What Are Agreed-Upon Procedures Standards? Requirements and Reports

Agreed-upon procedures standards are the professional rules that govern how a practitioner performs, documents, and reports on specific tests that the parties have agreed to, without expressing any opinion or conclusion on the subject matter. For nonissuers, the controlling standard is AT-C Section 215, as revised by Statement on Standards for Attestation Engagements (SSAE) No. 19, issued by the AICPA and effective for engagements dated on or after July 15, 2021.¹ For public companies (issuers), the Public Company Accounting Oversight Board’s AT Section 201 applies instead.² The two frameworks share the same core structure, but SSAE No. 19 introduced flexibility that the PCAOB standard does not share.

What the Standards Actually Govern

An AUP engagement is defined by what the practitioner does not do. There is no opinion, as in an audit. There is no negative assurance, as in a review. The practitioner runs the procedures the parties agreed to and reports the factual findings, and that is the whole product.³ If the agreed procedure was to check whether 25 invoices had matching purchase orders, the report says how many matched and how many did not. Drawing conclusions from those findings is the reader’s job.

Everything the standards require flows from that basic design: the parties decide what gets tested, the practitioner executes precisely, and the report speaks in facts rather than judgments.

Requirements Before the Engagement Begins

Agreeing on the Procedures

Under SSAE No. 19, the engaging party and the practitioner agree on the procedures to be performed. The practitioner can now assist in developing those procedures and can refine them over the course of the engagement.¹ Under the prior version of the standard, the procedures had to be entirely specified upfront by the parties and the practitioner played no role in their design.

Whoever drafts them, the procedures must be specific enough that another qualified practitioner could replicate them and reach the same findings. “Review the accounts receivable for reasonableness” does not meet the standard. “Select a sample of 30 accounts receivable balances over $10,000 and trace each to a corresponding signed customer invoice” does.

Independence

The practitioner must be independent of the responsible party. AT-C Section 105, which sets concepts common to all attestation engagements, establishes this requirement.⁴ If the practitioner is not independent, that fact must be disclosed in both the engagement letter and the final report.

The Engagement Letter

The engagement letter pins down the scope, the agreed procedures, the inherent limitations, and any restrictions on report distribution. It is the contractual boundary of the work and the document that controls what happens when someone later asks why a particular test was or was not performed.

Requirements During Execution

The practitioner applies only the agreed-upon procedures. No freelancing. If something interesting surfaces during procedure four, the practitioner cannot chase it down on their own initiative. Investigating beyond the agreed scope requires going back to the engaging party, explaining what was found, and getting specific agreement to perform additional procedures through a formal amendment.

This constraint is the defining feature of AUP work under the standards. The practitioner is a highly qualified set of hands following a script, not an independent investigator. Due professional care in applying each step is still required — sloppy execution of a well-designed procedure still violates the standard — but the practitioner’s judgment about what to test is deliberately taken out of the equation.

Documentation

The practitioner must document the specific procedures applied, the evidence obtained, and the factual findings that resulted, with a clear link between each agreed-upon procedure and its corresponding finding.⁴ The workpapers must be detailed enough that another practitioner reviewing the file could understand what was done and how each finding was reached. Most firms retain AUP workpapers for at least five to seven years, and federal grant work may require longer retention.

Materiality

AUP engagements generally do not involve materiality judgments the way audits do. The practitioner reports every exception identified, regardless of dollar amount, because the parties, not the practitioner, decide what matters. Certain regulatory programs build materiality thresholds into their AUP requirements — the Securities Investor Protection Corporation, for example, allows practitioners to ignore small differences on specified SIPC-7 line items when the limits are agreed in the engagement letter and disclosed in the report.⁵ Outside carve-outs like that, all exceptions get reported.

What the Standards Require in the Report

The AUP report follows a structured format. Missing any of the mandatory components can render the report non-compliant.

Identification of the subject matter and the responsible party associated with it.
A complete list of every procedure performed, followed immediately by the factual findings from each procedure. Nothing is summarized or omitted.²
A prominent disclaimer that the practitioner does not express an opinion or conclusion about the subject matter, and a note that additional procedures might have surfaced other matters.²
A statement addressing the practitioner’s independence, with disclosure if the practitioner was not independent.

General-Use vs. Restricted-Use Reports

One of the most significant changes under SSAE No. 19 involves who can see the final report. Under the prior standard, AUP reports were always restricted to the specified parties who had agreed on the procedures. SSAE No. 19 now permits the practitioner to issue a general-use report, meaning anyone can read and rely on it.¹ A restricted-use report is still available when circumstances warrant it, but the default is no longer locked to named recipients only.

The PCAOB’s AT Section 201 has not followed suit. If the engagement involves a public company, report use is still restricted to specified parties.²

How the Standards Assign Responsibility

The Engaging Party

Under the prior standard, all specified parties, including intended users beyond the engaging party, had to formally acknowledge that the procedures were sufficient for their purposes. SSAE No. 19 eliminated that requirement. Now only the engaging party acknowledges the appropriateness of the procedures for the intended purpose, typically through a representation letter, before the practitioner issues the report.⁶ The engaging party also bears the risk if the procedures turn out to be inadequate — if they didn’t test what actually needed testing, that gap is not the practitioner’s fault.

The Responsible Party

The responsible party controls the subject matter being tested. Under the prior standard, the practitioner had to request a written assertion from the responsible party about the subject matter. SSAE No. 19 removed that requirement entirely.⁶ The practitioner no longer needs to obtain or disclose the absence of a written assertion. The responsible party must still provide access to all information and personnel needed to carry out the agreed procedures.

The Practitioner

The practitioner’s duties include maintaining independence, exercising due professional care, complying with applicable ethical standards, preserving professional skepticism, and keeping documentation sufficient to support every finding in the report. These are ongoing obligations, not one-time checkboxes at the start of the engagement.

When Government Auditing Standards Add Requirements

When an AUP engagement involves federal funds, the practitioner may need to comply with Government Auditing Standards, commonly called the Yellow Book or GAGAS, issued by the U.S. Government Accountability Office.⁷ GAGAS layers additional requirements on top of the AICPA standards.

The 2024 Yellow Book revision, effective for periods beginning on or after December 15, 2025, adds several requirements for AUP attestation engagements:⁸

Practitioners outside government audit organizations must be licensed CPAs or work for licensed CPA firms. Some states with multiclass licensing systems also recognize other licensed accountants.
If practitioners become aware of noncompliance with laws, regulations, contracts, or grant agreements that is material to the subject matter, they must report it, even if the noncompliance falls outside the specific agreed-upon procedures.
When claiming compliance with GAGAS, the report must include a statement that the engagement was conducted in accordance with Government Auditing Standards.
The audit organization must have a system of quality management that complies with the Yellow Book, designed and implemented by December 15, 2025, with an evaluation of that system completed by December 15, 2026.

The noncompliance-reporting requirement is worth flagging because it creates a duty that does not exist under the AICPA standard alone. Under AT-C Section 215, a practitioner who stumbles across fraud while running a different test has no obligation to investigate or report it beyond communicating with the engaging party. Under GAGAS, material noncompliance must be reported regardless of whether the procedures were designed to find it.

Consequences of Non-Compliance

Practitioners who fail to follow the standards face professional discipline. The AICPA’s ethics enforcement process can impose sanctions ranging in severity:⁹

Corrective action for less severe violations, which may require up to 80 hours or more of continuing professional education, submission of subsequent workpapers for review, or pre-issuance review of reports by an outside party.
Public admonishment from the Joint Trial Board for violations that do not warrant suspension but merit public notice.
Suspension for up to two years or expulsion. During suspension, the member cannot identify themselves as an AICPA member on letterhead or other materials and cannot vote or hold committee positions.

Automatic suspension or expulsion, without a hearing, can occur if a member’s CPA license is revoked, if the member is convicted of certain crimes, or if another governmental body takes disciplinary action against the member.⁹ State boards of accountancy can independently revoke or suspend a license, and malpractice claims from engaging parties or report users remain a real risk when a practitioner departs from the standards.

1
AICPA & CIMA. AICPA Statement on Standards for Attestation Engagements No. 19
2
Public Company Accounting Oversight Board. AT Section 201 – Agreed-Upon Procedures Engagements
3
Public Company Accounting Oversight Body. AT Section 201 – Agreed-Upon Procedures Engagements
4
AICPA & CIMA. AICPA SSAEs – Currently Effective
5
Grant Thornton. Materiality Limits for a SIPC-7 AUP Engagement
6
AICPA & CIMA. SSAE No. 19 At a Glance
7
U.S. GAO. Yellow Book: Government Auditing Standards
8
U.S. GAO. Government Auditing Standards: 2024 Revision
9
AICPA & CIMA. Definitions of Ethics Sanctions/Disposition