Agreed-Upon Procedures (AUP) Audit: Who Needs It and Who Does Not
Whether Agreed-Upon Procedures (AUP) Audit applies to a given business is the first thing worth settling, and it is where most of the early questions land. The questions below are the ones raised most often in practice; the full scope of the service is on the Agreed-Upon Procedures (AUP) Audit page.
Can an AUP report be shared with anyone other than the party who requested it?
No, not as a matter of good practice and standard drafting. SRS 4400 requires the report to state clearly that it is intended solely for the parties who agreed to the procedures, because a party unfamiliar with the specific scope could misinterpret factual findings as broader assurance than was actually provided. If a wider circulation is genuinely needed, that requirement should be identified during scoping — before the engagement letter is signed — so the intended users are properly defined and consulted on the procedures from the start.
In practice: A company may want to show an AUP stock-audit report to a second lender who was not part of the original engagement. We generally advise against this without first bringing the second lender into the agreed-procedures process — otherwise they may misread a factual finding as an assurance opinion it was never intended to be.
Does PNPC need to be independent of the company to perform an AUP engagement?
SRS 4400 itself does not impose the same strict independence requirements as a statutory audit under the Companies Act. However, many engaging parties — particularly banks and franchisors — expect and often explicitly require the practitioner to be independent of the entity being examined, because the credibility of the factual findings depends on it. We assess and disclose our independence position (or any relationship) as part of the engagement letter, and we decline engagements where a genuine independence concern would undermine the report's credibility for its intended purpose.
In practice: For clients where PNPC also handles statutory audit or accounting, we discuss with the bank or franchisor upfront whether they require an independent AUP practitioner or are comfortable with the existing relationship — this avoids a rejected report after the work is done.
Does an AUP engagement require a Unique Document Identification Number (UDIN)?
Yes. ICAI's UDIN mandate requires a UDIN for all certificates, reports, and documents signed by a practising Chartered Accountant in their capacity as a CA, and this extends to AUP reports issued under SRS 4400 where the report is signed by the engagement partner. PNPC generates and attaches the UDIN to every signed AUP report as a standard part of our issuance process.
In practice: Banks and other engaging parties may specifically request UDIN verification before accepting a report — it is a straightforward but essential step that should never be skipped.
Who is responsible for deciding whether the agreed procedures are adequate for the engaging party's purpose?
Under SRS 4400, the engaging party (and any other intended users involved in agreeing the procedures) is responsible for determining that the agreed procedures are adequate for their purposes — not the practitioner. The practitioner's responsibility is to perform the agreed procedures competently and report the findings factually and completely. This allocation of responsibility is one of the reasons the report is restricted to parties who participated in agreeing the procedures.
In practice: We explain this allocation clearly to clients at the outset, because it means our scoping conversation is not a formality — it is the moment where the engaging party takes on responsibility for whether the eventual report will actually answer their question.
Can a grant-funded NGO or Section 8 company use AUP to satisfy donor reporting requirements?
Yes, and this is a common use case. Donors and CSR funders frequently require a utilisation certificate or fund-utilisation report verified by an independent CA. An AUP engagement — tracing grant funds from the dedicated bank account through to vouchers and invoices supporting the approved budget heads — produces exactly this kind of factual, restricted-use report. Where the donor prescribes a specific format for the utilisation certificate, we align the AUP procedures and report structure to that format while keeping it SRS 4400-compliant.
In practice: Some donor formats effectively ask for an assurance-style certification rather than a factual AUP report. We review the donor's required format early and clarify with the donor (or advise the NGO to clarify) exactly what type of report they actually need — AUP, a certificate, or a different form of assurance — before committing to a specific engagement type.
What sampling approach does PNPC use for debtor confirmations or multi-location stock checks?
The sampling basis — whether 100% coverage, a value-based threshold sample, or a statistical sample — is itself one of the procedures agreed with the engaging party before fieldwork begins, since it directly affects the reliability and cost of the engagement. Coverage can be set as debtors or locations representing a defined percentage of the total balance or value, supplemented by any specifically flagged high-risk items, and the sampling rationale should be documented clearly in the report so the reader understands exactly what was and was not covered.
In practice: A sample that is too small to be meaningful, agreed only to save cost, produces a report that gives the bank or franchisor false comfort. We push back on sampling approaches we consider inadequate for the stated purpose, even if the client would prefer a smaller and cheaper sample.
Where this sits in the wider engagement
Agreed-Upon Procedures (AUP) Audit rarely arrives on its own. The statutory basis and the current requirements are set out on the Agreed-Upon Procedures (AUP) Audit service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Agreed-Upon Procedures (AUP) Audit we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.