SSAE 19 for Agreed-Upon Procedures (AUP) Engagements

• Assertion requirement eliminated: The new standard removes the need for practitioners to obtain or reference formal assertions from responsible parties about the subject matter under review. This is especially beneficial when responsible parties are unable or unwilling to provide formal evaluations of the subject matter.
• Broader report distribution permitted: Reports can now be distributed to a wider audience since report users no longer need to accept responsibility for the appropriateness of procedures performed. While reports include disclaimers about procedure suitability for different purposes, practitioners can still restrict distribution when warranted.
• User responsibility for procedures eliminated: Under SSAE 18, specified users had to participate in determining procedures and accept responsibility for their appropriateness. This created complications when procedures needed modification or new parties joined engagements. SSAE 19 eliminates this requirement.
• Dynamic procedure development allowed: The new standard enables collaborative procedure development between practitioners, clients, and intended users throughout the engagement period. Procedures can evolve as the engagement progresses, with only the engaging party needing to approve their appropriateness before the report is issued. This significantly increases engagement flexibility.

SSAE 19 Requirements for Documentation and Reporting

Under SSAE 19, AUP reports must incorporate eight foundational components, including:

1. A complete mapping of participants in the engagement and the focus area under review.
2. Documentation verifying the alignment between procedures and business objectives.
3. Clear boundaries regarding report application.
4. A transparency statement about potential limitations, encouraging users to evaluate relevance.
5. A detailed breakdown of work performed and what was discovered.
6. A clarification that this differs from traditional examination services.
7. An explicit disclaimer regarding professional judgments.
8. Verification of the practitioner’s ethical standing and objectivity.

Beyond the core report, practitioners must maintain a comprehensive engagement file that contains:

• A signed agreement validating the chosen methodology.
• A detailed log of engagement activities, including when and how procedures were executed.
• A repository of engagement outcomes and supporting materials.

This approach has significant differences from prior standards as it emphasizes transparency and usability while maintaining professional rigor. The documentation requirements create a clear audit trail that supports the engagement’s findings and shows adherence to professional standards.

Meeting Professional Standards in AUP Engagements

SSAE engagements demand strict adherence to the AICPA Code of Professional Conduct to maintain attestation independence. The ethics division helps guide concepts common to these engagements.

Below are the requirements:

• Maintaining due professional care throughout the engagement.
• Ensuring the engaging party agrees to procedure appropriateness.
• Following professional standards for consistent findings.
• Documenting all findings gathered during the performed procedures.

An Example of Well-Structured AUP Documentation

• Procedure: We obtained the March 2023 accounts receivable aging report and corresponding customer payment records. We traced invoice numbers AR-2301, AR-2315, AR-2329, AR-2342, and AR-2350, verifying payment dates and amounts against bank deposits.
• Findings: All items were traced without discrepancy.

A Problematic Example

• Procedure: We reviewed the company’s receivables and discussed collections with the Controller. Everything appeared reasonable except for some minor discrepancies.
• Findings: Based on our general review, the receivables process seems adequate.

The point is that vague terms not only reduce the value of the findings but could also lead to misinterpretation by intended users. When procedures and findings lack specificity, they fail to provide meaningful insights and could expose practitioners to professional risk.

SSAE 19 Language Guidelines

The standard emphasizes precise terminology in procedure descriptions.

According to paragraph A27, practitioners should not use terms like:

• Note
• Review
• General review
• Limited review
• Evaluate
• Analyze
• Check
• Test
• Interpret
• Verify
• Examine

Acceptable words include:

• Inspect
• Confirm
• Compare
• Agree
• Trace
• Inquire
• Recalculate
• Observe
• Mathematically check