Posted by Tyler Starr, CPA
The American Institute of Certified Public Accountants’ (AICPA) Auditing Standards Board (ASB) issued the Statement on Standards for Attestation Engagements (SSAE) No. 19, Agreed-Upon Procedures Engagements, in December 2019. SSAE 19 supersedes SSAE 18 AT-C section 215 of the same name and also amends certain provisions of SSAE 18 section 105, Concepts Common to All Attestation Engagements. When the new standard was released, the AICPA indicated that SSAE 19 “provides flexibility to a practitioner performing an agreed-upon procedures engagement.” But, how exactly does SSAE 19 provide flexibility?
First, we should understand the flexibility that already comes with agreed-upon procedures (AUPs) compared to a traditional audit. The purpose of an audit is for the auditor to provide an opinion on the financial statements taken as a whole. On the other hand, an AUP can be used to address a particular need of an entity that an audit may not be able to address. For example, an AUP could be used to dig deeper into a financial statement line item regardless of materiality, test the effectiveness of specific internal controls, or determine compliance with agreements or contractual obligations. The primary benefit of an AUP is that the specific procedures are developed to address the needs or requirements of the specified parties. While an AUP does not provide the end users of the final report with an opinion, the report enables the parties involved to evaluate the results of the procedures developed according to their specific needs. Additionally, AUPs are generally more cost effective than a full financial statement audit.
SSAE 19 provides even greater flexibility to practitioners by:
- Removing the requirement that the practitioner request an assertion from the responsible party – Practitioners no longer have to request an assertion or disclose in the accountant’s report when the practitioner has not obtained an assertion. This is because the responsible party may not have the ability or willingness to perform its own measurement or evaluation of the subject matter. This differs from an examination or review engagement, which is predicated on the concept that a party other than the practitioner makes an assertion about whether the subject matter is measured or evaluated in accordance with suitable criteria.
- No longer requiring intended users to take responsibility for the sufficiency of the procedures – Extant AT-C section 215 is premised on specified parties determining the procedures to be performed by the practitioner and assuming responsibility for the sufficiency of the procedures. Such specified parties have been required to acknowledge their responsibility for the sufficiency of the procedures as part of the practitioner agreeing on the terms of the engagement with the engaging party. This requirement can become burdensome when procedures evolve, or additional specified parties are added during the engagement. SSAE 19 supersedes AT-C section 215 with the simpler requirement below.
- Allowing procedures to be developed over the course of the engagement – Procedures can be developed over the course of the engagement without requiring the practitioner to go back to any parties to obtain their agreement on the procedures. Instead, prior to the issuance of the practitioner’s report, the engaging party is simply required to agree to and acknowledge that the procedures performed are appropriate to meet the intended purpose of the engagement.
- Allowing the practitioner to develop or assist in developing the procedures – The procedures to be performed may be developed by the practitioner, the engaging party, another party, or a combination of these parties. Further, the procedures may be prescribed by law, regulation, or contract.
- Permitting the practitioner to issue a general-use report – Previously, AT-C section 215 required that the practitioner’s agreed-upon procedures report be restricted to the use of specified parties that have accepted responsibility for the sufficiency of the procedures. Since SSAE 19 eliminated the requirement for intended users to take responsibility for the sufficiency of the procedures, as noted above, practitioners can now issue a general-use report. The report would include language advising users that the procedures performed and the findings obtained may not be appropriate for their purposes. There is nothing in SSAE 19 that would preclude the practitioner form restricting the use of any report if, in the practitioner’s professional judgment, such restriction is appropriate.
SSAE 19 is effective for AUPs dated on or after July 15, 2021. Early implementation is permitted.
Photo by Chad Kainz (License)
