Agreed-Upon Procedures (AUP) Audit: The Process, Start to Finish
The mechanics of Agreed-Upon Procedures (AUP) Audit are what clients ask about once they have decided to proceed. The questions below are the ones raised most often in practice; the full scope of the service is on the Agreed-Upon Procedures (AUP) Audit page.
How is AUP different from a statutory audit?
A statutory audit results in an opinion — typically whether the financial statements give a true and fair view — based on the auditor's own risk assessment and judgment about what to test, governed by the Standards on Auditing. An AUP engagement results in no opinion at all — only factual findings against procedures that were specifically agreed in advance, governed by SRS 4400. The scope of an audit is determined by the auditor; the scope of an AUP engagement is determined jointly by the practitioner and the engaging party.
In practice: We are asked this constantly by clients who assume an AUP report is a 'lighter version' of an audit opinion. It is not a lighter opinion — it is a different kind of report altogether, with no opinion at all.
How does PNPC decide what procedures to include in an AUP engagement?
We start with a scoping conversation focused on the underlying business question: what decision will this report inform, and what specifically needs to be checked to answer it? From there we draft procedures that are specific, objectively performable, and testable — for example, 'physically count stock at [location] as on [date] and compare to the stock register balance, reporting the quantity and value variance by item category' rather than a vague instruction to 'review stock'. We then circulate this draft to the engaging party for explicit written agreement.
In practice: A poorly worded procedure — something like 'assess adequacy of stock records' — is not actually AUP-compliant, because it calls for judgment rather than a factual, testable result. We rewrite vague requests from clients or their banks into properly testable procedures before agreeing to proceed.
What does an AUP report actually look like — what does it contain?
An SRS 4400-compliant AUP report identifies the specific subject matter and the agreed procedures, states that the engagement was conducted in accordance with SRS 4400, explicitly states that no assurance conclusion is expressed, sets out the factual findings against each individual procedure (not a summary opinion), and includes a restriction-of-use and distribution paragraph naming the parties entitled to rely on it. It typically also references the engaging party's responsibility for the sufficiency of the agreed procedures for their purpose.
In practice: A well-drafted AUP report reads procedure-by-procedure, almost like a checklist with findings against each line — deliberately avoiding any summarising language that could read as an opinion. We train our teams specifically on this drafting discipline because it is the single most common quality risk in AUP reporting.
How long does a typical bank stock and book-debt AUP audit take?
For a single-location business, a stock and book-debt AUP engagement runs from signed engagement letter to final report — covering fieldwork planning, physical stock count, debtor confirmation circulation and follow-up, and report drafting and review — and the timeline depends on the scope of the engagement. Multi-location businesses or those with a large number of debtors requiring confirmation take proportionately longer, and the timeline should be planned around the bank's actual review or renewal deadline.
In practice: Debtor balance confirmations are usually the pacing item — non-responses from debtors can extend the timeline. We build in a follow-up cycle and, where the engaging party agrees, use alternative procedures (subsequent receipt tracing, invoice-to-ledger matching) for non-responding debtors rather than leaving the finding open indefinitely.
Can AUP be used for franchise royalty verification, and how does that work?
Yes — this is one of the more common AUP applications in Indian practice. Procedures typically include recalculating the royalty due per the formula in the franchise agreement against the outlet's actual reported sales (drawn from POS system reports, GST returns, and sales registers), comparing the recalculated figure to what was actually declared and paid by the franchisee, and reporting any variance by period and outlet. The franchisor uses the factual findings to decide whether to pursue a formal reconciliation, renegotiation, or dispute with the franchisee.
In practice: We recommend franchisors set up AUP royalty verification as a recurring quarterly or half-yearly cycle across a sample of outlets, rather than a one-off exercise — trend visibility across cycles is often more useful than a single point-in-time check.
What if the engaging party wants to add a new procedure midway through fieldwork?
This is common and manageable, but it must be handled formally. We do not simply add a new test to the workpapers — we discuss the additional procedure with the engaging party, confirm whether it should be formally added to the agreed scope (with a corresponding letter or amendment), assess any impact on timeline and fee, and only then proceed. This keeps the engagement letter an accurate record of what was actually agreed and performed.
In practice: Undocumented scope changes are the most common source of later disagreement about 'what was supposed to be checked'. We keep a simple amendment log for every AUP engagement so there is never ambiguity about what was in scope at each point.
How much does an AUP engagement typically cost compared to a statutory audit?
AUP engagements are generally priced significantly lower than a statutory or full-scope audit, because the scope is narrower and precisely defined — professional time is spent only on the agreed procedures rather than a comprehensive risk-based examination of the entire financial statements. The exact fee depends on the number of procedures, number of locations, volume of transactions or debtors to be tested, and the timeline required. PNPC agrees and confirms the fee in writing as part of the engagement letter before fieldwork begins.
In practice: We do not price AUP engagements as a discounted audit — we price them based on the actual time and locations the agreed procedures require. A narrowly scoped single-location stock audit and a five-location franchise royalty review will differ substantially in fee, and we are transparent about why.
How does PNPC ensure the AUP report language does not accidentally read as an audit opinion?
This is a specific internal quality-control step. Every AUP report drafted at PNPC goes through a senior partner review focused specifically on language discipline — checking for words like 'in our opinion', 'we are satisfied that', 'fairly presents', or any other phrasing that implies an assurance conclusion rather than a bare factual finding. Reports are structured procedure-by-procedure with the finding stated plainly, avoiding summarising or evaluative language.
In practice: This sounds like a technicality but it is not — a report that unintentionally reads as an opinion can create liability exposure for the practitioner and false comfort for the reader, both of which SRS 4400 is specifically designed to prevent.
How does PNPC handle AUP engagements across multiple locations, like a retail chain with several stores?
We plan a coordinated multi-location fieldwork schedule, often deploying teams to multiple locations concurrently to minimise the window during which stock or transaction data could change between sites, and to meet the engaging party's timeline. Findings are consolidated location-by-location in the final report so the reader can see both the aggregate position and any location-specific variances, rather than a single blended figure that could mask a problem at one specific site.
In practice: Location-specific reporting matters — we have had engagements where an aggregate figure looked fine but one specific outlet had a material shortfall masked by an overage at another. We always report by location unless the engaging party specifically agrees to an aggregated-only format.
Where this sits in the wider engagement
Agreed-Upon Procedures (AUP) Audit rarely arrives on its own. The statutory basis and the current requirements are set out on the Agreed-Upon Procedures (AUP) Audit service page, and the related services are grouped under Audit Assurance.
What PNPC does
PNPC Global has practised since 1986 across India and the UAE. On Agreed-Upon Procedures (AUP) Audit we take the work end to end — reviewing the facts, preparing and filing what is required, and dealing with the authority through to closure.