Choosing Between Agreed-Upon Procedures vs. Audit

AUPs vs. SOC 2: Brief Overview

An agreed-upon procedure (AUP) is a quick and targeted review of specific business procedures. It is brokered between a client (the responsible party) and a licensed Certified Public Accountant (CPA) firm and must be performed according to AT Section 201 from the American Institute of Certified Public Accountants (AICPA). 

A client may opt for an AUP to obtain factual, unbiased information based on specific procedures. After completion, the accountant issues a report detailing findings without providing an opinion or assurance.

In contrast, a SOC 2 audit report ensures that the engaging companies’ Trust Services Criteria (TSC) of Security, Availability, Processing Integrity, Confidentiality, and Privacy are being addressed and adhered to by their service organization’s internal controls. 

SOC 2 audits come in two types: Type 1 and Type 2. Type 1 assesses whether controls are designed and operating effectively at a specific point in time. Type 2 includes all Type 1 information but also tests the effectiveness of these controls over a period.

AUP and SOC 2 audits are not mutually exclusive, meaning organizations can undergo both if the situation demands. An expert CPA firm like I.S Partners can help you determine which audit you need and whether it makes sense to undergo both.

Below is a summarized comparison of AUPs and SOC 2 procedures.

SOC 2 Audits vs. AUP: Key Differences

SOC 2 audits offer a comprehensive assessment of data security practices, providing high assurance with detailed reports aimed at a broad audience. In contrast, AUPs focus on specific procedures, delivering limited assurance with targeted reports for particular users. 

This comparison highlights the key distinctions in scope, assurance, reporting, and implementation to help you choose the right approach for your needs.

We further dissect the differences between the two processes to help you decide which program fits your current requirements.

Scope 

SOC 2

SOC 2 audits are used to evaluate an organization’s controls across a selected set of TSCs. For instance, if a cloud service provider has its controls assessed based on the security, privacy, and confidentiality principles, every aspect of its data management system, such as user access controls and incident response plans, will be evaluated.

This means a SOC 2 audit has a broader application and a more comprehensive scope. It typically includes assessing all aspects of data access, handling, and security.  

AUP 

AUPs are used in situations where organizations need objective evaluation of specific security practices. They’re highly focused on the company’s needs, which means they have a much narrower scope. 

For instance, if a company is planning to acquire another business, it might request an AUP to review only the target company’s accounts receivable. This will help the company get a detailed report on the specific area it is interested in instead of going through a full audit. 

IS Partners’ Director for Attestation Services highlights when auditors promote undergoing AUPs,

Level of Assurance

SOC 2

SOC 2 audits provide a high level of assurance because they’re thorough and include an impartial auditor’s formal opinion about the data control system. 

For instance, a tech company that undergoes a SOC 2 audit would receive a report that evaluates both the company’s security controls and their effectiveness over a period. This would give stakeholders insights into the control system and learn the actual extent of the compliance. 

AUP

Agreed-upon procedures engagements offer a lower level of assurance compared to SOC 2 because they cover specific areas (as agreed upon by the client) and don’t contain an auditor’s opinion about the effectiveness of the data privacy and access controls. 

These reports present findings related to the procedures performed but don’t provide a macro-level overview of all the company’s control processes. 

This means that while localized issues may be identified and addressed quickly, other potential non-compliant processes or areas might remain undetected, which can expose the company to risks. 

Reporting

SOC 2

SOC 2 reports are comprehensive and detailed. They typically include an in-depth analysis of the organization’s data control environment and the auditor’s opinion on the effectiveness of the controls over time. 

For example, if a healthcare technology company completes a SOC 2 Type 2 audit, the report would talk about the TSC principles used, the control tests, and the results of the tests. The auditor will also provide an opinion on whether the controls are appropriately designed and operating effectively to meet the relevant criteria.

AUP 

An AUP report focuses only on factual findings on the mutually decided scope. The auditor does not provide their opinion and allows stakeholders to draw their own conclusions. 

For instance, if a bank wants an AUP to understand its level of control over cash disbursements, the report would talk only about this process and the steps the auditor took to verify compliance with policies and identify discrepancies. 

Unlike SOC 2 audits, AUP reports also don’t contain the auditor’s overall opinion on the data control and security systems. 

Customizability 

SOC 2

SOC 2 audits test a company’s data security, privacy, and access controls based on the selected TSC. This means SOC 2 has a standardized framework with minimal room for customization. 

For example, a SaaS company may choose to emphasize specific Trust Services Criteria (TSC) such as availability and security, in its SOC 2 audit based on stakeholder or client interests. However, SOC 2 audits cannot include unrelated areas like financial information, as they must adhere to the TSC defined by the AICPA. 

AUP 

An agreed-upon procedures audit can be tailored to meet the exact needs of the client, which means it can be used to test any business process.

For example, if a retail company requests an AUP that focuses only on specific product categories or warehouses to evaluate its inventory management practices, it can do that. The client and the auditor would agree on the specific procedures to be performed beforehand, which can include anything (including financial reporting). 

This high level of customization helps companies spend time and money on investigating only areas they absolutely have to while maximizing the benefits of the review.

Compliance Requirements

SOC 2

SOC 2 audits require organizations to demonstrate that their controls meet predefined Trust Services Criteria (TSC) to ensure robust data protection and operational effectiveness. 

In addition to meeting AICPA requirements, SOC 2 audits can help companies comply with external regulations specific to their industry. For example, healthcare businesses subject to HIPAA can use a SOC 2 audit to show alignment with both HIPAA requirements and the TSC. 

This mapping of SOC 2 criteria to HIPAA standards helps businesses prove their adherence to both internal data privacy and security requirements as well as external regulatory obligations.

AUP 

To navigate these options effectively and determine the best solution for your needs, consult with an expert like IS Partners. With over 20 years of experience, we specialize in helping organizations achieve and demonstrate compliance using our deep industry insights and proven methods.

Application 

SOC 2

A SOC 2 audit is designed to meet the needs of a broad range of users. It provides detailed information and assurance regarding the controls at a service organization. These controls relate to the security, availability, and processing integrity of the systems used to process users’ data. 

The audit also addresses the confidentiality and privacy of the information processed by these systems.

A few of the most common use cases for a SOC 2 audit include the following:

• Organizational oversight
• Vendor management programs
• Internal corporate government and risk management issues
• Regulatory compliance oversight

For instance, a financial services company that works with sensitive data may have to undergo a SOC 2 audit service to ensure that it has controls in place to protect that data and show to stakeholders (like clients, the government, and customers) that it’s committed to data protection.  

AUP 

AUPs are useful for organizations that need to assess specific controls or processes. For instance, they can be used in the following situations: 

• Pursuing a business loan—Banks often need objective and factually based assurances regarding your receivables and inventory, which will serve as collateral for your loan. Your accountant can examine your financial statements in order to generate an objective and candid report for the bank to review.
• Winning contracts and bids—An AUP is ideal for a government contractor who needs an account of your indirect costs during a specific time frame to help determine the rates and cost principles used in SOC 2 compliance with current regulations. A report of a comprehensive indirect cost allocation plan, as well as a job cost accounting system, can help you win and keep the government contracts you need.
• Verifying income tax revisions—Most businesses prefer to defer to the expertise of a reliable third-party auditor when it comes to dealing with the IRS. A CPA can go back through your returns without the stress and anxiety you may be feeling, find any errors, and objectively note what occurred and how you may fix it.

Implementation Time

SOC 2

If you’re going for your first SOC 2 compliance audit, it will take around 12 months, depending on the audit type. This includes the time it takes for the readiness assessment, testing, data collection, and auditing phases. 

But if your company has already gone through SOC 2 before, the implementation time would become shorter—how much depends on the time between your previous audit and the latest one. 

Dive Deeper!

Learn how long does it take to become SOC 2 compliant today!

Read Article

AUP 

Since the procedures are agreed upon in advance and the scope is limited, AUP engagements are usually completed much more quickly, such as within a couple of hours to a few weeks. 

How To Choose Between AUP and SOC 2?

To choose between AUP and SOC 2, identify your audit needs, review stakeholders’ requirements, estimate audit costs and resource availability, determine the audit timeline, and talk to an expert. 

Keep in mind that you don’t necessarily have to choose one audit type over the other, as they are not mutually exclusive. If your situation requires it, you might need both audits at the same time.

Here are more details on the best practices for choosing the right audit for you:

1. Identify Your Business Goals and Audit Needs

The first step is to know what you want to achieve with your audit and how an audit would affect your business goals. 

If you’re looking to assure your clients and stakeholders that their data is being securely managed across multiple domains, SOC 2 would be the right choice because it will help you cover all relevant areas and have an independent auditor verify the security of your systems. 

But if you’re looking to get data on a financial process before a merger, an AUP engagement would be better because it has a narrower scope and a faster turnaround time. It will provide the precise information you need without the additional expense and time of a full audit.

2. Review Stakeholders’ Requirements 

If you work in a heavily regulated industry like finance or healthcare, you’ll need to comply with specific data protection regulations like HIPAA and demonstrate compliance to stakeholders like business partners. A detailed SOC 2 audit will help you assure authorities and partners that you are taking all possible measures and avoid legal action.

If stakeholders need specific proof of adherence to a contract clause or regulation, an AUP’s narrower focus can demonstrate compliance effectively. Organizations in regulated industries may need both audit types to meet all requirements.

3. Estimate Audit Costs and Resource Availability 

Analyze the cost of the audit (direct costs like auditor fees and indirect costs like internal resources and time). For instance, if you’re going with SOC 2, you may find that indirect costs, like dedicating people to prepare for and manage the audit process, could outweigh the direct costs.  

You will also need to consider your ability to allocate personnel and time for the audit process. For a SOC 2 audit, this might involve assigning dedicated project managers, IT specialists, and compliance officers to oversee the audit from start to finish. 

In contrast, an AUP will require fewer resources and could be completed with a smaller team. This makes it a better option if you don’t have a large team or enough time to focus on a SOC 2. 

4. Determine the Audit Timeline 

Consider the audit timeline to ensure the audit procedures don’t disrupt your business activities. SOC 2 audits take at least six months to a year to implement, depending on the type you’re going for, which is an important consideration for business owners. 

Type 1 audits can be completed much more quickly than type 2, which usually take six months or more. During this time, your team will need to be actively involved in the audit process and may not be able to pay attention to their normal tasks, which may cause disruptions. 

In contrast, AUPs take a few weeks because they have a limited scope. This means you can conduct these audits even if you’re in the middle of launching a new product or entering a new market. 

5. Talk to an Expert

If you’re unsure which review—agreed-upon procedures (AUP) or a full audit—best suits your goals, compliance needs, budget, and timeline, consulting an auditing expert can clarify the options.

For example, if you’re an e-commerce startup questioning the need for a SOC 2 audit at this stage, an expert can evaluate your business model, client expectations, and regulatory requirements to recommend the best approach.

They can also advise on combining both SOC 2 and AUP audits if that’s the best fit for your situation.

Ace Every System Assessment with IS Partners

Choosing the right audit approach is crucial for protecting your data, meeting compliance standards, and building trust with clients and stakeholders. Agreed Upon Procedures (AUPs) allow for targeted assessments of specific areas, while SOC 2 audits provide a comprehensive evaluation of controls, underscoring your commitment to data security, privacy, and availability.

Both audits are invaluable in elevating your organization’s credibility and compliance.

At IS Partners, we specialize in guiding organizations through these decisions. Our 20 years of experience, combined with a fully U.S.-based audit team, ensures you receive insights that help you make informed choices and optimize your audit journey.

Ready to get started? Book a free consultation with our experts, and let’s design a customized audit strategy that meets your unique needs effectively.

About The Author

Jena Andrews

Jena is a senior auditor and security consultant since 2021. She is specialized in compliance management, cybersecurity, IT security, and risk management. Jena is a certified information systems auditor (CISA) and project manager.

With a decade-long history in Project Management, Jena has focused the past five years on Compliance, IT and Operations auditing, Information Security, and Cybersecurity. She has conducted a plethora of compliance audits and security assessments in accordance with standards including SOC 1, SOC 2, HIPAA, PCI DSS, ISO 27001, and NIST 800-53, 800-171.

Jena is a proud B.S. graduate in Criminal Justice from West Chester University and holds esteemed CISA, PMP, and CCP certifications, further highlighting her expertise and commitment to professionalism.