Agreed-Upon Procedures:
Applying SAS No. 75 and SSAE No. 4

By Thomas A. Ratcliffe

The conventional wisdom for practioners is to focus on the users of their reports, while limiting risk of legal liability. In the past that has not always been achievable. The Auditing Standards Board has found an answer through the use of agreed-upon procedures engagements under both the auditing standards and the attestation standards. The liability exposure no longer exists for what the practioner should have done but failed to do. The risk is reduced to whether he or she performed the procedures asked to be preformed.

In September 1995, the Auditing Standards Board issued two documents that will allow practitioners to participate in limited risk and limited liability agreed-upon procedures engagements. Statement on Auditing Standards (SAS) No. 75, Engagements to Apply Agreed-Upon Procedures to Specified Elements, Accounts, or Items of a Financial Statement, supersedes SAS No. 35, Special Reports‹Applying Agreed-Upon Procedures to Specified Elements, Accounts, or Items of a Financial Statement. Statement on Standards for Attestation Engagements (SSAE) No. 4, Agreed-Upon Procedures Engagements, extends the applicability of attestation standards to circumstances where the practitioner is engaged to apply agreed-upon procedures to a written assertion provided by the client where that written assertion does not relate to a financial statement element, account, or item (hereinafter, a financial statement component).

Limited Risk Engagements

An agreed-upon procedures engagement is one in which a practitioner is engaged by a client to issue a report on procedures and findings based on specific procedures performed related to a financial statement component or other written assertion provided by the client. A major advantage of engagements performed under SAS No. 75 and SSAE No. 4 is that practitioners will be able to accept engagements that will accomplish specific client objectives while, simultaneously, limiting engagement risk and the potential for liability related to the engagements. It is expected these engagements will have widespread applicability in practice.

Responsibility for Procedures. The primary way SAS No. 75 and SSAE No. 4 limit engagement risk relates to who takes responsibility for the sufficiency of the agreed-upon procedures. Under SAS No. 35, the requirement was that the parties involved have a clear understanding of the procedures to be performed. Further, SSAE No. 2, Reporting on an Entity's Internal Control Structure Over Financial Reporting, provided limited guidance on agreed-upon-procedures engagements and was silent regarding responsibility for the sufficiency of the procedures. And, SSAE No. 3, Compliance Attestation, indicated that specified users should take responsibility for adequacy of the procedures in agreed-upon procedures engagements.

To satisfy the requirements of SAS No. 75 and SSAE No. 4, the practitioner and the specified users agree on procedures to be performed and the users take responsibility for the sufficiency of the agreed-upon procedures for their purposes. Ordinarily, the practitioner and the specified users should communicate directly concerning these procedures and each of the specified users should provide an acknowledgment that the procedures are sufficient. When it is not practical to communicate directly with all specified users, the practitioner may satisfy this requirement by comparing procedures to be applied to written requirements of the specified users, discussing the procedures to be applied with appropriate representatives of the specified users, and/or reviewing relevant contracts with, or correspondence from, the specified users.

Since specified users take responsibility for the sufficiency of the agreed-upon procedures, much of the risk in these type engagements has been shifted from the practitioner to the users. The practitioner's responsibility is to carry out the procedures and report findings. The practitioner retains the responsibility related to risk that misapplication of the procedures may result in inappropriate findings being reported. Practitioners may reduce this risk by appropriate planning and supervision and the exercise of due professional care in performing the procedures, determining findings, and reporting findings.

"Negative Assurance" Prohibited. Another major change in the technical literature that reduces risk in agreed-upon procedures engagements relates to the prohibition against providing "negative assurance" in these engagements. The SAS No. 35 report typically included wording such as "no matters came to our attention that caused us to believe that the [specified elements, accounts, or items] should be adjusted." New, more restrictive, wording now has been substituted into the reports that indicates that "no exceptions were found" as a result of applying the procedures.

Restricted to Specified Users. All agreed-upon procedures engagements conducted under SAS No. 75 and SSAE No. 4 will have the resultant report restricted to specified users. If it becomes necessary to add to the list of specified users, any additional users also should acknowledge responsibility for the sufficiency of procedures performed. Since the report is restricted to use only by those who explicitly have taken responsibility for the agreed-upon procedures, practitioners minimize the likelihood the report will be used for purposes other than those for which it was intended.

Applicability of Pronouncements

SAS No. 75 and SSAE No. 4 should be utilized by practitioners in agreed-upon procedures engagements but are not applicable to the following engagements under circumstances where the practitioner (Exhibit 1 summarizes the applicability of these pronouncements)‹

* reports on specified compliance requirements based solely on an audit of financial statements; in these engagements, the provisions of SAS No. 62, Special Reports, should be followed.

* reports on compliance in governmental engagements; in these engagements, the provisions of SAS No. 74, Compliance Auditing Considerations in Audits of Governmental Entities and Recipients of Governmental Financial Assistance, should be followed.

* is requested to apply substantive procedures to user transactions or assets at a service organization and reference is made in the audit report to having carried out designated procedures; in these engagements, the provisions of SAS No. 70, Reports on the Processing of Transactions by Service Organizations, should be followed.

* is requested to issue a letter for underwriters (commonly referred to as a "comfort letter"); in these engagements the provisions of SAS No. 72, Letters for Underwriters and Certain Other Requesting Parties, should be followed.

Further, for SSAE No. 4 engagements, the client is required to provide a written assertion that is capable of reasonably consistent estimation or measurement. In contrast, under an SAS No. 75 engagement, financial statement components implicitly or explicitly contain the assertion(s) to be tested by the practitioner. The financial statement components may be presented in a schedule or statement or in the practitioner's report, appropriately identifying what is being presented and the point in time or the time period covered.

SSAE No. 4 engagements cannot be performed when a written assertion is not provided by the client. However, the practitioner may be able to provide certain nonattest services involving advice or recommendations to the client. In these circumstances, the practitioner should refer to guidance provided in Statement on Standards for Consulting Services, Consulting Services: Definitions and Standards. Further, certain other professional services do not constitute attestation services under paragraph 2 of SSAE No. 1, Attestation Standards. Examples of these nonattest services include serving as an advocate for a client's tax position, preparation of tax returns and providing tax advice, compilation of financial statements, etc.

Examples of assertions where SSAE No. 4 would be applicable include‹

* a narrative description about an entity's compliance with requirements of specified laws, regulations, rules, contracts, or grants during a specified period (SSAE No. 3 provides additional guidance).

* a representation by management that all investment securities owned by an entity during a specified period were traded on one or more of the markets specified in the entity's investment policy.

* a statement that the documentation of employee evaluations included in personnel files as of a certain date is dated within the time frame set forth in the entity's personnel policy.

Examples of assertions where SAS No. 75 might be applicable include‹

* the cash accounts, as of a certain date, are represented as being in accordance with generally accepted accounting principles.

* a schedule of accounts receivable of an entity is represented to reflect accounts receivable presented in conformity with generally accepted accounting principles.

* the amounts included in the caption "property and equipment" are represented to be presented on an income-tax basis.

* the gross income component of a statement of operations is represented to be presented in accordance with the rules of a regulatory agency.

Conditions for Acceptance

Before accepting an engagement to issue a report under SAS No. 75 or SSAE No. 4, the following conditions must be met:

* The practitioner should be independent.

* In SSAE No. 4 engagements, the client should provide a written assertion to the practitioner prior to the issuance of the report (as noted earlier, in SAS No. 75 engagements the assertion is embodied in the financial statement component and no written assertion is necessary).

* The practitioner and the specified users of the report have agreed upon procedures to be performed by the practitioner.

* The specified users take responsibility for the sufficiency of the agreed-upon procedures.

* The specified subject matter to which the procedures are to be applied is subject to reasonably consistent estimation or measurement.

* In SSAE No. 4 engagements, criteria to be used in the determination of findings are agreed upon between the practitioner and the specified users. For SAS No. 75 engagements, the basis of accounting for the financial statement component clearly should be evident to the specified users and the practitioner.

* The procedures to be applied to the specific subject matter are expected to result in reasonably consistent findings using the criteria (SSAE No. 4) or basis of accounting (SAS No. 75).

* Evidential matter related to the specific subject matter to which the procedures are applied is expected to exist to provide a reasonable basis for expressing the findings in the practitioner's report.

* Where applicable, the practitioner and the specified users agree on any materiality limits for reporting purposes.

* Use of the report is restricted to the specified users.

* For agreed-upon procedures engagements on prospective financial information, the prospective financial statements include a summary of significant assumptions.

* For agreed-upon procedures engagements performed pursuant to SSAE No. 3, management evaluates the entity's compliance with specified requirements or the effectiveness of the entity's internal control structure over compliance.

Engagement Procedures

After meeting with users to determine the procedures to be performed, practitioners should establish a clear understanding regarding the terms of the agreed-upon procedures engagement, preferably in an engagement letter. Engagement letters should be addressed to the client and, in some cases, to all specified users.

The procedures to be performed in a SAS No. 75 or a SSAE No. 4 engagement may be as limited or as extensive as the specified users desire. However, practitioners should not agree to perform procedures that are overly subjective or open to varying interpretations. Terms such as "general review," "limited review," "check," or "test," should not be used in describing procedures unless these terms are clearly defined. Examples of appropriate procedures would include‹

* execution of a sampling application after agreeing on relevant parameters.

* inspection of specified documents evidencing certain types of transactions or detailed attributes.

* confirmation of specific information with third parties.

* comparison of documents, schedules, or analyses with certain specified attributes.

* performance of specific procedures on work performed by others (including the work of internal auditors).

* performance of mathematical computations.

In certain circumstances, it may be appropriate or necessary for the practitioner to involve a specialist in the performance of one or more of the agreed-upon procedures. The practitioner and the specified users explicitly should agree to the involvement of the specialist and the practitioner's report should describe the nature of any assistance provided by the specialist.

The practitioner should prepare and maintain working papers related to SAS No. 75 and SSAE No. 4 engagements. While the quantity, type, and content for each engagement will vary with the circumstances, at a minimum the working papers should indicate that the work was adequately planned and supervised, and that evidential matter was obtained to provide a reasonable basis for the findings expressed in the practitioner's report. Exhibit 2 provides a summary of the major steps that should be considered in SAS No. 75 and SSAE No. 4 engagements.

The Report

A practitioner should report the results of applying agreed-upon procedures in the form of findings. Again, an important change in these type engagements is that no negative assurance should be provided in the report. Further, practitioners should understand that the concept of materiality generally does not apply in engagements to report findings as a result of applying agreed-upon procedures; all findings as a result of applying agreed-upon procedures should be reported. A defined materiality threshold may be agreed upon by the practitioner and the specified users. If this is the case, any agreed-upon materiality limit(s) should be described in the practitioner's report. Further, the report should be restricted to use by the specified users. The report should be dated as of the completion of the agreed-upon procedures.

An example of how a SSAE No. 4 and SAS No. 75 report would appear is shown in Exhibits 3 and 4 respectively.

When circumstances impose restrictions on the performance of the agreed-upon procedures, the practitioner should attempt to obtain agreement from the specified users for modification of the agreed-upon procedures. When such agreement cannot be obtained, the practitioner should describe any restrictions on the performance of procedures in the report or withdraw from the engagement.

Effective Date

Both SAS No. 75 and SSAE No. 4 are effective for reports on agreed-upon procedures engagements issued after April 30, 1996. Earlier application is encouraged. *

Thomas A. Ratcliffe, PhD, CPA, is chairman of the accounting program at Troy State University.

JANUARY 1996 / THE CPA JOURNAL

Conclude that you (the practitioner) are independent with respect to the client.

Meet/communicate with specified users to agree on procedures to be performed.

Conclude that agreed-upon procedures are expected to result in measurable and/or estimable findings and that evidential matter is expected to exist.

For SSAE No. 4 engagements, have client provide a written assertion. The significant difference in SSAE No. 4 and SAS No. 75 is that this written assertion is not required in SAS No. 75 engagements.

Establish understanding of the terms of the engagement (preferably in an engagement letter).

Consider the need to utilize a specialist; practitioner and specified users explicitly should agree to any involvement by a specialist.

Carry out the agreed-upon procedures.

Conclude that working papers document that the engagement was properly planned and supervised and that evidential matter was gathered to support issuance of the report.

Issue report of findings; restrict distribution of the report to specified users.

To the Audit Committee and Managements of ABC Inc. and the XYZ Fund:

We have performed the procedures enumerated below, which were agreed to by the audit committees and managements of ABC Inc. and the XYZ Fund, solely to assist you in evaluating the accompanying Statement of Investment Performance Statistics of the XYZ Fund (prepared in accordance with the criteria specified therein) for the year ended December 31, 19X1. This agreed-upon procedures engagement was performed in accordance with standards established by the American Institute of Certified Public Accountants. The sufficiency of these procedures is solely the responsibility of the specified users of the report. Consequently, we make no representation regarding the sufficiency of the procedures described below, either for the purpose for which this report has been requested or for any other purpose.

[Include paragraphs to enumerate procedures and findings.]

We were not engaged to, and did not, perform an examination, the objective of which would be the expression of an opinion on the accompanying Statement of Investment Performance Statistics of the XYZ Fund. Accordingly, we do not express such an opinion. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you.

This report is intended solely for the use of the audit committees and managements of ABC Inc. and the XYZ Fund, and should not be used by those who have not agreed to the procedures and taken responsibility for the sufficiency of the procedures for their purposes.

Issue report of findings; restrict distribution of the report to specified users.

MNO Auditors

New Toll-Free

"Faxformation" Service

1-800-605-4392

JANUARY 1996 / THE CPA JOURNAL

LOCKHART

1/3 VERTICAL

BW

To the management of Best Widget Company and The Loan Committee of Fred's Bank:

We have performed the procedures enumerated, which were agreed to by The Best Widget Company and Fred's Bank, solely to assist you with respect to determining the amount of inventory of the Best Widget Company on hand at December 31, 199X, that was in excess of one-year's sales. This engagement to apply agreed-upon procedures was performed in accordance with standards established by the American Institute of Certified Public Accountants. The sufficiency of the procedures is solely the responsibility of the specified users of the report. Consequently, we make no representation regarding the sufficiency of the procedures described below either for the purpose for which this report has been requested or for any other purpose.

We were not engaged to, and did not, perform an audit, the objective of which would be the expression of an opinion on the inventory of Best Widget Company. Accordingly, we do not express such an opinion. Had we performed additional procedures, other matters might have come to our attention that would have been reported to you.

This report is intended solely for the use of the specified users listed above and should not be used by those who have not agreed to the procedures and taken responsibility for the sufficiency of the procedures for their purposes.

January 31, 199Y Your Accountants

1.Compare the number of units and unit price for each item of inventory appearing on the December 31, 199X consolidated inventory listing and the number of units sold for that item as shown in the Annual Sales listing for the year ended December 31, 199X, with respective amounts appearing in the schedule "Inventory in Excess of One Year's Sales."

2. Recalculate the units in excess of one year's sales, the cost thereof (units times year-end unit cost), and the total cost of inventory in excess of one-year's sales on the schedule "Inventory in Excess of One-Year's Sales."

No exceptions found

No exceptions found.