Agreed-Upon Procedures (AUP) Engagements in UAE

ISRS 4400 (Revised), No Opinion Given & Common UAE Use Cases — 2026 Guide

📋 Introduction to AUP Engagements in the UAE

An Agreed-Upon Procedures engagement is the one type of assurance-adjacent work that deliberately doesn't give you an opinion. Under ISRS 4400 (Revised), the practitioner performs only the specific procedures that have been agreed in advance with the engaging party, and reports what they found — factually, mechanically, without interpretation. If you ask an AUP practitioner whether your inventory count looks "reasonable," you won't get an answer to that question. You'll get: "we counted 500 units of Item A, against a book record of 512." The reader draws their own conclusion from that fact.

This makes AUP genuinely useful in situations a full statutory audit would be overkill for, but where someone — a bank checking loan covenant compliance, a grant funder verifying how their money was spent, a franchisor checking royalty calculations, or RERA reviewing a developer's escrow account — needs independent, objective verification of something narrow and specific. The standard itself was substantially revised in 2022, tightening how procedures get agreed, documented, and reported, including a genuinely practical change: only the party who actually commissions the engagement needs to agree the procedures now, not every downstream reader of the report.

This guide breaks down exactly how AUP engagements work in the UAE in 2026 — what ISRS 4400 (Revised) actually requires, how AUP differs from an audit or review, the common UAE use cases (including how RERA escrow reviews are frequently structured this way), and the practical process from scope agreement to final report. If you'd rather have specialists scope and deliver an AUP engagement for your business, our audit & assurance team works with businesses across the UAE.

📖 What an AUP Engagement Actually Is (and Isn't)

• An AUP engagement is a non-assurance engagement — the practitioner performs specific procedures on financial or non-financial subject matter and reports the factual findings.
• It is explicitly not an audit, a review, or any other assurance engagement — it does not involve gathering evidence for the purpose of expressing an opinion or assurance conclusion of any kind.
• The practitioner acts as a fact-finder, not a judge — if an error is found, it's simply reported; the finding is the finding.
• The reader of the report is responsible for drawing their own conclusions from the facts presented, not the practitioner.

🔀 AUP vs Audit vs Review: The Three-Way Comparison

📜 The Governing Standard: ISRS 4400 (Revised)

• The governing standard is ISRS 4400 (Revised) — Agreed-Upon Procedures Engagements, issued by the IAASB.
• ISRS 4400.14 establishes the core scope: agree on specific procedures, perform them, and report findings of fact.
• The revised standard is effective for engagements where terms are agreed on or after 1 January 2022.
• ISQM 1 (quality management requirements) applies to firms performing AUP engagements under ISRS 4400.35, the same quality control foundation that applies to audit work.

🆕 What Changed in the 2022 Revision

• The revision responded to growing demand for AUP engagements, particularly around increased accountability for funding and grants — a wide range of stakeholders (regulators, funding bodies, creditors) use these reports.
• Enhancements included: sharper guidance on the exercise of professional judgment, clearer compliance with independence requirements, more defined engagement acceptance and continuance considerations, rules on using the work of a practitioner's expert, and greater clarity and transparency required in the AUP report itself.
• A genuinely practical technical change: under ISRS 4400 (Revised) paragraph 16(b)(ii), only the engaging party now needs to agree to the procedures — the previous requirement for every other intended user to individually agree was removed, easing multi-stakeholder situations like grant reporting.

🎯 The "No Subjective Interpretation" Rule

• ISRS 4400.A20 requires that procedures be described in a way that doesn't involve subjective interpretation — the practitioner should be able to perform them mechanically, without exercising judgment about what the result means.
• This is what keeps an AUP engagement from quietly turning into an unauthorized assurance engagement — "count the units in the warehouse" is a valid AUP procedure; "assess whether inventory levels are appropriate" is not, since that requires judgment and interpretation.
• Professional judgment is still required throughout the engagement itself (ISRS 4400.18 and .24) — in how procedures are performed and documented — but not in forming a conclusion about what the findings mean.

🏢 Common UAE Use Cases for AUP Engagements

🏦 RERA Escrow Reviews: A Real-World UAE Application

• Dubai's real estate escrow framework, under Law No. 8 of 2007, requires annual review of developer escrow accounts by RERA-approved firms.
• In practice, much of this review work follows an AUP-style structure: verifying that investor inflows and contractor outflows match certified project progress, and assessing whether reserve assets meet the liquidity requirements mandated by RERA.
• This connects directly to fund accounting principles covered in our guide on bookkeeping for home building companies — the escrow review itself is often where AUP-style factual verification meets project-specific fund accounting.

🧭 The AUP Process: Scope Agreement to Report

1. Identify the Specific Concern

   What exactly needs independent verification, and for whom.

2. Agree the Procedures With the Engaging Party

   The single most important step; procedures must be specific, objective, and free of subjective interpretation.

3. Confirm Preconditions Are Met

   Under ISRS 4400.16, before accepting the engagement.

4. Sign the AUP Engagement Letter

   Documenting the agreed scope, procedures, and intended report distribution.

5. Perform the Agreed Procedures

   Exactly as agreed, without variation.

6. Document Findings

   Factual, objective, free of interpretation or conclusion.

7. Issue the AUP Report

   Listing each procedure performed and its corresponding factual finding.

8. Distribute to Specified Parties Only

   AUP reports are typically restricted in distribution, since outside parties may not understand the specific context.

✍️ The Engagement Letter & Preconditions

• The scope must be documented in an engagement letter signed by all relevant parties before work begins.
• ISRS 4400.16 sets out specific preconditions the practitioner must confirm before accepting or agreeing to undertake the engagement.
• Unlike an audit engagement letter (which sets scope for an entire financial statement examination), an AUP engagement letter is narrowly focused on the exact procedures being performed — nothing more, nothing less.

🚫 When a Practitioner Must Refuse or Withdraw

• ISRS 4400.19 and .20 set out circumstances where a practitioner must refuse to accept, or must withdraw from, an AUP engagement.
• This typically arises where the requested procedures can't be described without requiring subjective interpretation, effectively asking the practitioner to provide assurance without properly scoping it as an assurance engagement.
• A practitioner declining to phrase a procedure the way a client wants isn't being difficult — it's often the standard doing exactly what it's designed to do.

⚖️ Independence: Is It Required for AUP?

• Unlike a statutory audit, independence is not an absolute, universal requirement for every AUP engagement under ISRS 4400.
• Compliance with applicable independence requirements is still addressed as part of engagement acceptance, and many engaging parties (banks, regulators) will require it regardless, even where the standard itself doesn't mandate it categorically.
• Practically, most UAE AUP engagements are still performed by independent practitioners, since that's usually what gives the report credibility with the intended reader.

📄 The AUP Report: What It Actually Contains

• The report lists each procedure performed and the corresponding factual finding — nothing more.
• No opinion, conclusion, or assurance statement is included, by design.
• ISRS 4400.30 sets out the mandatory elements the report must contain, with the revised standard requiring greater clarity and transparency than the previous version.
• Distribution is typically restricted to the specified parties who agreed to or were identified in connection with the procedures, since the report's narrow scope can be misleading if read out of context by someone unfamiliar with it.

⏱️ Timeline & Cost of an AUP Engagement

• Most UAE AUP engagements complete within 2–3 weeks of scope agreement, depending on the complexity of the procedures and data availability.
• Cost is typically driven by the number and complexity of procedures agreed, rather than the size of the underlying business, since scope is narrow and defined upfront.

⚠️ Common Mistakes When Commissioning an AUP

• Requesting procedures phrased in a way that requires subjective interpretation, effectively asking for an audit opinion disguised as an AUP.
• Assuming an AUP report carries the same weight or credibility as an audit opinion when presenting it to a third party who expects the latter.
• Skipping proper agreement of procedures with the engaging party before work begins, leading to scope disputes later.
• Distributing the AUP report to parties who weren't part of the original agreement, risking misinterpretation of findings taken out of context.
• Assuming independence never matters for AUP, when many banks, regulators, and grant funders specifically require it regardless of the standard's own flexibility.

💼 How One Desk Solution Can Help

Scoping an AUP engagement correctly — agreeing procedures that are specific, objective, and genuinely fit for purpose — makes the difference between a useful report and a disputed one. Our audit and assurance services team designs and delivers AUP engagements under ISRS 4400 (Revised) for bank compliance, grant verification, royalty audits, and RERA escrow reviews, supported by our accounting & bookkeeping services for the underlying records, our tax services team for related compliance, and our advisory & consultancy services for deciding whether AUP or a full audit fits your need. Explore our full range on the services page.

❓ Frequently Asked Questions

🔗 Related Resources