More flexibility for agreed-upon procedures

Agreed-upon procedures provide practitioners with an important opportunity to use their skills and training to help clients with engagements that differ from both audits and consulting engagements.

A carefully constructed agreed-upon procedures engagement can enable a client to use a practitioner’s expertise to gain comfort, for example, on certain types of transactions such as travel and credit card transactions; or tax credits available to condominium owners.

Practitioners may benefit from increased flexibility to perform agreed-upon procedures engagements under a standard issued by the AICPA Auditing Standards Board (ASB) in December 2019.

Statement on Standards for Attestation Engagements (SSAE) No. 19, Agreed-Upon Procedures Engagements, is effective for agreed-upon procedures reports dated on or after July 15, 2021, with early implementation permitted. SSAE No. 19 supersedes AT-C Section 215 of the same title in SSAE No. 18.

SSAE No. 19 also amends AT-C Section 105 of SSAE No. 18, Concepts Common to All Attestation Engagements.

SSAE No. 19 provides flexibility to practitioners with changes that are summarized in the chart, “Comparison of SSAE No. 18 and SSAE No. 19.” The new standard:

• No longer requires the practitioner to request an assertion from the responsible party;
• Permits the development of procedures during the course of the engagement and allows practitioners to develop or help to develop these procedures as part of the agreed-upon procedures engagement;
• No longer requires intended users to take responsibility for the sufficiency of the procedures; instead, the engaging party acknowledges the appropriateness of the procedures for the intended purpose of the engagement before the practitioner issues the report (e.g., done in the representation letter); thus, the practitioner need not deal with the intended users; and
• Permits the practitioner to issue a general-use report but does not prohibit the issuance of a restricted-use report when the practitioner deems such a restriction appropriate.

SSAE No. 19 also requires new disclosures in the agreed-upon procedures reports that address the risk that some users could misunderstand the reports’ content.

The new standard also more closely aligns these standards with the International Auditing and Assurance Standards Board’s standards for agreed-upon procedures engagements. The new standard may provide practitioners with new engagement opportunities by:

• Removing the requirement that the practitioner request an assertion from the responsible party;
• Permitting the use of a general-use report by the practitioner;
• Eliminating the requirement for intended users to take responsibility for the sufficiency of the procedures; and
• Allowing procedures to be developed over the course of the engagement and permitting the practitioner to participate in development of those procedures as long as the engaging party acknowledges the appropriateness of the procedures before the practitioner’s report is issued.

Comparison of SSAE No. 18 and SSAE No. 19

3 TYPES OF ATTESTATION ENGAGEMENTS

AT-C Section 105 defines an attestation engagement as an examination, review, or agreed-uponprocedures engagement performed under attestation standards related to subject matter or an assertion that is another party’s responsibility. The three types of attestation engagements are:

• Examination engagement: In this type of attestation engagement, the practitioner obtains reasonable assurance by obtaining sufficient appropriate evidence about measurement or evaluation of the subject matter against criteria in order to draw reasonable conclusions on which to base the practitioner’s opinion about whether the subject matter is in accordance with (or based on) the criteria or the assertion is fairly stated in all material respects.
• Review engagement: In this type of attestation engagement, the practitioner obtains limited assurance by obtaining sufficient appropriate review evidence about the measurement or evaluation of subject matter against criteria in order to express a conclusion about whether any material modification should be made to the subject matter in order for it to be in accordance with (or based on) the criteria or for the assertion to be fairly stated.
• Agreed-upon procedures engagement: In an agreed-upon procedures engagement, a practitioner performs specific procedures on financial or nonfinancial subject matter or an assertion and reports the findings without providing an opinion or a conclusion. Findings are the factual results of the procedures performed. Findings can be objectively verified and described. Thus, procedures to be applied to the subject matter can be expected to result in reasonable, consistent findings.

All agreed-upon procedures engagements have an engaging party (who hires the practitioner), a responsible party (who is responsible for the subject matter), the practitioner, and the intended users. Often the engaging and the responsible party are the same; however, in other engagements, the engaging party and the responsible party may differ (see the sidebar “Example of Application of an Agreed-Upon Procedures Engagement”).

CRITERIA FOR ACCEPTING SSAE ENGAGEMENTS

AT-C Section 105 requires a practitioner’s independence when performing attestation engagements unless a law or regulation requires the practitioner to accept the engagement and report on the subject matter, e.g., compliance with SEC Due Diligence Form 15E, Certification of Provider of Third-Party Due Diligence Services for Asset-Backed Securities. This is not changed by SSAE No. 19.

Also, the AICPA Code of Professional Conduct‘s “Agreed-Upon Procedure Engagements Performed in Accordance With SSAEs” interpretation (ET §1.297.020) modifies the independence requirements for agreed-upon procedures engagements. Among other things, this interpretation only requires the practitioner to be independent from the responsible party or parties when agreeing to issue reports in accordance with SSAEs.

As SSAE No. 19 explicitly permits practitioners to develop, or assist in developing, the procedures for an agreed-upon procedures engagement, the AICPA Professional Ethics Division discussed perceived independence issues raised by the addition of this explicit permission. The ethics division does not believe that this perceived independence issue raises any actual threats to independence. Because SSAE No. 19 requires the engaging party to agree to the procedures and acknowledge that the procedures are appropriate for the intended purpose of the engagement, this agreement and acknowledgment mitigate any perceived self-review and management participation threats, as the practitioner would not be the only one assessing the appropriateness of the procedures. 

The practitioner should also determine that the following four conditions exist in order to accept such engagements:

• Procedures can be designed, performed, and reported on per the provisions in SSAE No. 19;
• The engaging party agrees, or will be able to agree, to the procedures and will acknowledge that the procedures are appropriate for the intended purpose of the engagement;
• The procedures applied to the subject matter are expected to result in reasonably consistent findings; and,
• When applicable, the practitioner and engaging party agree to apply a (materiality) threshold that the engaging party establishes for reporting the exceptions.

Next, the practitioner and engaging party should agree in writing upon the engagement’s terms (normally in an engagement letter), including that the engaging party will provide the practitioner, prior to the completion of the engagement, with a written agreement and acknowledgment that the procedures performed are appropriate for the intended purpose of the engagement as well as a representation letter upon completing the engagement. The acknowledgment regarding the appropriateness of the procedures may be included in the representation letter. The practitioner also assumes the risk that misapplying the agreed-upon procedures may cause inappropriate reported findings and assumes the risk of omitted or misreported findings. As in all engagements, adequate planning and supervision and applying due professional care in performing the procedures, accumulating the findings, and preparing the practitioner’s report can lower the practitioner’s risks.

REQUIREMENTS OF SSAE NO. 19

The agreed-upon procedures practitioner’s report should, in part:

• Identify the engaging and responsible parties, and the subject matter to which the procedures were applied;
• State that the engaging party acknowledges that the procedures performed are appropriate to meet the intended purpose of the engagement (which should be described in the report);
• State that the practitioner’s report may not be suitable for any other purpose;
• State that the procedures performed may not address all items of interest to a report user and may not meet the needs of all report users — making users responsible for determining the appropriateness of such procedures for their purposes;
• Describe the procedures performed;
• Describe the findings for each procedure performed;
• State that the practitioner was not engaged to and did not conduct an examination or review, which would result in the expression of an opinion or conclusion, respectively, on the subject matter;
• State that the practitioner does not express such an opinion or conclusion; and
• State that the practitioner is required to be independent of the responsible party and is required to meet the practitioner’s other ethical responsibilities, in accordance with the relevant ethical requirements relating to the agreed-upon procedures engagement. (See the sidebar “Example of SSAE No. 19’s Agreed-Upon Procedures Report.”)

The practitioner’s documentation for the agreed-upon procedures engagement is required to include the following items:

• The written agreement and acknowledgment from the engaging party regarding the appropriateness of the procedures performed for the intended purpose of the engagement;
• The nature, timing, and extent of the procedures performed; and
• The results of procedures performed and the evidence obtained.

FLEXIBILITY IS THE KEY

The flexibility associated with SSAE No. 19 could provide practitioners with new opportunities to use their skills to serve the public. Practitioners’ expertise in rapidly evolving subject matters is highly valued in today’s increasingly complex business environment.

By permitting general reports, enabling practitioners to have a role in developing procedures and eliminating the requirement for an assertion by a responsible party, the new standard enhances practitioners’ ability to serve the public and users of agreed-upon procedures reports.

Example of application of an agreed-upon procedures engagement

A landlord engages a practitioner to perform agreed-upon procedures on a schedule of a commercial rental property’s common-area maintenance expenses to submit to all related tenants. Prior to the issuance of SSAE No. 19, Agreed-Upon Procedures Engagements, if the tenants were intended to be permitted to use the report, the practitioner was required to get tenants to agree in advance to the procedures’ sufficiency. Under SSAE No. 19, the practitioner need not get any tenants to agree to the sufficiency or appropriateness of the procedures performed. If the engaging party determines it is appropriate to obtain the agreement of the tenants to the appropriateness of the procedures, then the engaging party would do that as part of providing its acknowledgment to the practitioner. The practitioner could also issue a general-use report.

Example of SSAE No. 19’s agreed-upon procedures report

Independent Accountant’s Report

[Appropriate addressee]

We have performed the procedures enumerated below on the accompanying Statement of Investment Performance Statistics of XYZ Fund for the year ended December 31, 20X8. XYZ Fund is responsible for the Statement of Performance Statistics.

XYZ Fund has agreed to and acknowledged that the procedures performed are appropriate to meet the intended purpose of assisting users in understanding the Statement of Investment Performance Statistics of XYZ Fund for the year ended December 31, 20X8. This report may not be suitable for any other purpose. The procedures performed may not address all of the items of interest to a user of this report and may not meet the needs of all users of this report, and, as such, users are responsible for determining whether the procedures performed are appropriate for their purposes.

The procedures and the associated findings are as follows:

[Insert procedures and findings.]

We were engaged by XYZ Fund to perform this agreed-upon procedures engagement and conducted our engagement in accordance with attestation standards established by the AICPA. We were not engaged and did not conduct an examination or review engagement, the objective of which would be the expression of an opinion or conclusion, respectively, on the accompanying Statement of Investment Performance Statistics of XYZ Fund for the year ended on December 31, 20X8. Accordingly, we do not express such an opinion or conclusion. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you.

We are required to be independent of XYZ Fund and to meet our other ethical responsibilities, in accordance with the relevant ethical requirements related to our agreed-upon procedures engagement.

[Additional paragraph(s) may be added to describe other matters.]

[Signature of the practitioner’s firm]

[City and state where the practitioner’s report is issued]

[Date of the practitioner’s report]

About the authors

Alan Reinstein, CPA, CGMA, DBA, is the George R. Husband Endowed Professor of Accounting at the Mike Ilitch School of Business at Wayne State University in Detroit; Cathleen L. Miller, CPA, Ph.D., is an associate professor of accountancy at the University of Michigan—Flint; and John Fleming, CPA, MBA, is a discussion leader and consultant at Kaplan Financial Education in Philadelphia. The authors would like to acknowledge the input of Abe Akresh, CPA, consultant; David Duprey, CPA, retired CFO of Comerica; and David Sinason, CPA, professor emeritus, Northern Illinois University.

To comment on this article or to suggest an idea for another article, contact Ken Tysiac, the JofA’s editorial director, at Kenneth.Tysiac@aicpa-cima.com or 919-402-2112.

AICPA resources

Article

• “New Standard Adds Flexibility for Agreed-Upon Procedures,” JofA, Dec. 9, 2019

Center for Plain English Accounting

The Center for Plain English Accounting (CPEA) is the AICPA’s national A&A resource center and assists members with accounting, auditing, attest, review, and compilation needs by sharing technical advice and guidance in a straightforward manner. For more information on the benefits of membership, visit aicpa.org/cpea.

Accounting Technical Information Hotline

1-877-242-7212
9 a.m.—8 p.m. ET, Monday—Friday

The hotline is available for questions about accounting, auditing, and attest, including A&A implications of the pandemic. A live chat feature is also available to help you with questions.