Buying agreed-upon procedures: write the question and procedures precisely

An agreed-upon procedures engagement can fit a defined question about specific records. Describe the intended use and the population before discussing a fee. For example, a counterparty may want specified invoice amounts compared with an agreed schedule. The company needs to know whether those particular findings will answer the counterparty's question.

AICPA's SSAE No. 19 describes an engagement that reports findings from specific procedures without an opinion or conclusion. The engaging party acknowledges that the procedures are appropriate for the intended purpose. Discuss the currently applicable standards with the practitioner and keep the purchasing brief consistent with the report actually being commissioned.

A request to check the accounts leaves too much unspecified. Ask the practitioner to explain the record examined, action performed, comparison criterion and treatment of exceptions. Specify whether the work covers the full population or a selected sample. A report user should understand the procedure without guessing what the practitioner meant by review.

The following examples illustrate purchasing questions, not prescribed professional procedures. Have the practitioner determine what is suitable and permissible for the intended engagement. If the purpose changes while procedures are being developed, revisit the brief before work proceeds.

Where a lender, investor or contracting party requested the work, ask it to review the proposed procedures early. Its interests may differ from management's. Avoid buying a convenient set of checks only to discover that the recipient needed another population or different evidence. Obtain the necessary agreement through the practitioner rather than inventing a substitute approval process.

Clarify permitted distribution and the report's stated purpose. The same findings may have limited usefulness for someone making a different decision. Tell the practitioner if you expect additional recipients or publication, and ask whether the proposed engagement supports that use. Do not present the result as a broad certification of the business.

Ask what happens if records are missing, the population is larger than expected or the first procedures reveal differences. Reporting an exception is different from investigating its cause or correcting the records. Specify whether those additional activities are included and which need separate authorization.

Require the provider to identify any work that would change the nature of the engagement. Management may want recommendations after receiving factual findings; discuss whether that is a separate consulting assignment. Keep its outputs distinguishable so users can tell which statements are procedure findings and which are professional advice.

Include client preparation tasks, expected evidence formats and a realistic question-response process. If the population changes during the assignment, preserve the agreed version and document the revision. Otherwise the final report can answer a different question from the one the buyer believed it had authorized.

Review whether every agreed procedure has a corresponding result and whether limitations are visible. Check that the population, dates and intended use match the final engagement. Ask the practitioner to explain any proposed change before treating the report as complete.

Management and the intended users then decide what the findings mean for their purposes. If further investigation is needed, commission it explicitly with the findings as the starting evidence. Keep the original report intact so later interpretation does not overwrite what the practitioner actually performed and observed.