ASRS 4400

The assurance practitioner shall comply with this standard and with the terms of the engagement agreed with the engaging party.

When conducting an agreed-upon procedures engagement, the assurance practitioner shall comply with ethical requirements equivalent to the ethical requirements applicable to Other Assurance Engagements,^[4] including those pertaining to independence, unless the engaging party has explicitly agreed to modified independence requirements in the terms of the engagement.^[5]  If modified independence requirements have been agreed in the terms of the engagement, the level of independence applied shall be described in the report of factual findings.^[6] (Ref: Para. A1)

The assurance practitioner shall obtain an understanding of the needs and objectives of the intended users, including a class of intended users, of the assurance practitioner’s report of factual findings and the purpose for which that report will be used. (Ref: Para. A2-A3)

A regulator or representative of a class of users, industry or the accounting profession may specify the agreed-upon procedures to be performed to meet the needs of a class of intended users.  In these circumstances, the assurance practitioner shall be satisfied that the needs of the class of users for whom the engagement is intended have been appropriately considered and addressed.

Before accepting an agreed-upon procedures engagement, the assurance practitioner shall determine that the persons who are to perform the engagement collectively have the appropriate competence and capabilities to perform the procedures.

The assurance practitioner shall not accept an agreed-upon procedures engagement if, in the professional judgement of the assurance practitioner:

1. the provision of factual findings alone which provide no assurance is unlikely to meet the needs of the intended users; or (Ref: Para. A3)
2. the circumstances of the engagement indicate that the intended users are likely to construe the outcome of the engagement as providing an assurance conclusion about the subject matter; or
3. use of the report of factual findings cannot be restricted to the engaging party and any intended users identified, due to legal requirements or other circumstances; or
4. all of the elements of an assurance engagement^[7] are met; or (Ref: Para. A4-A6)
5. the engagement has no rational purpose; or
6. the circumstances of the engagement indicate that it will be necessary for the assurance practitioner to do any of the following:
   1. determine the sufficiency of the procedures to be performed; (Ref: Para. A7)
   2. perform a risk assessment in order to determine the procedures to be undertaken; (Ref: Para. A8)
   3. evaluate the findings in order to determine the sufficiency and appropriateness of the evidence gathered; (Ref: Para. A8) or
   4. reach a conclusion or form an opinion based on the evidence gathered. (Ref: Para. A8)

In order to establish whether the preconditions of an agreed-upon procedures engagement are present, the assurance practitioner shall obtain agreement from management [and, where appropriate, those charged with governance and intended users] that it acknowledges and understands its responsibility:

1. for determining the adequacy or otherwise of the procedures agreed to be performed;
2. for determining whether the factual findings reported, in combination with any other information obtained, provide an appropriate basis for any conclusions which management or the intended users wish to draw on the subject matter;
3. to provide the assurance practitioner with:
   1. access to all information of which management is aware that is necessary for the performance of the procedures agreed;
   2. additional information that the auditor may request from management for the purpose of the engagement; and
   3. unrestricted access to persons within the entity from whom the assurance practitioner requires co-operation in order to perform the procedures agreed.

The assurance practitioner shall agree the terms of the agreed-upon procedures engagement with the engaging party, and intended users who use the report.^[8] If the intended users of the report of factual findings are not signatories to the terms of the engagement, those intended users shall be identified in the terms of the engagement and all other parties shall be excluded from using the report. (Ref: Para. A9-A10)

The agreed terms of the engagement shall be recorded in an engagement letter or other suitable form of written agreement and shall include: (Ref: Para. A11-A13)

1. the objective and scope of the engagement;
2. confirmation of the assurance practitioner‟s acceptance of the appointment;
3. the nature of the engagement, including a statement that the procedures performed will not constitute a reasonable or limited assurance engagement and that accordingly no assurance will be provided;
4. a statement that intended users are expected to conduct their own assessment of the findings, combined with other information available to them and, if necessary, perform further procedures in order to obtain sufficient appropriate evidence on which to base any conclusion on the subject matter;
5. the assurance practitioner‟s responsibilities to the engaging party and other specified parties;
6. confirmation that the assurance practitioner will apply ethical requirements equivalent to those applicable to Other Assurance Engagements or, if modified independence requirements have been agreed, the level of independence agreed;
7. identification of the subject matter to which the procedures will be applied;
8. the nature, timing and extent of the specific procedures to be performed;
9. management‟s responsibilities;
10. identification of the intended users of the report including those users who may not be party to the terms of the engagement, such as a class of user, regulator or bank;
11. a statement that the use of the report of factual findings would be restricted to the engaging party, who has agreed to the procedures to be performed, and the intended users identified; and
12. reference to the expected form of any reports to be issued by the assurance practitioner, which may be illustrated by attaching to the engagement letter a draft of the report of factual findings that will be issued, omitting the factual findings.

The nature, timing and extent of procedures shall be specified in the terms of the engagement in sufficient detail such that the assurance practitioner will not be required, during the course of the engagement, to exercise professional judgement in determining or modifying the procedures to be performed. (Ref: Para. A11)

When conducting an agreed-upon procedures engagement, if the assurance practitioner is unable to perform the exact nature, timing or extent of procedures agreed, but alternative procedures can be performed and the engaging party requires those procedures to be performed, then new terms of the engagement shall be agreed with the engaging party in writing.

The assurance practitioner shall plan the work so that the engagement will be performed in an effective manner, in accordance with the terms of the engagement and this standard.

The engagement plan for an agreed-upon procedures engagement shall be restricted to the nature, timing and extent of procedures agreed in the terms of the engagement.  The plan does not include alternative or further procedures unless agreed with the engaging party in amended terms of the engagement. (Ref: Para. A14)

The assurance practitioner does not perform a risk assessment for an agreed-upon procedures engagement, as the nature, timing and extent of procedures to be performed are agreed with the engaging party rather than determined by the assurance practitioner in response to assessed risks.

The assurance practitioner does not apply materiality to designing the procedures to be performed nor to assessing the factual findings to determine whether the subject matter information is free from material misstatement or non-compliance, as this is the responsibility of the intended users.

The assurance practitioner shall take responsibility for the overall quality of the agreed-upon procedures engagement and shall apply the firm’s quality control procedures equivalent to those applicable to Other Assurance Engagements.^[5]

Throughout the engagement, the assurance practitioner shall remain alert, through observation and making enquiries as necessary, for evidence of non-compliance with relevant ethical requirements, including independence, by members of the engagement team.  If matters come to the assurance practitioner’s attention that indicate that members of the engagement team have not complied with relevant ethical requirements, the assurance practitioner shall determine the appropriate action.

The assurance practitioner shall be satisfied that the engagement team^[10] and any experts engaged who are not part of the engagement team, collectively have the appropriate competence, capabilities and resources to perform the agreed-upon procedures in accordance with this standard.

The assurance practitioner shall take responsibility for the direction, supervision and performance of the engagement and the accurate reporting of factual findings.

When the assurance practitioner uses the work of another assurance practitioner, internal auditor or an expert, the assurance practitioner shall evaluate the adequacy of their work, including their objectivity and technical competence in conducting the procedures, whether the nature, timing and extent of procedures conducted agrees with procedures in the terms of the engagement and whether the factual findings communicated detail adequately the result of the procedures conducted.

The assurance practitioner shall document:

1. issues identified with respect to compliance with relevant ethical requirements and how they were resolved;
2. conclusions on compliance with independence requirements equivalent to „Other Assurance Engagements‟ or modified independence agreed;
3. conclusions reached regarding the acceptance and continuance of client relationships and acceptance of the agreed-upon procedures engagement;
4. the nature, timing and extent of procedures performed and the factual findings obtained, as identified in the agreed-upon procedures report; and
5. evidence that the engagement was carried out in accordance with this standard and the terms of the engagement.

As no assurance is to be provided, the assurance practitioner shall carry out only the procedures agreed in the terms of the engagement and use the results of the procedures to provide a report of factual findings. (Ref: Para. A15-16)

If the engaging party’s requirements alter during the course of the engagement which require the assurance practitioner to draw conclusions from the findings, the terms of the agreed-upon procedures engagement cannot be extended to the provision of assurance.  However, a new engagement may be agreed for the provision of assurance, if appropriate, to be conducted in accordance with applicable AUASB standards.

The assurance practitioner shall provide a report of factual findings for the agreed-upon procedures engagement.  In contrast to an assurance report, a report of factual findings does not include an evaluation of those findings in order to draw a conclusion or form an opinion. (Ref: Para. A17)

The assurance practitioner shall not express a conclusion or opinion in an agreed-upon procedures engagement as the assurance practitioner has not performed a risk assessment, responded to assessed risks by determining the procedures to be performed or assessed whether sufficient appropriate evidence has been obtained as a reasonable basis for expressing a conclusion.

If the assurance practitioner is undertaking an agreed-upon procedures engagement in parallel with an assurance engagement, the factual findings from the agreed-upon procedures engagement shall be presented separately from the report on the assurance engagement.

Use of the report shall be restricted to those parties that have either agreed to the procedures to be performed or have been specifically included as intended users in the engagement letter since others, unaware of the reasons for the procedures, may misinterpret the results.

The report of factual findings for an agreed-upon procedures engagement shall contain: (Ref: Para. A18-A19)

1. a title;
2. an addressee (ordinarily the engaging party);
3. identification of the specific information to which the procedures have been applied;
4. a statement that the procedures performed were those agreed with the engaging party;
5. a statement that the engagement was performed in accordance with ASRS 4400;
6. a statement that either ethical requirements equivalent to those applicable to Other Assurance Engagements have been complied with, including independence, or, if modified independence requirements have been agreed in the terms of the engagement, a description of the level of independence applied;
7. identification of the purpose for which the agreed-upon procedures engagement was performed;
8. a statement that the responsibility for determining the adequacy or otherwise of the procedures agreed to be performed by the assurance practitioner is that of the engaging party;
9. a listing of the specific procedures performed, detailing the nature, timing and extent of each procedure;
10. a description of the assurance practitioner‟s factual findings in relation to each procedure performed, including sufficient details of errors and exceptions found;
11. identification of any of the procedures agreed in the terms of the engagement which could not be performed and why that has arisen;
12. a statement that the procedures performed do not constitute either a reasonable or limited assurance engagement and, as such, no assurance is provided;
13. a statement that had the assurance practitioner performed additional procedures, a reasonable assurance engagement or a limited assurance engagement, other matters might have come to the assurance practitioner‟s attention which would have been reported;
14. a statement that use of the report is restricted to those parties identified in the report, who have agreed to the procedures to be performed or were identified in the terms of the engagement;
15. a statement (when applicable) that the report relates only to the elements, accounts, items or financial and non-financial information specified and that it does not extend to the entity‟s financial report, or other specified report, taken as a whole;
16. the date of the report;
17. the assurance practitioner‟s address; and
18. the assurance practitioner‟s signature.

If the assurance practitioner is required by law or regulation to use a specific layout or wording for the report of factual findings, the report of factual findings shall refer to ASRS 4400 only if the assurance practitioner’s report includes, at a minimum, each of the elements in paragraph 43.

Law or regulation of the relevant jurisdiction may prescribe the layout or wording of the report of factual findings in a form or in terms which are significantly different from the requirements of this standard. In these circumstances, the assurance practitioner shall evaluate:

1. whether intended users might misunderstand the factual findings reported and the fact that no assurance is provided; and, if so;
2. whether additional explanation in the report of factual findings can mitigate possible misunderstanding.

If the assurance practitioner considers that additional explanation in the report of factual findings cannot mitigate possible misunderstanding, the auditor shall not accept the engagement unless required by law or regulation to do so. As an agreed-upon procedures engagement conducted in accordance with such law or regulation does not comply with this standard, the assurance practitioner shall not include any reference in the report of factual findings to the engagement having been conducted in accordance with ASRS 4400. (Ref: Para. A20)

The assurance practitioner shall not issue modifications or an emphasis of matter in a report of factual findings, as no conclusion or opinion is expressed. Nevertheless, the following matters, if applicable, are reported as part of the factual findings:

1. errors or exceptions identified as a result of the procedures performed, regardless of whether they were subsequently rectified by the entity; and (Ref: Para. A21)
2. the inability of the assurance practitioner to perform any of the agreed-upon procedures. (Ref: Para. A22)

The report of factual findings for an agreed-upon procedures engagement shall be clearly distinguished from an assurance report in that it shall not contain:

1. a statement of compliance with AUASB standards, except for reference to ASRS 4400;
2. inappropriate use of the terms “assurance”, “audit”, “review”, “opinion” or “conclusion”; or
3. any statement that could reasonably be mistaken for a conclusion designed to enhance the degree of confidence of intended users about the outcome of the evaluation or measurement of a subject matter against criteria.^[11]

(Ref: Para. 17)

Ethical requirements, applicable to Other Assurance Engagements, permit the independence requirements to be modified, if the intended users of the assurance practitioner’s report are knowledgeable as to the purpose, subject matter information and limitations of the report and explicitly agree to the application of the modified independence requirements.  In these circumstances, the report is to include a restriction on use to the intended users only, which is already included in the report of factual findings.  If modified independence requirements are adopted in the terms of the engagement, but the intended users include a class of users who are not party to the terms of the engagement, they are required to be made aware of the modified independence requirements, such as by reference to them in the report of factual findings.  In any case, the independence of the assurance practitioner and the engagement team will need to be assessed.

(Ref: Para. 18-22)

The assurance practitioner needs to understand the engaging party’s objectives in engaging the assurance practitioner to ensure that an engagement is agreed which is appropriate to those objectives and to avoid any misunderstandings with respect to the scope of the engagement.

In determining whether a report of factual findings is likely to meet the needs of intended users, or class of intended users, of the report, the assurance practitioner considers the purpose for which users intend to use the report.  In doing so, the assurance practitioner, does not take responsibility for the sufficiency of the agreed-upon procedures to be performed to meet the needs of intended users.  If intended users are likely to be able to interpret the factual findings resulting from procedures performed, whether alone or in combination with other available evidence, to reach appropriate conclusions, then an engagement to report factual findings may be acceptable.  If intended users are unlikely to be able to interpret the factual findings to reach appropriate conclusions, then the assurance practitioner does not accept an agreed-upon procedures engagement, but may accept an assurance engagement if appropriate.

An agreed-upon procedures engagement may be accepted if it satisfies some but not all of the elements of an assurance engagement,^[12] with the exception of a written assurance report, as that requires the provision of assurance.

If all of the elements of an assurance engagement are met,^[13] the assurance practitioner declines an agreed-upon procedures engagement, however an assurance engagement may be accepted if appropriate and applicable AUASB standards are applied.  Appendix 1 provides a table of Differentiating Factors between Agreed-Upon Procedures Engagements and Assurance Engagements to assist the assurance practitioner in determining whether the engagement is an agreed-upon procedures engagement or an assurance engagement.

The extent of the subject matter does not affect whether an engagement is an assurance engagement or not. Even if the subject matter of an engagement is very specific, when the engagement contains the elements of an assurance engagement, the assurance practitioner complies with the requirements of either:

1. ASA 805 Special Considerations - Audits of Single Financial Statements and Specific Elements, Accounts or Items of a Financial Statement when providing reasonable assurance on historical financial information other than a financial report;
2. ASA 2405 Review of Historical Financial Information Other than a Financial Report when providing limited assurance on historical financial information other than a financial report; or
3. ASAE 3000 Assurance Engagements Other than Audits or Reviews of Historical Financial Information when providing reasonable or limited assurance on matters other than historical financial information.^[14]

Example engagements are described in Appendix 2 illustrating how an engagement could be scoped as an agreed-upon procedures engagement or an assurance engagement for the same subject matter.

The assurance practitioner may assist the engaging party and intended users in determining the procedures to be performed to ensure that the procedures are able to be performed and are likely to meet the needs of the intended users.  Nevertheless, the assurance practitioner is not responsible for the adequacy of the agreed-upon procedures nor for assessing whether the findings will be sufficient either alone or in combination with other evidence to support any conclusions which the users intend to draw.  The assurance practitioner’s role in an agreed-upon procedures engagement is to use their professional competence and capabilities in the performance of the agreed-upon procedures and to report the findings accurately.

If it is necessary for the assurance practitioner to perform a risk assessment, respond to assessed risks or evaluate the evidence gathered, then this indicates that the assurance practitioner is using their professional judgement to gather sufficient appropriate evidence to support a conclusion.  In these circumstances, the engagement may be an assurance engagement and, if so, the relevant requirements in the AUASB standards need to be applied.

(Ref: Para. 23-26)

The agreed terms would ordinarily be recorded in an engagement letter or other suitable form of written agreement. It is in the interests of both the engaging party and the assurance practitioner that the assurance practitioner sends an engagement letter, preferably before the commencement of the engagement, to help in avoiding misunderstandings with respect to the engagement.

In certain circumstances, for example when the procedures have been agreed to between the regulator, industry representatives and representatives of the accounting profession, the assurance practitioner may not be able to discuss the procedures with all the intended users who will use the report of factual findings. In such cases, the assurance practitioner may consider, for example, discussing the procedures to be applied with appropriate representatives of the intended users, reviewing relevant correspondence from such users or sending them a draft of the report of factual findings that will be issued.

In an agreed-upon procedures engagement, as the assurance practitioner does not express a conclusion, it is the engaging party’s responsibility to determine the procedures which will provide sufficient appropriate evidence to support their own or intended users’ conclusions.  It is only appropriate for the assurance practitioner to select the procedures if they will be assessing the evidence to support a conclusion provided in an assurance engagement.

Not all intended users may be available to agree to the terms of the engagement or the agreed-upon procedures to be performed. These intended users may still be specified in the letter of engagement where the assurance practitioner is satisfied that those users will understand the purpose for which the report of factual findings is intended to be used. These intended users may include:

1. regulators or industry bodies which issue requirements for procedures to be performed and factual findings to be reported; and
2. an identifiable class of users which are intended to receive the report of factual findings for a specified purpose.

An example of an engagement letter for an agreed-upon procedures engagement is set out in Appendix 3.

(Ref: Para. 27-28)

Planning in an agreed-upon procedures engagement is restricted by the nature, timing and extent of procedures as agreed in the terms of the engagement.  Therefore, the assurance practitioner does not have the discretion to perform alternative or additional procedures without obtaining the engaging party’s agreement.  Nevertheless, the assurance practitioner will still need to plan the nature, timing and extent of the resources necessary to perform the engagement.

(Ref: Para. 37-38)

The procedures applied in an engagement to perform agreed-upon procedures may include:

1. inspection;
2. observation;
3. external confirmation;
4. re-calculation;
5. re-performance;
6. analytical review procedures, where those procedures are based solely on comparison against expectations defined in the terms of the engagement; and
7. enquiry.

Analytical procedures are not performed in an agreed-upon procedures engagement unless the engaging party provides an expectation of recorded amounts or ratios on which the assurance practitioner may base the analytical procedures.  The engaging party’s expectations are defined in the procedures described in the terms of the engagement.  It is necessary for the engaging party to provide the expectations as a basis for the analytical procedures so that the assurance practitioner does not use their professional judgement to develop expectations, which is only appropriate when conducting an assurance engagement.  The assurance practitioner does not interpret the findings from the analytical procedures but simply presents the findings against the expectations provided by the engaging party.

(Ref: Para. 39-47)

Even though assurance is not provided by the assurance practitioner, the intended users are entitled to rely on the accuracy of the reported findings by virtue of the assurance practitioner’s capabilities and competence in conducting the agreed-upon procedures.

The report of factual findings needs to describe the procedures performed and findings in sufficient detail to enable the intended users to understand the nature, timing and extent of the work performed as well as the nature of the errors and exceptions identified in order to assess the findings reported and draw their own conclusions on the subject matter.  In order to draw conclusions, intended users may need to assess the factual findings along with information from other sources.  Intended users will need to satisfy themselves that the evidence, which the report of factual findings and other sources provide, is sufficient and appropriate to provide a basis for any conclusion which they may reach.

An illustrative report of factual findings, incorporating the elements set forth in paragraph 43, is set out in Appendix 4.

If the law or regulation prescribes the layout or wording of the assurance practitioner’s report in a form or in terms that are significantly different from the requirements of this standard and an additional explanation cannot mitigate possible misunderstanding, in addition to excluding any reference to this standard in the report, the assurance practitioner may consider including a statement that the agreed-upon procedures engagement is not conducted in accordance with this standard.

If the assurance practitioner is aware that an error or exception identified has been substantially rectified, the fact that it has been rectified may be included in the report.

The assurance practitioner's inability to perform the agreed-upon procedures may arise from:

1. circumstances beyond the control of the engaging party;
2. circumstances relating to the nature or timing of the assurance practitioner's work; or
3. limitations imposed by management of the engaging party.