[Anonymous]

Can this happen?

[Anonymous]

I suppose in theory all AUPs are ‘AUPs of AUPs'.

I've done quite a bit of them and normally had a client-prepared AUP program with multiple steps.

[soyanks]

Performing an AUP on an AUP?

That makes no sense. AUP, by nature, provides no assurance or opinion. The audit firm literally performs only the steps written by the client. All you have to do is report back where X = X, or X is not X.

By performing an AUP on an AUP, it's trying to get some kind of assurance that an existing AUP is working as intended. But AUP provides zero assurance, so if one is interested in doing an AUP on an AUP, most audit firms will tell their clients to do an audit so the audit firm can design its own procedures and actually issue an opinion.

FAR - 86
REG - 85
BEC - 90
AUD - 84

[Anonymous]

soyanks-

AUPs do provide an opinion, it's generally on a management assertion.

[Anonymous]

AUP=no assurance.

Step by step report of procedures (So I guess therefore assertions)

[Anonymous]

Nope. Actual assertions. One of the first steps is to obtain a signed management assertion letter. The AUP revolves around the assertions.

A lot of the Governmental audits are AUPs. I think SOC1 (SSAE16) and the now superceded SAS70 audits are a good example of an AUP. They all start with a management assertion, then kinda look like a normal audit opinion after that are are normally backed up by about 100 pages of reading that's about as fun as a fart in a spacesuit (I have to review them from time to time at work).

If you're looking to bore yourself to death, you may be able to find a SOC 1 to read on the internet.

[soyanks]

@BillBrasskey. I hire KPMG to do an AUP on a big international supplier for my company. One of the big things we discussed before the AUP was initiated was exactly what KPMG can and can't do with AUP. They were adamant that AUP does not issue any opinion. None of my AUP reports have opinions issued by KPMG. It just says that they performed the procedure as described and tells me either there are exceptions or no exceptions.

FAR - 86
REG - 85
BEC - 90
AUD - 84

[soyanks]

In fact in the engagement letter, it clearly says the following:

“The sufficiency, comprehensiveness and scope of the procedures are XXX Corp. and XXX Inc's exclusive responsibility. Thus, KPMG does not make nor will it make any representation or judgment on the merits of, or express an opinion on, the sufficiency, comprehensiveness and scope of the procedures for the purposes of XXX and XXX as described below or for any other purpose.

Also, we don't provide any management rep letter. Only an engagement letter.

FAR - 86
REG - 85
BEC - 90
AUD - 84

[Anonymous]

Soyanks-

It looks like we are both kinda right.

I've done about 150 AUPs (GAAS & GAGAS reqs) for the Federalay-hood. All have had opinions because they are compliance audits and as it turns out, compliance audits are a form of AUP where an opinion is issued.

I can't speak to the type of AUP that KPMG did for ya, but some AUPs only require a list of procedures like you wrote of.

[Anonymous]

I'd pull that engagement letter post if I were you.

[Anonymous]

Excerpt from AT 201.03:

“In an engagement performed under this section, the practitioner does not perform an examination or a review, as discussed in section 101, and does not provide an opinion or negative assurance.3 (See paragraph .24.) Instead, the practitioner's report on agreed-upon procedures should be in the form of procedures and findings.”

[Anonymous]

Soyanks- it looks like your AUPs were performed under the citation provided by CTM (AT 201). I have done mine under AT 601 (an AUP per AT 601.16). My AUPs are subject to additional GAGAS reporting requirements (Findings & Observations and all that ballyhoo).

[Anonymous]

2014 Released CPA exam question:

Which of the following statements is least likely to be included in a practitioner's report on agreed-upon procedures?

a. the use of the report is subject to specified restrictions.

b. the report has provided limited assurance.

c. the subject matter is the responsibility of the responsible party.

d. the procedures performed were agreed to by the specified parties.

The correct answer is b with the explanation that agreed-upon procedure engagements provide no assurance. So for purposes of the CPA exam AUP = no assurance. As for the real world, there appears to be more to the issue as shown by Mr. Brasskey, CPA. Alas, the CPA exam doesn't live in the real world.

[Author]

Replies