Agreed-Upon Procedures Engagements: Findings Without Assurance, and Why the AICPA Requires Independence Where ISRS 4400 Does Not

Run the same procedures on the same schedule under the two standards and the reports can still disagree about the practitioner. Under the AICPA's AT-C 215, the title must contain the word "independent" and the report must state that the practitioner is required to be independent of the responsible party. Under ISRS 4400 (Revised), which SOCPA endorsed, the report may say instead: "For the purpose of this engagement, there are no independence requirements with which we are required to comply."

The rest matches closely. The practitioner performs procedures the engaging party has accepted as appropriate, reports what was done and what was found, and expresses no opinion and no conclusion. CPA AUD tests the AICPA version and SOCPA's Auditing paper the IAASB one, and a candidate fluent in one risks losing the independence mark in the other.

What an agreed-upon procedures engagement is: procedures and findings, no opinion

AT-C 215 .02 defines it as an attestation engagement in which a practitioner performs specific procedures on financial or nonfinancial subject matter and reports the findings without providing an opinion or conclusion. ISRS 4400 (Revised) describes the same work but files it elsewhere: paragraph 6 says it is not an audit, review or other assurance engagement, and the IAASB groups it with compilations as a related service. SOCPA's auditing standards committee endorsed the revision in March 2021 for use in the Kingdom as the IAASB issued it.

The engagement rests on one word. Findings are the factual results of the procedures, capable of being objectively verified, and exclude opinions, conclusions and recommendations (AT-C 215 .A36; ISRS 4400 paragraph 13(f)); different practitioners performing the same procedures should reach equivalent results (A12). Recommendations may be given, but kept clearly apart from the report (paragraph 34 and A59; compare .05). AT-C 215 .06 excludes comfort letters, which belong to AU-C 920.

Who chooses the procedures, and why the engaging party must accept them as appropriate

Under SSAE 19, which governs reports dated on or after 15 July 2021, the procedures may be developed by the practitioner, the engaging party, another party or a combination, or prescribed by law, regulation or contract (.A2). The standard needs acceptance, not authorship: before the report is issued, the engaging party acknowledges in writing that the procedures are appropriate for the intended purpose (.22), and if it refuses, the practitioner withdraws (.23). The old rule making users take responsibility for the sufficiency of the procedures is gone.

ISRS 4400 (Revised) applies the test at acceptance: the practitioner declines if aware that the procedures are inappropriate for the purpose (paragraph 21) and accepts only once the engaging party acknowledges them as appropriate (22(a)). Its warning signs include procedures selected to bias users' decisions (A28); AT-C 215 .A6 names procedures chosen to show the subject matter only in a favourable light.

Both standards police the verbs. Inspect, confirm, compare, agree, trace, inquire, recalculate and observe are acceptable; "review", "verify", "test", "evaluate" and "examine" are not, unless defined (.A27; A33 to A34). ISRS 4400's own example, "review cost allocations to determine if they are reasonable", fails twice: "review" suggests limited assurance and "reasonable" is open to interpretation (A35).

Independence from the responsible party: required under AT-C 215, optional under ISRS 4400 (Revised)

The AICPA rule starts in AT-C 105: the practitioner must be independent for any attestation engagement unless required by law or regulation to accept it (paragraph .26 of the current codification). The AICPA Code's interpretation for agreed-upon procedures under the SSAEs, ET 1.297.020, which AT-C 215 .A5 cites, narrows this to independence from the responsible party, the party responsible for the subject matter. A practitioner compelled by law or regulation to accept without being independent must say so in the report (.10).

ISRS 4400 (Revised) has no independence precondition, and neither had its predecessor, as SOCPA's endorsement notice records. The IESBA Code sets no independence requirements for agreed-upon procedures (A15), so the floor is objectivity (A14); independence applies only where a national code, law, regulation, contract or the engagement terms require it (A15 and A37; 22(e)). Where the practitioner also audits the entity, users may assume independence, so A38 lets the practitioner agree to comply with the audit independence requirements.

Point	AT-C 215	ISRS 4400 (Revised)
In force	Reports dated on or after 15 July 2021	Engagements whose terms are agreed on or after 1 January 2022
Independence	Required: independent of the responsible party, unless law or regulation compels acceptance	Only where a code, law, regulation, contract or the engagement terms require it
Report title	Includes the word "independent" (.34a)	Identifies an agreed-upon procedures report (30(a))
Independence statement	Required to be independent of the responsible party (.34r)	No independence requirements apply, or the named ones were met (30(l))
Written representations	Requested from the engaging party (.27)	The practitioner considers whether to request them (28)
Procedures not acknowledged	Withdraw (.23)	Do not accept or continue (22(a))

The report: findings stated as facts, and when its use may be restricted

Most required statements match: the subject matter and the responsible party, the engaging party's acknowledgment, a warning that the report may not suit another purpose (.34h; 30(d)), each procedure's nature and extent, the findings with details of exceptions, no opinion or conclusion, and that further procedures might have revealed other matters (.34q; 30(j)). Both date the report no earlier than the completion of the procedures (.34w; paragraph 33).

The finding is where the marks go. AT-C 215 .A41 accepts "No exceptions were found as a result of applying the procedure" and rejects "Nothing came to my attention as a result of applying that procedure" and "The resultant percentage approximated the predetermined percentage". The first rejected sentence is a review's negative assurance, which .A40 and .A42 bar; the second is a judgement, not a result another practitioner would reproduce.

Restriction loosened on both sides. SSAE 19 permits a general-use report without prohibiting a restricted one: the practitioner considers a separate alert limiting use to specified parties (.35), for example at the engaging party's request, on contract compliance, for a regulator, or where the procedures were prescribed (.A65). ISRS 4400 (Revised) dropped the old requirement to restrict the report to the parties who agreed the procedures and leaves restriction to judgement where law allows (A53 to A54); its first illustrative report is unrestricted, its second restricted.

Agreed-upon procedures against an examination, a review and a compilation

Engagement	AICPA standard	IAASB standard	What the reader gets
Examination	AT-C 205 and 206	ISAE 3000 (Revised), reasonable assurance	An opinion
Review	AT-C 210; AR-C 90 for financial statements	ISAE 3000 (Revised), limited assurance; ISRE 2400 (Revised)	A conclusion
Agreed-upon procedures	AT-C 215	ISRS 4400 (Revised)	Procedures and findings
Compilation	AR-C 80	ISRS 4410 (Revised)	No assurance

The line runs between the second and third rows. Assurance requires independence under both sets of standards (AT-C 105; ISAE 3000 paragraph 22(a); ISRE 2400 paragraph 21). Below it, the IAASB requires independence for neither related service (ISRS 4410 A21 for compilations), while the AICPA keeps it for agreed-upon procedures because they remain attestation. The compilation rules are in Compilation vs Review vs Audit under SSARS. The quick test: a reader who wants the practitioner's conclusion needs assurance; a reader who wants facts to judge for themselves needs agreed-upon procedures.

How CPA AUD and SOCPA Auditing ask it

CPA AUD places it in Area IV, Forming Conclusions and Reporting (10 to 20%), Group B, Reporting on attestation engagements, Topic 2, Agreed-upon procedures engagements. The 2026 Blueprint sets two tasks: identify the factors to consider when issuing the report (Remembering and Understanding), and determine its form and content (Application), the highest skill. The SSAEs with their interpretations and the AICPA Code are on AUD's reference list, and Area I applies the Code's independence framework, so the responsible-party rule is fair game.

SOCPA Auditing places it in subtopic 8/1 of main topic 8, Related services engagements (3 to 9% of the paper), beside compilations and forensic accounting services. The February 2026 guidance framework sets five tasks:

Task	Skill level
1. Determine the purpose before acceptance, and agree the terms in writing	Remembering and Understanding
2. Describe the nature, timing and extent of the procedures	Remembering and Understanding
3. Describe the procedures and findings, prescribed or not	Remembering and Understanding
4. Apply quality management requirements	Application
5. Perform the procedures, use an expert, report breaches of law to a party outside the entity, write the report	Application

The paper is 90 multiple-choice questions in three hours, then four essay questions in two; multiple choice carries 75 of the 100 marks, and a pass needs 60 overall with at least 5 of the 25 essay marks. Sitting both exams, keep one rule in front: "independent" in the title and a required independence statement are right under AT-C 215 and wrong under ISRS 4400 (Revised), unless the facts say independence was required or agreed.

One change is pending in the US: the AICPA's 2026 exposure drafts include conforming amendments to AT-C 215 that, if issued as final, apply to engagements beginning on or after 15 June 2029.

Where to practise this

Prepito's AUD course covers Area IV with practice questions and timed simulations in English, and the free AUD practice questions show the format; the section is mapped in the CPA AUD study guide, and the Code's wider rules are in AICPA covered members and independence rules. For the Fellowship, the Audit course has practice questions in Arabic and English, mapped in SOCPA Audit: syllabus, topics and a study plan. See also the CPA programme and the SOCPA Fellowship programme.

---

Sources: AICPA, AT-C sections 100 to 300 and SSAE No. 19; Journal of Accountancy on SSAE No. 19 and ET 1.297.020 and the 2026 proposals; IAASB, 2025 Handbook, Part IV; SOCPA, endorsement of ISRS 4400 (Revised), exam topics, guidance framework, 2026 examinations guide and structure and weights amendment; AICPA, CPA Exam Blueprints. AT-C paragraph numbers follow the AICPA's 2023 codification; the attestation standards are under revision and the Blueprint changes each edition, so confirm both for your testing window.