In July 2025, the Louisiana Legislative Auditor (LLA) issued Version 7 of its statewide agreed-upon procedures (SAUP) instruction manual. This update reduces testing requirements for entities that show patterns of strong internal controls and compliance. In this article, we’ll answer the following questions:
- What are Louisiana’s statewide agreed-upon procedures?
- Who is subject to Louisiana’s statewide agreed-upon procedures?
- What’s in the Louisiana statewide agreed-upon procedures update
- How should entities respond to the SAUP update?
What are Louisiana’s statewide agreed-upon procedures?
Louisiana’s statewide agreed-upon procedures (SAUP) are a set of procedures that must be performed for certain entities under state law. First introduced as a statewide requirement in 2017, the SAUPs test an entity’s control and compliance across 14 areas identified by the LLA as best practices:
- Written Policies and Procedures
- Board or Finance Committee
- Bank Reconciliations
- Collections (other than EFTs)
- Non-Payroll Disbursements
- Credit, Debit, Fuel, and Purchase Cards
- Travel & Travel-Related Expense Reimbursements
- Contracts
- Payroll and Personnel
- Ethics
- Debt Service
- Fraud Notice
- IT Disaster Recovery/Business Continuity
- Prevention of Sexual Harassment
The state’s goal in implementing the SAUP requirement is “to correct internal control processes of local entities” to alleviate the risks of misuse or mismanagement of public money.
Who is subject to Louisiana’s statewide agreed-upon procedures?
Louisiana’s SAUPs are only required for local governments, quasi-public organizations, and nonprofits that receive at least $500,000 in public funds within a fiscal year. State entities must comply with a different set of AUPs called “state entity agreed-upon procedures.”
What’s in the Louisiana SAUP update?
The most noteworthy change in Version 7 of the SAUP instructions is that testing now follows a two-year cycle. In Year 1, the entity will be tested in all 14 categories that the LLA identifies as high risk for fraud. In Year 2, the only categories that will need to be retested are those that were found to have exceptions during the Year 1 audit. As the SAUP manual puts it, “Year 1 establishes the baseline for determining the extent of testing required in Year 2.”
This means that if there are no exceptions found in Year 1, no testing will be required in Year 2.
The alternating testing pattern looks like this:
Here is some of the fine print that you should keep in mind as you undergo SAUP testing:
- Timely submission is required: Entities only qualify for the reduced testing cycle if they submit their Year 1 audits on time.
- No partial credit: If a risk area includes multiple procedures, and testing shows inefficiencies in even one of them, you’ll be required to retest the entire risk area in Year 2.
- Tests must be performed by an independent auditor: The SAUP requires an independent auditor (often a CPA firm) to perform SAUP testing.
- Same auditor requirement: The SAUP testing must be performed by the same independent auditor that performs the annual audit. A separate engagement letter isn’t required.
- Costs are borne by the entity: The agency or entity commissioning the SAUP will bear the full cost of testing.
- Compensating controls may be a safeguard: If the auditors found exceptions within a testing category but believe other compensating controls fully mitigated the underlying control risk, they may report that there were no exceptions within that testing category.
- Only Louisiana operations matter: Multistate entities will still need to comply with the SAUP, but the testing will only cover functions that are funded with Louisiana government funds.
- Single Audit exception: Entities that receive Federal funds in addition to Louisiana funds may be able to avoid some SAUP testing in regards to expenditures of federal awards. Any categories that are tested during Single Audit testing procedures don’t need to be retested for SAUP purposes.
- IT procedures exception: The IT Disaster Recovery/Business Continuity test will not need to be retested in Year 2 unless the report is filed late.
How should entities respond to the SAUP update?
First, determine if the SAUPs apply to your entity. It’s possible that your entity is subject to a different type of agreed-upon procedure engagement, or is subject to more than one. The LLA currently has four different types of AUP engagements:
- Statewide AUPs (the topic of this article)
- State Entity AUPs
- Review/Attest Engagements
- Department of Education Performance Measures AUPs
See “Applicability of AUPs” in the FAQ document for details.
Second, consider which areas of your operations are more susceptible to exceptions, and shore up those control inefficiencies before you undergo the audit procedure. The SAUPs may alleviate some of the testing burden from a time and financial perspective, but your control environment shouldn’t weaken as a result: you’ll still need to have strong internal controls in all 14 high-risk areas.
Reach out to your LaPorte contact for more information about the SAUPs or about your annual audit.