SSAE 19 Offers Agreed-Upon Procedure Efficiencies for Governments

The AICPA’s Statement on Standards for Attestation Engagement (SSAE) No. 19, Agreed-Upon Procedures Engagements, applies to reports dated on or after July 15, 2021. SSAE 19 provides flexibility to a practitioner’s ability to perform agreed-upon procedures engagements by removing the requirement that the practitioner request a written assertion from the responsible party. Also, it no longer requires intended users to take responsibility for the sufficiency of the procedures, instead requiring the engaging party to acknowledge the appropriateness of the procedures prior to issuance of the practitioner’s report. This allows the practitioner to issue a general-use report. This column discusses the new SSAE 19 requirements and how the changes could benefit state and local governments.

Written Assertions

SSAE 19 requires practitioners to determine if the following preconditions are present for an agreed-upon procedures engagement:

• The procedures can be designed, performed, and reported on in accordance with this section.
• The engaging party agrees, or will be able to agree, to the procedures, and acknowledges that the procedures are appropriate for the intended purpose of the engagement.
• The procedures to be applied to the subject matter are expected to result in reasonably consistent findings.
• When applicable, the practitioner agrees to apply a threshold for reporting exceptions established by the engaging party.

Practitioners, however, are no longer required to obtain written assertions from the responsible party. Additionally, the practitioner’s report does not need to disclose that an assertion letter was not obtained. Some state and local governments may not be willing or able to measure or evaluate the subject matter of the procedures, therefore eliminating the requirement to provide written assertions gives additional flexibility for a government to obtain agreed-upon procedures engagements.

Sufficiency and Appropriateness

SSAE 18, AT-C Section 215, required specified parties to determine which procedures the practitioner would perform and to acknowledge and assume responsibility for their sufficiency. This had to happen before the practitioner could agree to terms of the engagement.

SSAE 19 removed this requirement and stated that, prior to the issuance of the practitioner’s agreed-upon procedures report, the practitioner should obtain a written agreement of the procedures and acknowledgment from the engaging party that the procedures performed are appropriate for the intended purpose of the engagement. If the engaging party refuses to provide the acknowledgment, the practitioner should withdraw.

Under SSAE 19, the responsibility of the practitioner is to carry out the procedures and report the findings in accordance with attestation standards. The practitioner assumes the risk. The practitioner’s risks can be reduced through adequate planning, supervision, and due professional care in performing the procedures, accumulating the findings, and preparing the practitioner’s report.

SSAE 19 provides a few examples of appropriate procedures:

• Inspection of specified documents showing certain types of transactions or detailed attributes thereof.
• Confirmation of specific information with third parties.
• Comparison of documents, schedules, or analyses with certain specified attributes.
• Performance of specific procedures on work performed by others.
• Performance of mathematical computations.
• Interpreting documents outside the scope of the practitioner’s professional expertise.

Governments should benefit from the new standard requirements that allow procedures to be developed over the course of the engagement, resulting in more efficient and effective procedures as more information and issues are revealed as the engagement progresses. Additionally, the new standard allows the practitioner to assist in developing the procedures. Therefore, a government can leverage the knowledge and experience of the external auditors in developing the procedures to increase the quality and sufficiency of these procedures.

General-Use Report

SSAE 19 allows practitioners to issue a general-use, agreed-upon procedures report. However, the standard did not preclude a practitioner from issuing a restricted report. SSAE 19 states that the practitioner should consider whether to include an alert, in a separate paragraph, that restricts the use of the agreed-upon procedures report, taking into account the understanding with the engaging party regarding the nature of the engagement.

This alert paragraph should state the following:

• The report is intended solely for informational use by specified parties.
• Who the specified parties are.
• That the report is not intended for use by anyone other than the specified parties.

SSAE 19 provides examples of situations in which the practitioner, using professional judgment, may decide to include an alert that restricts the use of the practitioner’s agreed-upon procedures:

• When the engaging party requests that the use of the report be restricted.
• When agreed-upon procedures are performed on compliance with aspects of contractual agreements, use may be restricted to the parties to the contract or agreement.
• When agreed-upon procedures are performed to comply with regulatory requirements, use may be restricted to the engaging party and the regulator.
• When agreed-upon procedures are performed relating to certain subject matter, the practitioner may determine to restrict the use of the report to parties known to understand the subject matter.

Under the new permission for practitioners to issue a general-use report, state and local government management may be in better position to award agreed-upon procedures contracts and secure the necessary funds knowing that the report will not be restricted. There are programs within state and local governments that do not require expensive and costly audit or examination services, and agreed-upon procedures engagements may be the appropriate service for these programs. The fact that the agreed-upon procedures report is now allowed to be a general-use report should improve transparency of a government’s operations and provide a better picture of performance.

Conclusion

The flexibilities provided by SSAE 19 for agreed-upon procedures engagements will benefit state and local governments. Removing the requirement to provide written assertions represents significant flexibility for a government to obtain agreed-upon procedures engagements, especially for those programs that do not require costly audit or examination services. The procedures are no longer determined before the beginning of the engagement; instead, SSAE 19 allows the procedures to be developed during the course of the engagement and allows the practitioners to participate in the development process. This should help governments develop procedures that are relevant and current as an engagement progresses and new information becomes available. Additionally, a government can now use the knowledge and experience of practitioners in developing procedures and testing techniques. Finally, SSAE 19 allows practitioners to issue general-use reports that provide additional transparency of a government’s operations and activities.

Khaled Abdel Ghany, CPA, PhD, is an executive accounting adviser for the government of Washington, D.C. He can be reached at drabdelghany@yahoo.com.