Agreed-upon procedures under ISRS 4400
How a firm runs an agreed-upon procedures engagement under ISRS 4400 (Revised), from agreeing procedures to a report of findings with no opinion.
By Achekam · · 4 min read · For Accountants & audit firms in South Africa, Nigeria, Kenya
A development funder writes to your client, a community organisation, asking for "an audit of the grant expenditure". Read the letter closely and the funder does not want an opinion on anything. It wants someone independent to check that each payment over a certain size was supported by an invoice, approved by two signatories and charged to an eligible budget line, and to say what they found.
That is not an audit. It is an agreed-upon procedures engagement, and it is one of the most useful services a firm can offer when a client or a third party wants specific facts checked rather than an overall conclusion. Run under ISRS 4400 (Revised), it gives the user exactly the information they asked for, and gives the firm a scope it can control.
This article walks through such an engagement and how to set it up in Achekam.
Procedures, not an opinion
In an agreed-upon procedures engagement, the practitioner performs procedures that have been agreed with the engaging party and reports the factual findings. There is no opinion and no assurance conclusion. The users of the report draw their own conclusions from the findings.
Typical uses include:
- a funder or grantor checking how a grant was spent;
- a lender checking a covenant calculation;
- a franchisor checking a franchisee's royalty statement;
- a regulator or industry body asking for specific figures to be checked.
The IAASB's page on ISRS 4400 (Revised) describes the standard for agreed-upon procedures engagements, which are often used to report to funders, grantors and regulators.
The first professional task is often to recognise the engagement for what it is. When a letter asks for an "audit" but describes specific checks, explain the difference to the client and, through them, the third party. Agreeing to an audit when the user wants procedures wastes everyone's money; agreeing to procedures when the user needs assurance leaves them without what they need.
Agreeing the procedures and the intended users
The heart of the engagement is the list of procedures, and it must be agreed before work starts.
Good procedures are specific, objective and capable of producing a factual finding. Compare:
| Vague | Specific |
|---|---|
| Review the grant expenditure | For each payment above the agreed amount, inspect the supplier invoice and note whether its amount agrees to the payment |
| Check approvals are adequate | For each such payment, inspect the payment authorisation and note whether it bears two signatures from the authorised list |
| Confirm costs are eligible | Compare the account each payment is charged to with the budget lines in the grant agreement, and list any that do not match |
Terms such as "review", "verify" or "adequate" invite the reader to believe more was done than was. Agree the wording that describes what will actually be done.
The terms of engagement should also record who the intended users are, the purpose of the engagement, the subject matter, the procedures, and whether the practitioner is required to be independent. The engagement letter is where all of this is pinned down.
Performing each procedure with evidence
Each procedure is performed as agreed and documented so that another practitioner could see what was done and what was found.
In Achekam, each work item lists the procedures to perform and the documents required. A step is marked done only with a written response and its documents, or set aside with a reason, and steps are never deleted. For agreed-upon procedures that structure fits naturally: enter each agreed procedure as a step, and record the finding and the evidence against it.
Two habits help. Record exceptions exactly, with enough detail for the user to understand them. And if a procedure cannot be performed as agreed, because records are missing for instance, do not quietly substitute a different one. Go back to the engaging party and agree any change in writing.
Reporting factual findings
The report describes the procedures and the factual findings, and makes clear that no opinion or assurance conclusion is expressed. It should not contain words that suggest assurance, and the findings should be stated plainly: "In two of the payments inspected, the invoice amount did not agree to the payment."
Where a finding is an exception, list it rather than summarise it away. The user agreed the procedures precisely so that they could judge the exceptions for themselves.
Setting up the engagement in Achekam
When creating an engagement, staff choose its type, and a firm can add its own named types. If agreed-upon procedures is not among the types the firm uses, add it, so these engagements can be found and reported on separately from audits and reviews.
Achekam also ships working-paper template packs written in its own words, including packs for ISRS 4400 and ISRS 4410, for a firm to adopt and approve. The catalogue is marked as unapproved platform content until the firm adopts it, so have the technical partner review the pack against the firm's methodology before use.
For the engagement letter, AI can draft clauses, never fees, and a person saves the draft. Achekam will not send a letter whose wording breaks the professional guardrails; for audits and reviews it also waits for a partner's review. An agreed-upon procedures letter carries its own risks, chiefly an unclear scope, so the firm may sensibly require a partner to read it too. Once ready, the letter can be prepared for e-signature, with the client signing from an e-mailed link without an Achekam account.
Related engagements
Agreed-upon procedures sit beside other related services and assurance work. If the client needs financial statements prepared rather than checked, see compilation engagements under ISRS 4410. If the third party does need a conclusion, an assurance engagement may fit; assurance engagements under ISAE 3000 explains the difference.
Next time a client forwards a request for an "audit" of a grant or a calculation, read it for the procedures it actually describes before quoting.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
