AT-C Section 215: Agreed-Upon Procedures
Explore how AT-C 215 guides engagements focused on delivering objective findings from specific procedures, without providing assurance or expressing an opinion.
An agreed-upon procedures (AUP) engagement is a service where a practitioner is hired to perform specific procedures and report the resulting findings, and is distinct from an audit or a review. The primary guidance for these engagements in the United States is AT-C Section 215 of the Statement on Standards for Attestation Engagements (SSAEs), issued by the American Institute of Certified Public Accountants (AICPA).
The defining characteristic of an AUP engagement is its focus on factual results. The practitioner performs procedures agreed upon with the client and reports on the findings without offering any assurance, opinion, or conclusion. This means the practitioner does not state whether the subject matter is presented fairly or in conformity with any criteria. The report presents the procedures performed and the objective results, leaving interpretation to the users of the report.
Recent updates to the standards have introduced more flexibility into these engagements, making them more practical and useful in a wider variety of circumstances. The standards continue to evolve, with further amendments effective for engagements from December 15, 2025. These changes are designed to align AUP engagements with new quality management standards and revise performance and reporting requirements related to the involvement of other practitioners.
Conditions for Engagement Acceptance
Before a practitioner can accept an AUP engagement, several conditions must be met. A primary requirement is the practitioner’s independence from the client and the subject matter of the engagement. This independence ensures that the practitioner’s findings are objective and free from bias, although exceptions may exist if an engagement is required by law or regulation.
A precondition is the mutual agreement on the procedures to be performed. The practitioner and the engaging party must have a clear understanding of the exact steps to be taken, which must be specific and not subject to interpretation. The subject matter itself must also be suitable, meaning it can be consistently measured or evaluated against established criteria, allowing for objective findings.
The responsibility for the procedures rests with the engaging party. Before the practitioner issues the report, the engaging party must acknowledge that the procedures are appropriate for their intended purpose. This requirement is a change from older standards, which required users to take responsibility for the sufficiency of the procedures, and was designed to make AUP engagements more flexible.
The terms of the engagement must be formalized in an engagement letter or similar contract. This written agreement documents the procedures to be performed, the subject matter, the criteria to be used, and the acknowledgment of the engaging party’s responsibility. Recent standards allow for procedures to be developed or modified during the engagement, as long as the engaging party agrees to the final set of procedures before the report is issued.
Performing the Agreed-Upon Procedures
Once the engagement is accepted, the practitioner executes the agreed-upon procedures. The practitioner must follow the exact steps outlined in the engagement letter or subsequent written agreements. Examples of such procedures include inspecting specific documents for certain attributes, confirming details like account balances with third parties, or performing mathematical recalculations on provided data.
The practitioner must adhere to the agreed-upon scope and is not permitted to deviate from the specified procedures. If a procedure cannot be performed for any reason—for instance, if a requested document does not exist—this fact must be clearly documented. The inability to perform a procedure is a finding that is reported to the engaging party.
Throughout the process, the practitioner’s role is to gather evidence and document the factual results of each procedure. The findings must be objective and free of personal judgment, opinion, or conclusion. For example, if a procedure is to check a sample of invoices for proper authorization signatures, the finding would state how many had the required signature, without speculating on the reason for any discrepancies. This documentation forms the basis of the final report.
The Practitioner’s Report
The final deliverable of an AUP engagement is the practitioner’s report, which has a specific structure and content mandated by professional standards. The report’s title must include the word “independent” and be addressed to the engaging party. It begins by identifying the subject matter and the specific procedures that were performed as agreed upon by the parties.
The report contains statements that clarify the roles and responsibilities of the parties. It explicitly states that the engaging party is responsible for the appropriateness of the procedures for their purposes. It also outlines that the practitioner’s responsibility was limited to performing those agreed-upon procedures and reporting the resulting findings.
The core of the document is the detailed listing of the procedures and the corresponding findings. For each procedure outlined in the engagement agreement, the report presents the objective, factual results that were found. This section is a direct presentation of the evidence gathered, without interpretation or analysis.
The report must include a prominent statement clarifying the level of assurance provided—which is none. The practitioner must state that the engagement was not an audit or a review and, therefore, no opinion or conclusion is expressed. This “no assurance” declaration is a protection for both the practitioner and the users of the report, ensuring there is no misunderstanding about the nature of the service rendered.
A change introduced by recent standards relates to the report’s distribution. Previously, AUP reports were required to be restricted to specified parties. However, current standards now permit the practitioner to issue a general-use report, allowing findings to be shared more broadly. The practitioner can still choose to restrict the report’s use if necessary, but the option for general use makes AUP engagements more versatile.