties.
[Firm Signature]
[Date]
Reading the Procedures and Findings Section
The procedures and findings section is the heart of the report, and it follows a strict pattern. Each procedure is described with the same precision it carried in the engagement letter, and each finding states only the factual result. The practitioner does not add context, suggest causes, or characterize the result as favorable or unfavorable.
Look again at Procedure 2 in the sample. The finding reports a $50,000 variance between the EBITDA on the compliance certificate and the general ledger total. It does not call the variance material, immaterial, concerning, or acceptable. Whether the variance matters is a question for the Board and the bank, not the practitioner.
The vocabulary inside a procedure description is deliberately narrow. Words like “evaluate,” “analyze,” “check,” “test,” “review,” “examine,” “verify,” and “interpret” should not appear unless the engagement letter defines exactly what they mean, because those terms invite differing readings and defeat the point of a report built on replicability. The acceptable verbs are concrete and observable: compare, count, inspect, recalculate, confirm, agree, trace. A well-written procedure reads something like: “Compare the interest rate on the $5 million term loan to the rate specified in Section 3.1 of the loan agreement and report any differences.” A second practitioner given the same instruction and records should reach the same finding.
What Every AUP Report Must Contain
SSAE No. 19 sets out specific content that must appear, even if the exact ordering varies between firms:
- A title that includes the word “independent,” such as “Independent Accountant’s Report on Applying Agreed-Upon Procedures,” and an addressee (the engaging party and any other intended users).
- A clear description of the subject matter or assertion the procedures relate to, together with identification of the responsible party.
- A statement that the engagement was conducted in accordance with attestation standards established by the AICPA.
- A statement that the practitioner is required to be independent and to meet ethical responsibilities under the AICPA Code of Professional Conduct and applicable regulatory requirements.
- An explicit disclaimer that the practitioner was not engaged to perform an examination or review, did not perform one, and expresses no opinion or conclusion on the subject matter.
- A detailed description of each procedure, immediately followed by the factual findings for that procedure.
- A statement identifying the intended purpose of the engagement, as agreed to by the engaging party.
- A use restriction, when the practitioner determines one is appropriate, limiting distribution to specified parties.
- The practitioner’s signature (or firm name) and the date the report is issued.
The disclaimer language is not a formality. Organizations sometimes commission this work thinking it will carry the same weight as an audit opinion. It will not. Lenders, regulators, and other sophisticated users understand the distinction, but less experienced parties occasionally misread a clean set of findings as a stamp of approval, and the disclaimer exists to prevent that misreading.
Restricted-Use and General-Use Language
The closing paragraph of the sample report restricts use to the Board and the bank. That language is optional under the current standard. Before SSAE No. 19 took effect in July 2021, every AUP report was restricted, because every intended user had to agree the procedures were sufficient. SSAE No. 19 moved that acknowledgment to the engaging party alone, which opened the door to general-use reports that can be distributed broadly.
General-use reports fit situations where it isn’t practical to get every reader to agree on procedures beforehand: AUP findings on diversity hiring progress shared with all employees, results from a service organization sent to hundreds of user entities, or findings from an observed lottery drawing or competitive bidding process published publicly. Restricted-use language stays appropriate when the procedures are narrowly tailored to one party’s needs and reliance by outsiders could mislead. When restricting use, the report must state that it is intended solely for the specified parties and should not be used by anyone who has not agreed to the procedures.
How Procedures and Findings Look in Other Contexts
The covenant example is one of the most common uses, but the same procedure-then-finding format carries across subject matters. A few short illustrations show how the pattern travels.
Expense Report Compliance
Procedure: “Randomly select 30 expense reports filed during the third fiscal quarter and inspect each for a physical receipt supporting every expenditure exceeding $50.”
Finding: “Twenty-eight of the 30 selected expense reports contained a physical receipt for each expenditure over $50. Two reports contained only a credit card statement copy in place of a physical receipt.”
The finding stops there. It does not opine on whether credit card statements should be an acceptable alternative or whether two exceptions signal a policy failure.
Government Contract Cost Verification
The Defense Contract Audit Agency describes procedures structured as: compare the proposed direct labor rates by category to the contractor’s actual year-end labor rates per the contractor’s records, and report any differences. Another might compare the five highest proposed material line items to vendor quotes provided by the contractor and report any differences. Compare one number to another, report what you found. The practitioner does not opine on whether any difference is reasonable, justified, or within tolerance.
Royalty Payment Calculations
Procedure: “Recalculate the royalty payment for Q3 2025 by applying the 5% royalty rate specified in Section 7.1 of the licensing agreement to the licensee’s reported net sales figure, and compare the result to the amount actually remitted.”
Finding: State what the recalculated amount was, what was actually paid, and any difference between the two. Nothing further.
What the Report Deliberately Does Not Say
An AUP report provides no assurance. A financial statement audit delivers reasonable assurance through a positive opinion on whether the statements present fairly in all material respects. A financial statement review provides limited assurance through a negative-form conclusion about whether any material modifications should be made. An AUP report does neither. The practitioner makes no positive or negative statement about the subject matter and only warrants that the listed procedures were performed as described. Interpretation belongs to the users.
That is why the sample report’s fourth paragraph is written the way it is. The sentence “Accordingly, we do not express such an opinion or conclusion” is not boilerplate padding. It is the point of the entire document, and it governs how every finding below it should be read.