Agreed-upon procedures can be appropriate when a specified party needs factual findings about a particular schedule, transaction, control, or compliance matter. The procedures are agreed in advance, and the report presents findings rather than an audit opinion on the financial statements as a whole.
Specialized needs may call for a different service alongside financial reporting work. SOC 2 examinations address service-organization controls, while forensic accounting focuses on specific financial questions or allegations. Clear scope helps the organization engage the right expertise without treating these services as substitutes for one another.
Audit & Assurance Frequently Asked Questions
What audit and assurance services are available beyond a financial statement audit?
Other attest services include reviews, compilations, agreed-upon procedures, examinations, and support for new accounting standard implementation. Broader assurance work can include outsourced or co-sourced internal audit, regulatory compliance, loan review, enterprise risk assessments, financial due diligence, fraud investigations, forensic accounting, expert witness services, and SOC 2 audits.
How can an organization strengthen internal audit coverage without adding permanent headcount?
Outsourcing or co-sourcing can supplement internal capacity and provide targeted specialists for technical or emerging risks. Relevant areas can include cybersecurity, technology governance, regulatory and compliance risk, fraud risk management, data privacy, and emerging technology. Internal leadership can retain direction and continuity while specialist resources support execution.
How can audit, compliance, risk, finance, and IT coordinate without combining their roles?
An aligned assurance model coordinates work across functions while preserving each function’s authority and accountability. Practical steps include inventorying assurance providers, aligning the risk universe and plans, standardizing reporting, using existing governance forums, and sharing findings and completed testing. The result is less duplication and a more unified view of risk and control effectiveness for leadership.
How should an organization use a vendor’s SOC report in third-party risk oversight?
First confirm that the report covers the specific service or system used and the relevant reporting period. Then review the issuing firm’s credibility, the auditor’s opinion, complementary user entity controls, testing results, exceptions, and remediation. The report should support ongoing vendor monitoring, audit planning, risk assessment, and follow-up when control gaps or unresolved issues are identified.
What audit and assurance support may be relevant during a transaction, fraud matter, or dispute?
Financial due diligence can support transaction evaluation, while fraud investigations and forensic accounting can address financial irregularities. Expert witness support may be relevant in disputes, and related internal control, compliance, or financial analysis work may be needed as the matter develops. The applicable work should align with the financial, operational, compliance, or reporting question under review.
