Independent findings a board, lender or investor can act on — facts, procedure by procedure, not an opinion.

An agreed-upon procedures engagement under ISRS 4400 (Revised) answers the questions you actually have — is the collateral there, do the cash flows match the projections, does the file look the way a bank will expect — and reports what was found, procedure by procedure. It is not an audit and not an assurance engagement; that is the point: the scope is yours, the findings are factual, and the report says exactly what was done.

Who it is for

• Fiduciary estates and securitisation compartments: an investor, trustee or board wants an independent check on the underlying assets, security documents and collections before a distribution, a refinancing or a dispute.
• Funds in liquidation: the liquidator or the general meeting needs the closing position examined on defined procedures rather than re-examined from scratch.
• Non-EU groups entering the EU: a factual review of an EU obligation — GDPR readiness, the EU AI Act, a compliance framework — before committing budget.
• Boards and lenders: covenant, ratio or use-of-proceeds checks; grant and subsidy cost verifications; damages quantification support in a dispute.
• Companies preparing for bank onboarding: a look at the compliance profile from the bank's side before the questionnaire arrives.

What you receive

• Agreed-upon procedures report — the practitioner's report in ISRS 4400 wording, one section per procedure in the order of the engagement letter, each with numbered key findings, work performed and evidence references. Before the 2022 revision this document was called a "report of factual findings"; the substance is similar, the required content is fuller.
• Findings register — every finding with quantum or effect, evidence reference and suggested action; also delivered as a workbook.
• Evidence index and note on documents received — what was received, what was reviewed, what was excluded and why.
• Schedules workbook — the tables behind every figure in the report, with a tie-out.
• Where useful, an information-request list the client can pass to a counterparty or bank.

How it runs

Indicatively four to eight weeks.

1. Scoping call. What decision the findings feed, who will read the report, what evidence exists.
2. Engagement letter. The procedures written out verbatim, sources, limitations, intended users. Nothing outside the letter goes in the report.
3. Delivery. Evidence intake and indexing, procedures performed, draft findings shared for factual accuracy — not for negotiation.
4. Review session. Findings walked through with the addressee; the register handed over.

Independence

VieKey does not accept an agreed-upon procedures engagement on a vehicle, fund or company for which it acts, or has acted, as adviser or in an accounting or company-secretarial role. Conflicts are checked before the engagement letter is issued.

Representative matters

Independent review of a securitisation compartment's loan portfolio (ISRS 4400) — A Luxembourg securitisation vehicle needed an independent, factual review of one of its compartments. The compartment finances receivables portfolios, which it holds through secured loans to specialised buyer-servicers. VieKey carried out agreed-upon procedures covering title to the underlying assets, the security and servicing agreements, cash collected against the manager's projections, and the reported economic value of the portfolios. The client received a report of factual findings with procedure-by-procedure evidence mapping.

AI adoption in EU financial services: independent review (ISRS 4400) — A technology group needed a factual view of how EU financial institutions are adopting AI under the EU AI Act. VieKey carried out an agreed-upon procedures engagement covering risk classification, provider and deployer obligations, human oversight and the application timeline, alongside adoption patterns in banking, funds and corporate services. The client received a report of factual findings and used it to prioritise target segments before entering the market.

Bank-readiness compliance review (ISRS 4400) — A company in the medical-devices sector wanted to know how its compliance profile would look to banks during onboarding and ongoing due diligence. VieKey carried out an agreed-upon procedures engagement in three parts: a risk assessment from the bank's perspective, following the FATF risk-based approach; recommendations for improvement; and reporting of findings. The client received a report of factual findings together with a targeted information-request list, giving it a clear remediation agenda before approaching banks.

Where the text and practice diverge

• ISRS 4400 (Revised) says the practitioner does not express assurance. In practice addressees read a findings report as if it did; the engagement letter and the report's restricted-use wording are what keep the two apart, and we spend time on both.
• The standard requires the procedures to be agreed with the engaging party; lenders and investors often want to add procedures after the letter is signed. The workable answer is a short supplementary letter, not a widened report.
• A Luxembourg commissaire mandate and an AUP engagement are different instruments. Where a general meeting needs a commissaire à la liquidation, the AUP report does not substitute — see liquidation.

Next step

Request a sample AUP report — a redacted table of contents, sent by email — or book a 20-minute scoping call.