Audit, Review, Compilation or Agreed-Upon Procedures? Which Report Your Business Needs and Who Accepts It

Many business owners ask for an “audit” and mean different things: one wants a report the Ministry of Commerce will accept, another wants professionally prepared financial statements for the bank, a third wants someone to verify a single figure in a dispute with a partner. Each of these purposes calls for a different professional engagement, under a different standard, with a different report and a different cost. Choosing the wrong one means either paying for more than you need, or handing in a report the requesting party will not accept.

The standards adopted in Saudi Arabia — according to the Saudi Organization for Chartered and Professional Accountants (SOCPA) — are the international standards on auditing, review, other assurance and related services, with limited modifications that do not change their substance. This guide explains the four engagements that cover most of what small and medium-sized businesses need, then answers the practical question: who accepts which report in Saudi Arabia?

First: the four engagements in one table

Engagement	Adopted standard	Level of assurance	How the report concludes	What the CPA does
Audit	International Standards on Auditing (ISAs)	Reasonable assurance — the highest	A positive opinion: the statements “present fairly, in all material respects”	Understands the entity and its internal control, assesses the risks of misstatement, tests evidence, obtains confirmations, attends the inventory count, then gives an independent opinion
Review	ISRE 2400 (Revised)	Limited assurance	A conclusion in negative form: “nothing has come to our attention that causes us to believe…”	Mainly inquiries of management and analytical procedures, without detailed testing of evidence
Compilation	ISRS 4410 (Revised)	No assurance	A report stating that the accountant assisted management in preparing the statements under the framework, with no opinion or conclusion	Applies accounting expertise to turn management’s records into properly presented financial statements
Agreed-upon procedures (AUP)	ISRS 4400 (Revised)	No assurance	A report of factual findings from specific procedures agreed in advance	Performs the agreed procedures exactly as specified on particular items and reports what was found, leaving the reader to draw conclusions

Second: what does “assurance” actually mean?

Reasonable assurance in an audit is a high level of assurance but not an absolute one. The auditor plans the work to reduce the risk of not detecting a material misstatement to an acceptably low level, but works on a sampling basis and on persuasive rather than conclusive evidence, which is why the auditing standards say expressly that an audit is not a guarantee that every fraud or error will be found. Limited assurance in a review is considerably lower, because its procedures are mainly inquiries and analytics rather than tests of documents; that is why its conclusion is worded in the negative: nothing has come to our attention. Compilation and agreed-upon procedures provide no assurance at all: the first delivers statements prepared with professional expertise, the second delivers facts, not conclusions.

The practical difference for the reader: a third party who does not know the business can rely on an audit report because an independent opinion has been given; a review report gives less comfort; a compilation report tells the reader only that a qualified accountant prepared the statements from management’s data; and an AUP report can only be understood by reading the procedures themselves, which is why its use is usually restricted to the parties that agreed them.

Third: who accepts which report in Saudi Arabia?

• The Companies Law and the Qawaem platform: the rule is that every company has a licensed auditor appointed by the partners or the general assembly (Article 18 of the Companies Law), and that financial statements are prepared under the adopted accounting standards and filed within six months of the year end (Article 17). Micro and small companies are exempt from the obligation to appoint an auditor (Article 19) — unless their articles say otherwise, or they are listed, foreign, or own or are owned by another company, or are required to be audited under other laws — and partners holding 10% of the shares may demand an auditor despite the exemption. We covered the thresholds in when a company must appoint an auditor and filing on Qawaem. An exempt company still needs properly prepared statements to file with the manager’s declaration, and a compilation is usually enough.
• Contractor classification: the Contractors Classification Law makes financial statements the basis for assessing “financial capacity” (Article 6), and its regulation requires the statement of financial position and the income statement for the latest year to be certified by a licensed chartered accountant — that is, an audit.
• The Local Content Authority: the local content certificate rests on a calculation approved by a licensed accounting office under the Authority’s form and mechanism, which is by nature an agreed-upon procedures engagement: specific procedures performed on expenditure items and their findings reported, not an opinion on the financial statements. See the local content certificate guide.
• Zakat and tax: an accounts-based taxpayer files its return from its financial statements, and ZATCA requests them in an examination; a company required to be audited under the Companies Law submits audited statements. See how to prepare for a ZATCA examination.
• Banks and financing: there is no single statutory rule; each bank has its credit policy. Audited statements are usually required for larger facilities, while reviewed or compiled statements may be accepted for smaller ones. The question that saves the most time: ask the bank which report it accepts before engaging the firm.
• Disputes and the courts: when what is needed is verification of a specific item — a partner’s balance, a contract settlement, a disputed cash movement — the right tool is usually agreed-upon procedures with a scope set by the parties or the court, or an accounting expert’s report. See how an embezzlement and financial fraud report is examined.

Fourth: what none of them does

• An audit is not a fraud investigation. The auditor is responsible for obtaining reasonable assurance that the statements are free from material misstatement due to fraud or error, not for uncovering every irregularity however small; investigating a specific embezzlement is a separate engagement with a different scope.
• The auditor does not keep your books. The Companies Law requires the auditor to be independent under the adopted professional standards and prohibits technical, administrative or consulting work for the company being audited, except as the regulations allow (Article 20). Whoever keeps the books cannot audit them.
• A review cannot be turned into an audit with a stroke of the pen. The scope of each engagement is fixed in the engagement letter, and reducing an audit to a review mid-way is acceptable only for a reasonable justification — such as a change in the business’s needs — not to avoid a modified opinion.
• An AUP report is not a certificate of correctness. It narrates what was performed and what was found; a reader who takes it as an opinion on the soundness of the statements misreads it.

Fifth: how to choose in two minutes

1. Who will read the report? A regulator that requires an audit (the Ministry of Commerce for a non-exempt company, contractor classification) → audit, and there is no other option.
2. Are you an exempt company with nobody asking for an independent opinion? → a compilation gives you professional statements for filing, zakat and management at a lower cost.
3. Does the reader want comfort without the cost of a full audit, and expressly accept limited assurance? → a review.
4. Is the question confined to specific items? → agreed-upon procedures, with the list of procedures agreed in writing before work starts.
5. Will you most likely need an audit next year? Start with it now; the first year of an audit costs more and takes longer because opening balances need additional work.

Sixth: recurring mistakes

• Submitting compiled statements to a body that requires audited ones, so the file is rejected after the deadline has passed.
• Commissioning a full audit for an exempt company from which nobody requires an independent opinion — cost without return.
• Expecting the auditor to catch every small embezzlement, then being surprised when a separate investigation engagement is proposed.
• Asking one firm to keep the books and audit them, which the Companies Law and the independence rules prohibit.
• Appointing the auditor after the year end, so they cannot attend the inventory count or confirm balances in time, leaving the opinion exposed to modification — see types of auditor opinion.

Frequently asked questions

How we help

At Al-Mousa & Al-Tamimi Certified Public Accountants we start from the question “who will read the report?” and then set the right engagement, its letter and its scope: an audit under the international standards for companies that are required to have one, a compilation for exempt companies, a review, or agreed-upon procedures with a written list of procedures — while observing the independence rules, so we never audit books we keep ourselves.

See our external audit service · Read next: when must a company appoint an auditor? · Types of auditor opinion · Contact us

Sources: Standards adopted in the Kingdom (auditing, quality management, review, other assurance, related services) — SOCPA (Arabic); Adoption of ISRS 4400 (Revised) — SOCPA (Arabic); Companies Law, Royal Decree No. M/132 dated 1/12/1443H — Saudi Laws Portal (Articles 17, 18, 19 and 20; Arabic); Contractors Classification Law, Royal Decree No. M/9 dated 18/1/1443H — Saudi Laws Portal (Article 6; Arabic). This article is general guidance and is not a substitute for advice on a specific case.

Related guides

• CPA-certified financial statements: what the requesting bodies want
• A CPA for contracting companies: classification and long-term contracts
• Auditing non-profit associations and foundations