Agreed-upon procedures (ISRS 4400) - Restriction of use and ...

Learning Outcomes

After reading this article, you should be able to:

• Explain the purpose and structure of ISRS 4400 Agreed-upon procedures engagements.
• Identify why such reports must include restriction of use and distribution clauses.
• Recognize the risks and practical implications of misuse if reports reach unintended users.
• Apply these requirements to exam scenarios and justify appropriate report wording.

ACCA Audit and Assurance (AA) Syllabus

For ACCA Audit and Assurance (AA), you are required to understand the regulatory and practical framework of agreed-upon procedures (AUP) under ISRS 4400, focusing on engagement scope, reporting, and user limitations. This article is relevant to:

• The definition and key features of agreed-upon procedures engagements (ISRS 4400).
• Responsibilities regarding report wording, especially restriction of use and distribution.
• The difference between AUP, audit, and other assurance reports.
• The consequences of misuse by unintended parties and the reason for restricted circulation.
• How to apply, identify, and justify restriction requirements in exam scenarios.

Test Your Knowledge

Attempt these questions before reading this article. If you find some difficult or cannot remember the answers, remember to look more closely at that area during your revision.

1. State one key reason why agreed-upon procedures (AUP) reports include a restriction of use clause.
2. Who are “intended users” in an AUP engagement, and why is this distinction important for report distribution?
3. True or false? An AUP report provides assurance to any party who obtains a copy, regardless of their involvement in drawing up the procedures.
4. Which of the following should you include in an AUP report (per ISRS 4400):
   a) Auditor’s opinion on subject matter
   b) Detailed factual findings
   c) Restriction of use/distribution clause
   d) General recommendation for all readers

Introduction

Agreed-upon procedures (AUP) engagements are a type of non-assurance service where the practitioner performs specific procedures, agreed with the engaging parties, and reports only factual findings without providing an opinion or conclusion.

Because no assurance is given and procedures are tailored for a specific user group, strict restrictions are required on who can rely on or use the report. ISRS 4400 mandates that AUP reports must warn that only the parties who agreed to the procedures—and for whom the report was prepared—may use and interpret the results. Others, not privy to the engagement terms and the scope’s limitations, could easily misinterpret or misuse the information.

Purpose and Scope of Agreed-upon Procedures (AUP)

AUP engagements allow a client and practitioner to agree exactly which procedures are to be carried out and to receive a report of objective factual results only—no assurance or professional opinion is offered.

Key Term: Agreed-upon procedures engagement
An assignment in which a practitioner performs specific procedures agreed with the engaging party and reports factual findings, with no assurance or opinion provided.

The practitioner’s responsibility is to perform only those procedures, as specified, and to report accurately and objectively.

Importance of Restricting Use and Distribution

AUP reports are not assurance reports. The findings are limited to what was done and observed—no interpretation or wider judgement is provided. Therefore, if someone outside the intended user group reads the report, they may misunderstand its purpose, limitations, or scope, and falsely conclude that assurance (or an audit opinion) has been given.

Key Term: Restriction of use clause
A required statement in an AUP report specifying that its content is intended only for the parties who agreed to the procedures and should not be distributed or relied upon by others.

Key Term: Intended users
Individuals or organizations who agree on the procedures to be performed and the subject of the AUP engagement, as identified in the engagement letter and report.

Factual Finding Reports vs Assurance Reports

Unlike audit or review reports, which provide reasonable or limited assurance and may have a much broader audience, an AUP report is specific to parties who commissioned it. Wording prescribed by ISRS 4400 makes it clear that no opinion or conclusion is expressed and that findings are not to be interpreted as any form of assurance. Including a clear restriction of use is mandatory to prevent misunderstanding by third parties.

Worked Example 1.1

Scenario: A supplier requests an AUP engagement where the practitioner will test the company’s inventory quantities as at year-end, performing procedures requested by a lender who will fund the supplier’s short-term loan.

Question: How should the resulting report restrict use and why?

Answer:
The AUP report should clearly state that the findings are for the exclusive information of the supplier and the lender who specified the procedures. This is because only those two parties agreed to the nature and extent of procedures performed and understand their sufficiency or limitations. Distribution to others could result in misunderstanding, as the work was not designed for the needs of any other party.

Key ISRS 4400 Requirements on Restriction

ISRS 4400 requires that every AUP report—regardless of subject matter—must:

• Name the parties who agreed the procedures and to whom the report is addressed.
• Include a clear restriction on use and distribution, typically stating that the report is not intended for (and should not be used by) parties other than those who agreed to the procedures.
• Make clear that no assurance is expressed and that only facts are reported.

This aligns with ethical duties of clarity and professional behavior.

Worked Example 1.2

Scenario: A client commissions agreed-upon procedures for specific payroll calculations, which the auditor performs and reports as required by ISRS 4400.

Question: If the client circulates the AUP report to shareholders, what risk does this create, and how does the restriction of use protect against it?

Answer:
Shareholders, not party to the original engagement, may mistakenly interpret the factual findings as assurance on payroll integrity, when in fact only specific, limited checks were performed. The restriction of use clause aims to prevent such users from relying on the report or misinterpreting its scope, thus reducing the risk of legal liability or claims against the practitioner.

Why Restriction is Critical

The reason for such restrictive clauses is that, without them, any third party obtaining the report could assume the work meets their decision-making needs or equates to an assurance engagement. This can lead to:

• Misinterpretation of the procedures or findings.
• Unjustified reliance or legal claims.
• Potential reputational damage to the practitioner if unintended users act on misunderstood findings.

Practical Wording Required in Reports

A typical report includes:

“This report is intended solely for the information and use of [the engaging party and named users] who have agreed to the procedures described, and is not intended to be, and should not be, used by anyone other than these specified parties.”

If someone not named in the report reads or receives it, the practitioner can point to the clause to clarify that the report was not designed for them—protecting all parties from inappropriate reliance.

Exam Warning

Many students confuse AUP factual finding reports with assurance or audit reports. Remember:

• There is NO assurance given in an AUP engagement.
• The report MUST restrict use to only those who agreed the procedures.
  Confusing these points is a frequent exam error.

Summary

In ISRS 4400 agreed-upon procedures engagements, practitioners only report facts derived from specifically agreed work for named parties. The report’s use and distribution must be restricted because:

• Only those parties agreed the work’s scope and understand its limitations.
• No assurance—reasonable, limited, or otherwise—is provided.
• Wider distribution could result in misinterpretation or inappropriate reliance, with associated risks for all involved.

ISRS 4400 prescribes mandatory restriction wording for all AUP reports. Understanding this is essential to answer related ACCA AA questions and to draft or evaluate such reports in practice.

Key Point Checklist

This article has covered the following key knowledge points:

• Define agreed-upon procedures engagements and distinguish from assurance engagements.
• Explain the necessity for restricting use and distribution of AUP reports.
• Identify intended users and understand their significance in the report context.
• Recognize the mandatory nature of the restriction of use clause under ISRS 4400.
• Apply knowledge to scenario-based questions about misuse of reports and unintended reliance.

Key Terms and Concepts

• Agreed-upon procedures engagement
• Restriction of use clause
• Intended users