ISRS 4400 (Revised)
Agreed-Upon Procedures Engagements
1Objective and scope
ISRS 4400 (Revised) deals with the practitioner's responsibilities when engaged to perform agreed-upon procedures (AUP) and to report on the findings, and with the form and content of the report. It applies to AUP engagements on financial and non-financial subject matters, whether or not the practitioner is the entity's auditor. The 2020 revision (effective for engagements agreed on or after 1 January 2022) restated the standard: it clarifies that the engagement gives no assurance, allows procedures to be agreed with parties beyond the engaging party, removes the prohibition on the practitioner's independence being relevant (independence is now disclosed rather than required), permits the use of a practitioner's expert, and sets a clear report format. AUP engagements are common in Kenya for donor-funded projects (verification of expenditure against a grant agreement), for regulators (a bank's compliance with a specific prudential ratio), for insurers' claims, for tax and customs compliance checks, and for due diligence where a purchaser wants specific facts checked rather than an opinion.
The objectives are to agree with the engaging party the procedures to be performed, to perform the procedures, and to communicate the procedures performed and the related findings in an agreed-upon procedures report. The practitioner does not express an opinion or a conclusion; the intended users assess the procedures and findings for themselves and draw their own conclusions.
2Key definitions
3Requirements
Ethics, quality, acceptance and agreement of terms
- Comply with the relevant ethical requirements (the IESBA Code's fundamental principles apply; independence is not required for an AUP engagement, but the practitioner must comply with any independence requirements imposed by law, regulation or the terms of engagement, and must state in the report whether the practitioner is required to be independent and, if so, that the requirements were complied with).
- Apply ISQM 1 and take responsibility for quality at the engagement level; the engagement partner has competence in the subject matter and in AUP engagements.
- Accept or continue only if the practitioner has no reason to believe the ethical requirements will not be satisfied, is satisfied that the engaging party acknowledges the terms, and is satisfied that the procedures can be performed, that the findings can be described objectively, and that the engagement has a rational purpose (the intended users will find the procedures and findings useful). Do not accept where the procedures are so vague or inappropriate as to be misleading, or where the engaging party wants the practitioner to express an opinion under the guise of AUP.
- Agree the terms in an engagement letter: the nature of the engagement, including that it is not an audit, review or assurance engagement and no opinion or conclusion will be expressed; the purpose and identification of the subject matter; the responsibilities of the engaging party and the responsible party; the procedures to be performed (listed precisely, with the population, the sampling method and any thresholds); a statement that the findings will be factual; any restriction on distribution or use of the report; and the expected form of the report. Where procedures are to be agreed with other intended users, the practitioner establishes the mechanism (a regulator's prescribed procedures, a donor's terms of reference).
Performing the procedures
- Perform the procedures as agreed, exercising professional judgement in their application (sample selection, the handling of missing documents) but not in substituting other procedures without agreement. If a procedure cannot be performed as agreed, discuss with the engaging party and either agree a modified procedure (documented as a change in terms) or describe the limitation in the report.
- Where the practitioner uses a practitioner's expert (an engineer to check a quantity survey, a lawyer to check title), evaluate competence, capabilities and objectivity, agree the nature of the work, and evaluate the adequacy of the work; the report describes the expert's involvement.
- Where the practitioner considers it necessary, obtain written representations from the engaging party or the responsible party (for example, that the population provided is complete); these are not a substitute for performing the agreed procedures.
- Record the findings accurately and completely, including exceptions; do not net off, omit or characterise them.
Prohibited and permitted terms
| Avoid in findings | Use instead |
|---|---|
| 'The expenditure is properly supported', 'the ratio is correctly calculated', 'nothing came to our attention' | 'We agreed each of the 60 items in the schedule to a supplier invoice and a payment record; for 57 items the amounts agreed; for 3 items, listed in Appendix 1, no invoice was available.' |
| 'Reasonable', 'adequate', 'material', 'in compliance with' | Objective wording tied to an agreed threshold: 'we found 4 items where the difference exceeded KES 10,000, the threshold agreed'. |
| 'We reviewed', 'we audited', 'we examined for reasonableness' | 'We inspected', 'we compared', 'we recalculated', 'we confirmed', 'we observed', 'we inquired of [name] and were told'. |
4Documentation and reporting
The AUP report describes the procedures and findings in sufficient detail for the intended users to understand the nature and extent of the work and to form their own conclusions. It contains: a title indicating an agreed-upon procedures report; an addressee (normally the engaging party); identification of the subject matter; identification of the purpose of the engagement and a statement that the report may not be suitable for another purpose; a description of the engagement, stating that the procedures were agreed with the engaging party (and any other parties) and were performed solely to assist them; a statement that the engagement was performed in accordance with ISRS 4400 (Revised), that the practitioner makes no representation about the appropriateness of the procedures, that it is not an assurance engagement and no opinion or conclusion is expressed, and that had additional procedures been performed other matters might have come to attention; a statement on ethical requirements, on independence (whether required and, if so, that it was complied with), and on the firm's application of ISQM 1; a description of the responsibilities of the engaging party and responsible party and of the practitioner; the procedures performed, with the findings for each, including exceptions, and a description of any procedure that could not be performed as agreed; a description of any practitioner's expert used; any restriction on distribution or use; the signature; the date; and the location. Documentation records the terms agreed, the procedures performed and the evidence for each finding, the resolution of any procedure that could not be performed, and the report. Where the engaging party or a third party wants the report to say anything beyond the procedures and findings, the practitioner declines.
5Examinable focus
What KASNEB tests
A donor, a lender or a regulator asks for verification of expenditure, of a covenant ratio or of a licence condition: explain why an AUP engagement fits, the acceptance considerations (rational purpose, appropriate procedures, agreement of terms with the users), how to write procedures and findings (precise, factual, exceptions listed, no assurance words), the contents of the report and the difference from an audit, a review and an assurance engagement (no opinion, no assurance, restricted use, users draw their own conclusions). The 2020 revision points, independence disclosed rather than required and experts permitted, are current. Practise converting an inappropriate finding ('the expenditure appears reasonable') into an acceptable one.