Agreed-upon procedures engagement letter under AT-C 215 (SSAE 19)
By Arthur Teboul, DokuTrak · Published
In brief
An agreed-upon procedures engagement letter sets out the exact procedures a CPA will perform on a named subject matter, who agreed to them, and how findings will be reported without any opinion. Under SSAE 19 the engaging party must acknowledge in writing that the procedures fit their purpose before the report is issued.
The template: Agreed-upon procedures engagement letter
Complete each [placeholder] and write the procedures in Exhibit A before you send it. Keep the responsible party paragraph only when that party differs from the engaging party, and have counsel review the template once.
- WordEdit the bracketed parts and put it on your letterhead.Free, with your email
- PDFRead-only copy, to print or keep on file.Free, no email
Fill it in online: The engagement letter generator fills this template with your firm and client, keeps the optional clauses you pick, and gives you the letter to copy, print or save.
[Firm name] [Firm address] [Date] [Engaging party legal name] Attention: [Contact name, title] [Address] Re: Agreed-upon procedures on [subject matter] for [period]
Dear [Contact name],
Nature of the engagement
This letter confirms that [Firm name] will perform the procedures listed in Exhibit A on [subject matter, e.g., reported gross sales for royalty purposes for the year ended (date)]. [Responsible party name] is responsible for that subject matter. We will perform the work under the attestation standards established by the American Institute of Certified Public Accountants. This is an agreed-upon procedures engagement; it is neither an examination nor a review.
Intended purpose and users
The procedures are intended to assist [engaging party, and other named parties such as the franchisor or grantor] in [purpose, e.g., evaluating whether royalties were computed on all reported sales]. [Other party names] will also be asked to agree to the procedures and to acknowledge that they are appropriate for their purposes.
No opinion or conclusion
We will not express an opinion or a conclusion on [subject matter]. Had we performed additional procedures, other matters might have come to our attention that we would have reported to you.
Your acknowledgment of the procedures
Procedures may be added or changed as the engagement proceeds, by written agreement. Before we issue our report, you will give us a written agreement to the final procedures and an acknowledgment that they are appropriate for the intended purpose. If you do not provide it, we will withdraw from the engagement.
Responsibilities of the responsible party(optional)
[Responsible party name] is responsible for [subject matter] and for the records that support it. It will give us access to those records and to its staff, and we may ask it for written representations.
Our responsibilities
We will perform the procedures in Exhibit A and report every finding in factual terms. We are not responsible for whether the procedures are sufficient for your purposes. We are independent of [responsible party name] and will remain so throughout the engagement.
Exhibit A: procedures, source documents and thresholds
For each procedure, Exhibit A states the source document, the sample size or the full population, and the threshold above which a difference is reported. Example line: “Select [number] invoices at random from the [month] sales journal; agree each to the signed invoice and the bank deposit; report any difference greater than $[amount].” Terms such as “review” or “check” are used only where the procedure defines them.
Records and due dates
You will deliver the records in Exhibit B, including [sales journal, bank statements, invoices, payroll registers, signed contracts], by [date]. Fieldwork runs from [start date] to [end date]. If a record is missing or a procedure cannot be performed as written, we will describe the restriction in our report or withdraw.
Specialists(optional)
With your agreement, [specialist name or firm] will assist us with [procedure numbers]. Our report will describe the nature of that assistance. The procedures in our report will be performed by our engagement team, which may include participating practitioners, not by your internal auditors.
Representation letter
At the end of the engagement, you will sign a representation letter. Where other parties were asked to agree to the procedures, it will confirm that you obtained their agreement and acknowledgment.
Our report and its use
Our report will list each procedure and its findings, and any threshold you set for reporting differences. [The report will include an alert restricting its use to (named parties). / The report will be available for general use.]
Fees
Our fee for the procedures in Exhibit A is [fixed amount / hourly at (rates)]. Added or changed procedures are billed at [rates]. Invoices are due within [number] days of receipt. If we withdraw because the procedures are restricted or the acknowledgment is refused, you will pay for the work done to that date.
Working papers and disputes
Our working papers are the property of [Firm name] and will be kept for [retention period]. Peer reviewers and regulators may access them under professional standards. Any dispute about our services will first go to non-binding mediation in [city, state]. This letter is governed by the laws of [state].
Signing
Please sign below to agree to these terms and to the procedures in Exhibit A as they stand today. Where [responsible party name] is a different party, its officer signs as well.
Sincerely, [Firm name] [Partner name], CPA Signature: ____________________ Date: __________ Agreed on behalf of [Engaging party legal name]: [Name, title] Signature: ______________ Date: ________ Agreed on behalf of [Responsible party legal name]: [Name, title] Signature: ______________ Date: ________
What an AUP engagement is, and what it is not
An agreed-upon procedures engagement is an attestation engagement in which the CPA performs specific procedures and reports the findings, with no opinion and no conclusion. It falls under AT-C 215 of the AICPA attestation standards, which SSAE 19 rewrote (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements). Readers draw their own conclusions from the findings.
Grantors, franchisors and lenders use AUPs when they want facts, not assurance. For example, a franchisor may want sampled sales tested against the royalty report. A grantor may want payroll charged to a grant traced to time records. Federal rules even let a pass-through entity charge a federal award for an AUP that monitors a subrecipient, within limits (2 CFR 200.425, Audit services).
The practitioner must be independent of the responsible party, as in any attestation engagement (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements). That surprises clients who think an AUP is a consulting job.
What SSAE 19 changed in the letter
Older AUP letters still circulate, and they carry clauses the standard no longer needs. The AICPA summary of SSAE 19 lists the main changes (AICPA, SSAE No. 19 At a Glance). Update your template on each one.
| Topic | Older letters | Under SSAE 19 |
|---|---|---|
| Written assertion | Requested from the responsible party | No longer required (AICPA, SSAE No. 19 At a Glance) |
| When procedures are fixed | Agreed in full before work starts | May be developed over the course of the engagement (AICPA, SSAE No. 19 At a Glance) |
| Sufficiency of procedures | Intended users took responsibility for it | Users no longer take that responsibility (AICPA, SSAE No. 19 At a Glance) |
| Acknowledgment | Users agreed to procedures up front | Engaging party acknowledges in writing, before the report, that procedures are appropriate (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements) |
| Report use | Always restricted to specified parties | Restriction alert added when the practitioner judges it needed (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements) |
The terms AT-C 215 requires in the letter
The engaging party is the party that hires the CPA and agrees to the procedures. The responsible party is the party responsible for the subject matter, such as the franchisee whose sales are tested. They are often different, and AT-C 215 wants the letter to name both (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements).
- The nature of the engagement, the subject matter and the responsible party.
- The practitioner’s responsibilities, and a statement that the work follows AICPA attestation standards.
- A statement that the responsible party is responsible for the subject matter.
- The engaging party’s promise to give a written acknowledgment, before completion, that the procedures fit the intended purpose, and a representation letter at the end.
- Any other parties asked to agree to the procedures, if known at the start.
- The expected form of the report, any use restriction, and any disclaimers.
- Assistance from the client, any external specialist, and any threshold for reporting exceptions.
Writing the procedures exhibit
The exhibit is what makes an AUP letter different from every other engagement letter. Each line names one procedure, the source document, the sample or the full population, and the threshold for reporting a difference. AT-C 215 bars procedures that use vague words such as “review” or “check” unless the procedure defines them (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements).
Write each procedure so two practitioners would do the same thing. “Compare each sampled invoice to the sales journal and report differences over $[amount]” works. “Review sales for reasonableness” does not. The exhibit also tells the client which documents to pull, such as invoices, bank statements, payroll registers or signed contracts.
Under AT-C 215 as amended by SSAE 23, procedures listed in the report must be performed by the engagement team, not by the client’s internal auditors. For engagements beginning on or after December 15, 2025, that team may include participating practitioners (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements). If the engaging party will not give the written acknowledgment, the practitioner should withdraw (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements).
Questions people ask
Is an agreed-upon procedures engagement an attest engagement?
Yes. AUPs are performed under AT-C 215 of the AICPA attestation standards, so they are attestation engagements, but the practitioner gives no opinion or conclusion (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements). The report lists each procedure and its findings.
Does SSAE 19 still require a written assertion?
No. SSAE 19 removed the requirement that the practitioner request a written assertion from the responsible party (AICPA, SSAE No. 19 At a Glance). The engaging party still gives a written acknowledgment of the procedures and a representation letter.
Can procedures change after the letter is signed?
Yes. Under SSAE 19, procedures may be developed or changed during the engagement (AICPA, SSAE No. 19 At a Glance). The final list is the one the engaging party acknowledges in writing before the report is issued.
Must an AUP report be restricted to specified parties?
Not always. The practitioner considers whether to add an alert restricting use, for example when the procedures only make sense to the parties who agreed to them (AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements). Without that alert, the report can be general use.
Sources
- AICPA SSAEs, AT-C 105 and AT-C 215 Agreed-Upon Procedures Engagements: AT-C 215 lists the terms of an AUP engagement letter, requires the engaging party’s written acknowledgment before the report, bars vague procedures and governs restricted-use alerts and independence.
- AICPA, SSAE No. 19 At a Glance: SSAE 19 removed the written assertion requirement, lets procedures be developed during the engagement, and no longer makes intended users responsible for the sufficiency of procedures.
- 2 CFR 200.425, Audit services: A pass-through entity may charge a federal award for agreed-upon procedures engagements that monitor exempt subrecipients, within stated limits.
About the author
Arthur Teboul (Founder, DokuTrak) is building DokuTrak after watching professionals lose hours chasing clients for documents over email. Arthur Teboul.
Editorial standards
How this page was made (methodology): it is built from the primary sources listed under Sources, and every rule and figure on it links to the source it comes from. Last updated October 25, 2026. Spotted an error or a rule that changed? Contact us.
Ask once. DokuTrak does the chasing.
- Your client uploads from one link, with no account and no password.
- Reminders go out on a schedule, by default 2, 5, 10 and 14 days after the request, until the file arrives.
- With AI review switched on in your workspace (it is off by default), each upload gets a first pass that flags a file that is not the requested document or an unreadable or blurry scan. It says so when it is not sure.
- You accept every file or mark it for re-upload, and your client gets the note by email. The AI never accepts a file.