Practitioner Alert – Agreed-upon Procedures Engagements and Obligations under the CPA Code of Professional Conduct

Standards on Specified Auditing Procedures will be replaced by the new related services standard CSRS 4400, Agreed-upon procedures. Applies to engagements agreed on or after January 1, 2022

What has changed? In August 2020, the Canadian Auditing and Assurance Standards Board (AASB) approved CSRS 4400, Agreed-upon procedures (AUP) Engagements standard for issuance in the CPA Canada Handbook – Assurance. This new standard is effective for agreed-upon procedures engagements for which the terms of engagement are agreed on or after January 1, 2022 and will replace:

• Section 9100, Reports on the Results of Applying Specified Auditing Procedures to Financial Information other than Financial Statements (SAP); and
• Section 9110, Agreed-Upon Procedures Regarding Internal Control Over Financial Reporting.

Similar to the Specifed Auditing Procedures engagements, in an AUP engagement,

• the practitioner does not express an assurance conclusion, but instead performs the procedures that have been agreed with the engaging party as being appropriate for the purpose of the agreement;
• the practitioner communicates the procedures performed and the findings in the AUP report; and
• users of the AUP report consider the findings based on the procedures performed and draw their own conclusions.

However, CSRS 4400 is more detailed in terms of requirements and application material as compared to Section 9100. The new AUP standard introduces specific conditions for accepting or continuing the AUP engagement, and recognizes that the practitioner may agree with the engaging party that compliance with independence requirements is appropriate for the purpose of the AUP engagement. The scope of CSRS 4400 is also broader and addresses engagements related to either financial or non-financial matters whereas the current Specifed Auditing Procedures standards address financial information other than financial statements and internal controls over financial reporting.

Is Independence required for AUP engagements?

The CPA Code of Professional Conduct ( the CPA Code) does not currently address whether a practitioner is required to be independent when performing an AUP engagement under CSRS 4400. The CPA Code requires practitioners to be independent when performing “a specified auditing procedures engagement as contemplated by the CPA Canada Handbook – Assurance.” With the removal of Sections 9100 and 9110 from the Handbook, references to Specified Auditing Procedures Engagements in the CPA Code will need to be addressed and these changes might have accompanying public interest considerations. While these matters are being addressed by the profession, there are a number of other provisions in the CPA Code that will continue to apply to AUP engagements and serve to protect the public. This alert highlights practitioners’ continuing obligations under the CPA Code until these matters are resolved.

CSRS 4400 requires compliance with the relevant ethical requirements which would, at a minimum, require the practitoner to be objective when performing an AUP engagement. CSRS 4400 does not include a pre-condition for the practitioner to be independent, however laws or regulations, other professional requirements, or conditions of a contract, program or arrangement may set out independence requirements with which practitioners need to comply.

Even if there are no such independence requirements, a practitioner’s knowledge of certain matters may nonetheless indicate that it may be appropriate to discuss with the engaging party whether the practitioner needs to comply with certain identified independence requirements for the purpose of the AUP engagement.
CSRS 4400 recognizes that the engaging party, in consultation with the practitioner, may require and/or establish independence requirements that are appropriate for the purpose of the AUP engagement. The new standard requires practitioners to have extensive discussions with engaging parties, and to agree and document the terms of AUP engagements in an engagement letter or other suitable form of written agreement. Specific requirements for the matters to be included in the terms of the engagement are set out in the standard, however, those related to independence and objectivity are highlighted below:

• Acknowledgement of the relevant ethical requirements with which the practitioner will comply in conducting the agreed-upon procedures engagement, and;
• A statement as to whether the practitioner is required to comply with independence requirements and, if so, the relevant independence requirements.

CSRS 4400 also requires a statement in the AUP report with respect to whether or not independence was required, and if so, the relevant independence requirements with which the practitioner had to comply.

What if the engaging party requires independence?

When considering engagement acceptance and continuance or agreeing on the terms of an engagement, the practitioner’s knowledge of the following matters may indicate that a discussion with the engaging party regarding compliance with relevant independence requirements is appropriate for the AUP engagement:

• the purpose of the AUP engagement;
• the identities of the engaging party, the responsible party and other intended users of the AUP report, if any, and;
• other engagements that the practitioner has performed or is performing for the engaging party, responsible party, or other intended users of the report, if any.

If it is determined that the practitioner is required to be independent, it will also be important to agree on the relevant independence requirements and to document these in the engagement letter.

Rule 204, Independence takes a layered approach that results in three levels of independence.

The portions of Rule 204 relating to “all assurance engagements” form the base independence requirements, with an additional layer of requirements that apply to “all audits/reviews” of financial statements and a final layer that applies to “reporting issuer/listed entity” clients. The relevant independence requirements for a particular AUP engagement could be based on one of these levels or could be more specific. For example, the relevant independence requirements for an AUP engagement might be agreed to include only those provisions of Rule 204 that apply to members of the AUP engagement team and their immediate family members.

As with all matters involving the exercise of professional judgment, the practitioner’s consideration of these matters and the related discussions should be documented.

What are my obligations under the CPA Code?

Rule 206, Compliance with Professional Standards

Rule 206.1 requires members and firms to perform professional services in accordance with generally accepted standards of practice of the profession. In this regard, CSRS 4400 as issued in the Handbook will be the generally accepted standard of practice in Canada for the performance of AUP engagements. Accordingly, practitioners must ensure that they are sufficiently familiar with its requirements to ensure compliance.

Rule 202.2, Objectivity

CSRS 4400 states that “relevant ethical requirements to which the practitioner is subject would, at a minimum, require the practitioner to be objective when performing an agreed-upon procedures engagement”.

A practitioner performing an AUP engagement is required to comply with the fundamental principles of the CPA Code, including objectivity, which requires that members and firms not allow their professional or business judgment to be compromised by bias, conflict of interest or the undue influence of others.

The practitioner is required to exercise professional judgment in accepting, conducting, and reporting on an AUP engagement. The new requirements introduce specific conditions for accepting or continuing the AUP engagement that must be met. Practitioners are required to understand the purpose of the engagement and decline the engagement if facts and/or circumstances indicate that the procedures are not appropriate for the purpose of the engagement. Professional judgment is exercised in areas such as discussing and agreeing with the engaging party (and if relevant, other parties) the nature, timing and extent of the procedures to be performed, whether independence is needed, and if so the relevant independence requirements.

In accepting or continuing an AUP engagement, a practitioner will need to consider a wide range of activities, interests and relationships that might impact objectivity. For example, any involvement by the practitioner in the subject matter of the AUP engagement should trigger consideration of whether the practitioner is objective.

Rule 210, Conflicts of Interest

In addition to the requirement to have an objective state of mind, with respect to conflicts of interest, the profession employs the criterion of whether a reasonable observer would conclude that a specified situation or circumstance posed an unacceptable threat to a member’s or firm’s objectivity and professional judgment.

Before undertaking an AUP engagement, practitioners are required to determine whether a conflict of interest exists between themselves and the client, two or more clients, or the client and a third party. A conflict of interest means an interest, restriction or relationship that, in respect of the provision of any professional service, would be seen by a reasonable observer to influence a member’s or firm’s judgment or objectivity in the provision of the professional service. If the conflict cannot be managed to the satisfaction of all affected parties, then the member or firm must decline the engagement.

Assessing compliance with Rules 202.2 and 210 requires the exercise of professional judgment. Practitioners will find helpful guidance in exercising such judgments by referring to the framework included in the Guidance to Rules 204.1 to 204.3 which is used to identify threats to independence and apply safeguards to eliminate or reduce threats to an acceptable level, even though applying that framework is not specifically required when assessing objectivity or conflicts of interest.

Rule 204.10, Disclosure of Impaired Independence

Members and firms who provide a professional service which does not require the member or firm to be independent are required by Rule 204.10 to disclose any activity, interest or relationship which, in respect of the professional service, would be seen by a reasonable observer to impair the member’s or firm’s independence.

Accordingly, while Rule 204 does not specifically require independence when a member or firm performs an AUP engagement, they must still consider whether there exists possible impaired independence which would require disclosure.

Sample Situations and Considerations

A member is asked to undertake an agreed-upon procedures engagement related to a lawyer’s compliance with trust account requirements after having already performed bookkeeping for the same lawyer. The bookkeeping service included recording client trust account transactions and preparing the related regular reporting to clients. In this case, the member would compromise their objectivity by reviewing and reporting on the integrity and accuracy of their own work.

The Controller[1] of Company X, the largest shareholder of Company Y, issues a report to tenants on the results of applying agreed-upon procedures to Company Y’s common area maintenance expenses. In this case, there is a conflict between the interests of the member’s employer and the users of the report (the tenants). As a result of this conflict, a reasonable observer would likely conclude that the Controller cannot remain objective.

A firm that has been asked to perform an AUP engagement on a charitable organization’s compliance with the terms of a grant has a partner who is a Board member of that charitable organization. This relationship creates a conflict of interest and threatens objectivity. The terms of the AUP engagement might not establish a requirement for independence on the part of the firm, however the firm is required to be objective. The firm might be able to maintain objectivity and manage the conflict if it implements conflict management techniques such as a firewall, discloses the relationship, obtains informed consent and complies with all of the discussion, documentation and reporting requirements of CSRS 4400 and Rules 210 and 204.10.

An internal auditori routinely prepares reports on compliance with debt covenants for review by the Audit Committee. Her employer has asked her to issue an AUP report on those same covenants to satisfy the lender. A conflict of interest exists between the internal auditor’s employer and the lender. As a result of this conflict, a reasonable observer would likely conclude that the internal auditor cannot remain objective.

A firm has been asked to perform an AUP engagement on a real estate broker’s compliance with trust account regulations, however, the broker is the daughter of one of the partners of the firm. This relationship creates a possible conflict of interest and threatens objectivity. The terms of the AUP engagement might not establish a requirement for independence on the part of the firm, however the firm is required to be objective. The firm might be able to maintain objectivity and manage the conflict if it implements conflict management techniques such as a firewall, discloses the relationship, obtains informed consent and complies with all of the discussion, documentation and reporting requirements of CSRS 4400 and Rules 210 and 204.10

Footnotes

1. These examples assume compliance with any bylaws or other governing documents in the jurisdiction that might require registration of a public practice firm when performing an AUP engagement.