ISRS 4400 Agreed-Upon Procedures Report for a Donor

Donors increasingly ask grantees for an agreed-upon procedures (AUP) report instead of a full audit. In this format the auditor does not evaluate the financial statements as a whole; the auditor performs a specific list of checks agreed with the engaging party and reports what was found.

For organisations the format is convenient: it matches more precisely what the donor actually wants to know and usually takes less time than an audit. But it has its own rules, and confusion between a “4400 report” and an “audit opinion” regularly leads to misunderstandings with grant-makers.

This article covers what ISRS 4400 is, how an agreed-upon procedures engagement differs from an audit, how the report is structured, when a donor requires it, and how to agree the procedures properly so that the report meets expectations.

What ISRS 4400 is

ISRS 4400, International Standard on Related Services 4400 “Agreed-Upon Procedures Engagements”, is issued by the International Auditing and Assurance Standards Board (IAASB). It governs engagements in which a practitioner performs procedures agreed with the engaging party and, where relevant, other intended users, and reports the factual findings.

The standard was revised in 2020: ISRS 4400 (Revised) applies to engagements whose terms are agreed on or after 1 January 2022. The revised standard clarified the requirements for wording procedures, for practitioner independence and for the content of the report. Ukraine applies the international standards as national standards, so Ukrainian auditors perform these engagements under ISRS 4400.

The defining feature of the engagement is that the auditor provides no assurance. The auditor does not say “the statements are fairly presented” or “the costs are eligible”. The auditor says: “we compared 40 payment orders with contracts and found that in 2 cases the amount differed”. Conclusions from those facts are drawn by the user of the report, that is, the donor.

How agreed-upon procedures differ from an audit

Criterion	Audit (ISA 700, 800, 805)	Agreed-upon procedures (ISRS 4400)
Output	Audit opinion (unmodified or modified)	Report of factual findings, no opinion
Level of assurance	Reasonable assurance	No assurance
Scope of work	Determined by the auditor based on risk assessment	Determined by the parties when agreeing the procedures
Independence	Mandatory	Not required by the standard, but may be required by the donor or by law
Who judges sufficiency	The auditor	The users of the report
Typical use	Annual financial statements, special purpose project audit	Grant expenditure verification, verification of specific items

In practice both formats coexist in grant-funded projects. If the donor wants an auditor’s opinion on the project financial report, an audit under ISA 800 or ISA 805 (special purpose frameworks, single elements of a financial statement) is commissioned. If the donor needs a detailed check of transactions against its own list, ISRS 4400 is more suitable. We describe both formats on our grant audit page.

When a donor requires an ISRS 4400 report

• European Union grants. The standard Terms of Reference for expenditure verification refer directly to ISRS 4400.
• UN agencies and European government donors. Often offer a choice between an audit and AUP depending on the amount and risk of the project.
• Private foundations. Use AUP when they need specific issues checked: procurement, sub-grants, staff costs.
• Internal needs of the organisation. The governing body of an NGO or a business may commission agreed-upon procedures to check a department, a partner or a contractor.

The general rule: AUP are appropriate when the user knows exactly what needs to be checked and is prepared to draw conclusions independently. If an independent overall opinion is required, choose an audit.

Structure of the report of factual findings

ISRS 4400 (Revised) prescribes the mandatory elements of the report. It must include:

1. a title clearly indicating that it is a report of factual findings on an agreed-upon procedures engagement;
2. the addressee (usually the engaging party and, by agreement, the donor);
3. identification of the subject matter: the project financial report, the list of expenditure, the period;
4. the purpose of the engagement and a statement that the report may not be suitable for other purposes;
5. a reference to ISRS 4400 and a statement that the engagement is not an assurance engagement and therefore no opinion is expressed;
6. a statement on compliance with ethical requirements and on independence (or on its absence, if it was not required);
7. a description of the responsibilities of the engaging party and of the practitioner;
8. the procedures performed, as agreed, including a description of the sample and thresholds;
9. the factual findings for each procedure, including exceptions in sufficient detail;
10. a restriction on use and distribution of the report, where applicable;
11. the signature, the name of the audit firm, the location and the date.

Donors often have their own template in which procedures and findings are presented as a table: the procedure on the left, the finding and exceptions on the right. This format lets the donor’s programme manager quickly spot problem areas.

How to agree the procedures: step by step

Step 1. Identify the users

Establish who will read the report and what matters to them. If it is a donor with its own ToR, the procedures are largely predefined, and the organisation’s task is to check whether the ToR contain anything that cannot be performed on your accounting records.

Step 2. Word the procedures precisely

The standard requires procedures to be described in terms of actions that give an unambiguous result: “compare”, “agree”, “recalculate”, “obtain confirmation”. Wording such as “assess reasonableness” or “verify correctness” is unsuitable because it implies professional judgement rather than fact.

Step 3. Agree the sample and thresholds

If a procedure is performed on a sample, the engagement letter records the sampling method, the sample size or minimum coverage ratio, and the threshold for reporting exceptions.

Step 4. Sign the engagement letter

The terms of the engagement, the list of procedures, the report format and restrictions on use are recorded in writing. Procedures can be changed after work begins, but only with the written consent of all parties.

Step 5. Prepare the documents

Organising documents by procedure saves time and reduces the number of exceptions caused by “not found”. If you keep the project accounts in-house, pay attention to analytics by donor budget line. For organisations without an in-house accountant we offer accounting for NGOs and businesses tailored to donor requirements.

Typical mistakes when commissioning a 4400 report

• The organisation expects a “conclusion on eligibility of costs” and receives a list of facts instead. Explain the format to the donor in advance.
• Procedures are worded too broadly and the parties interpret the result differently.
• The report language is not agreed: many donors need an English text. MK Audit prepares reports in Ukrainian and English.
• The donor is not among the addressees and refuses to accept a report addressed only to the organisation.
• The auditor is engaged in the last week before the reporting deadline, with no time to resolve exceptions.

Need an ISRS 4400 report for a donor or help drafting the procedures? Leave a request: after reviewing the task we will send you a commercial proposal. We reply within 1 business day.