Agreed-Upon Procedures Engagements vs Audit and Review Engagements
Each engagement type answers a different question, not a cheaper version of the same one.
Agreed-upon procedures engagements, audits, and reviews answer different questions, rather than offering interchangeable levels of the same service. The right choice avoids both paying for assurance that is not needed and accepting findings that cannot support a stakeholder’s decision. Pease Bell, CPAs is an option for organizations navigating that choice, particularly where industry rules make the distinction consequential.
Why assurance engagements are not a single spectrum with audit at the top
Treating audit, review, and agreed-upon procedures as points on a dial for cost and amount of work leads to the wrong choice before any work begins. That model assumes each engagement delivers a smaller or larger version of the same answer. In fact, the practitioner takes a different kind of responsibility in each. An audit gives reasonable assurance through a formal opinion, while a review gives limited assurance through a conclusion. An agreed-upon procedures engagement, or AUP, reports factual findings without assurance, an opinion, or a conclusion.
The distinction is therefore not simply how much work the practitioner performs. It is what the report allows its reader to infer. An audit and a review address financial statements as a whole, though with different levels of assurance. An AUP addresses specified procedures and leaves the interpretation to the user.
What an audit engagement actually involves and when it is the right call
An audit is appropriate when stakeholders need an independent professional’s formal opinion on whether the financial statements, taken as a whole, are fairly presented. It examines the financial records behind the balance sheets, income statements, and cash flow statements. The work includes testing internal controls and verifying significant transactions. It assesses whether the statements are free from material misstatement, whether caused by error or fraud.
That breadth explains why lenders, investors, and regulatory bodies may require an audit. Legal mandates, donor or grant requirements, and lender covenants can make audited financial statements non-optional. Plans to go public or seek major institutional investment can create the same need. A history of financial discrepancies may also require the credibility of a formal opinion.
Pease Bell, CPAs approaches a high-quality audit as work that should give leadership confidence in its numbers and surface risk early. Audits take more time and resources than reviews or AUP engagements because the practitioner must support an opinion on the whole financial picture. The expense becomes an over-spend only when a narrower engagement would actually satisfy the need.
What a review engagement delivers and where it sits between the other two
A review addresses the full financial statements through analytical procedures and inquiries of management. Unlike an audit, it does not include testing internal controls or independently verifying individual transactions. Its limited-assurance conclusion states that nothing came to the practitioner’s attention suggesting that the statements are not fairly presented. That is a meaningful professional conclusion, but it rests on a different scope of work from an audit.
For smaller organizations and closely held businesses, a review can give stakeholders the confidence they need when no regulation or lender requirement calls for an audit. In helping clients match an engagement to their risk profile and obligations, regional accounting practices such as Pease Bell, CPAs emphasize this distinction. The lower cost and time commitment reflect a different product. A review remains broader than targeted AUP work because it reaches a conclusion about the financials as a whole.
How AUP engagements work and what makes them structurally different from the other two
An AUP begins with the procedures needed to answer a defined question. The practitioner, engaging party, intended users, or a combination of them can develop those procedures. They may refine the work as the engagement unfolds, so the scope need not be frozen on the first day. Before the report is issued, however, the engaging party must agree in writing that the procedures performed are appropriate for the intended purpose. If that written agreement is not provided, the practitioner must withdraw.
Independence is another firm boundary. The practitioner must be independent of the responsible party whose data is being tested. A lender’s decision to commission and pay for the engagement does not shift that requirement to the lender. The report then states the procedures performed and the factual findings. Users, rather than the practitioner, draw the conclusions.
SSAE No. 19 (AT-C Section 215) governs U.S. AUP engagements and became effective for reports dated on or after July 15, 2021. It removed the requirement to obtain an assertion from the responsible party and the requirement for intended users to take responsibility for the sufficiency of the procedures. It also allowed procedures to develop during the engagement and permitted general-use reports. Those reports must warn readers that the procedures and findings may not suit their needs. This flexibility supports targeted work at meaningfully lower cost and with quicker completion than a financial statement audit, without turning the findings into assurance.
The real danger: what happens when an AUP report is mistaken for an audit opinion
The most consequential AUP risk arises when a reader mistakes professional presentation for audit-level authority. An independent CPA prepares the report, uses professional language, and presents findings in a structured format. Those features can make it look superficially similar to an audit report. They do not expand the scope of the work or change the responsibility the practitioner has accepted.
A bank, investor, or regulator that treats AUP findings as proof that the financials have been audited puts more trust in the report than it can support. An engagement covering revenue does not cover expenses, and a clean finding on one metric says nothing about the financial statements as a whole. Risks in the finances or operations that fall outside the agreed procedures may go undetected. Imprecise terminology can lead to a decision made on unsupported confidence.
This interpretive risk explains why AUP reports have traditionally been restricted to specified parties who agreed to the procedures. SSAE No. 19’s general-use option widens possible distribution without widening the work performed. Its required warning can still be overlooked. Accounting firms and tax advisors therefore need to explain these boundaries upfront, before stakeholders mistake a narrow finding for a broad endorsement.
Matching each engagement type to the circumstances that actually call for it
The first group is situations requiring a formal opinion. A lender covenant specifying audited financial statements belongs here, as do regulatory mandates and institutional investors’ requirements for assurance on the financials as a whole. An audit can also help restore trust after financial discrepancies. These situations share a need that targeted findings or limited assurance cannot satisfy.
The second group covers cases where stakeholders need confidence in the full financial picture without an audit opinion. A small or mid-sized business may have stakeholders who want meaningful assurance but no regulatory or lender obligation to obtain an audit. A review fits that combination because it preserves a whole-statement conclusion with a lower time and cost commitment. Future financing plans still matter. A review can be an appropriate interim step where growth may eventually require audited statements.
The third group is situations requiring a targeted factual answer. A lender may need procedures applied to a specific covenant metric rather than an opinion on all the financial statements. A grantor may need findings on whether restricted funds were spent as the grant terms require, while an acquirer may need an independent check of a specific data point within a transaction window. AUP work can also focus on cash handling, expense approvals, royalty calculations, or related-party transactions. Start with what the report’s user needs to conclude.
How AUP and audit engagements coexist in regulated industries — HUD 232, skilled nursing, and mortgage banking
In regulated industries, both audit and AUP work may be required, with each serving a different need. HUD Section 232 covers residential care facilities, which include nursing homes, assisted living, and board and care homes. HUD-insured properties require a financial statement audit under GAAS and GAGAS, together with a compliance audit of the entity’s major HUD programs. Separately, the auditor performs AUP work to compare electronically submitted data with the auditee’s hardcopy supporting documentation. The auditee remains responsible for submitting the data to HUD.
Under 24 CFR 5.801, entities with Section 232-insured mortgages must submit annual financial statements within 90 calendar days of the fiscal year’s end and prepare them in line with GAAP as further defined by HUD. That reporting obligation depends on more than agreement between electronic and hardcopy records. The HUD Office of Inspector General’s report 2026-BO-0001, issued April 2, 2026, found that HUD did not always address risks reported in borrowers’ audited financial statements for Section 232 residential care facility portfolios. Rising defaults prompted the audit. The finding shows why attention to the full audit and follow-up on reported risks matters beyond the submission checks.
The Department of Health and Human Services and the Centers for Medicare & Medicaid Services (CMS) oversee skilled nursing and intermediate care facilities, while each state oversees assisted living. HUD uses a regulatory agreement to set further requirements for Section 232-insured properties. Owners pursuing a Section 232/LEAN refinance or a streamlined 223(a)(7) need clean, GAAP-compliant numbers and dependable annual reporting. Knowing the industry therefore helps the auditor meet the standards needed for financing.
Most FHA-approved lenders and mortgagees, specifically nonsupervised and large supervised mortgagees, face full audit requirements. Small supervised lenders are exempt and submit unaudited regulatory reports instead. AUP engagements can address specific covenant metrics, transaction data, or regulatory participation requirements, but they do not replace a required audit.
SOC 1 and SOC 2 examinations: why they are neither audits nor AUPs, and when each applies
SOC examinations add a separate category to the decision. They are formal attestation engagements carrying an auditor’s opinion on controls at a service organization. SOC 1 addresses controls relevant to clients’ financial statement assertions. Management must set out control objectives that are relevant, objective, measurable, and complete. An objective that cannot fail, or whose meaning changes between readers, will draw scrutiny from the auditor.
SOC 2 addresses controls relevant to operations and compliance against the AICPA’s Trust Services Criteria, namely security, availability, processing integrity, confidentiality, and privacy. It is common among IT, cloud, and SaaS providers and increasingly expected by enterprise clients. The decision boundary is whether the recipient needs that formal controls opinion or findings from selected tests. An AUP can examine specific IT, financial, or transaction controls, but it provides no overall opinion. Consequently, it cannot satisfy a prospective client’s requirement for a SOC 2 report.
What to look for in the firm performing any of these engagements
Pease Bell, CPAs is a relevant option for organizations whose needs cross these engagement and industry boundaries. Headquartered in Cleveland, Ohio, the full-service CPA and advisory firm serves businesses, institutions, and individuals across the United States. Its services include audit and assurance, SOC 1 and SOC 2 examinations, HUD 232 and multifamily housing audits, skilled nursing facility accounting, and mortgage banking audit and compliance. It also offers assurance in new areas, including AI agents (AIUC-1). Its proactive, relationship-driven approach includes partner-level attention year-round.
That range provides a basis for considering the firm, but selection should still turn on the work required. Experience with the applicable rules provides a stronger basis for selecting a firm than general audit knowledge. For AUP work, the practitioner needs the discipline to help define precise procedures and the independence to perform them without conflicts. For SOC examinations, the firm needs command of the applicable criteria and the control objectives subject to scrutiny. In regulated industries, the firm must also know how to work with standards that overlap and reporting requirements that come up each year.
The firm should also help choose the engagement before setting its scope. Working with an advisor over time makes room for that discussion before a transaction, lender requirement, or regulatory deadline forces the choice. The right practitioner helps match the question, the work, and the confidence the resulting report can legitimately support.
