Reporting standard
Two reports, never merged.
An agreed-upon procedures report must not carry opinions. A government still needs estimates to act on. They arrive as separate documents, so the factual findings hold when an operator challenges them.
Report 1 · ISRS 4400 (Revised)
Agreed-upon procedures
- Factual findings: what was compared, with what, and the difference
- The engaging party confirms in writing that the procedures fit the purpose
- Named intended users and restricted distribution
- Each finding stated with its population, sample and source
- No opinion, no conclusion, no assurance
Report 2 · Advisory
Analytics and exposure
- Inferred obligations as ranges, with the assumptions stated
- Operator risk tiers and where to look next
- Recommendations on systems, data sharing and enforcement
- Marked as not assurance and not part of Report 1
ISRS 4400 is a reporting standard, not a software product. A proposal that says a tool "runs ISRS 4400", or promises fraud ratings inside an agreed-upon procedures report, will not survive review by a supreme audit institution. Neither would ours, so we do not write them.