CPA AUD Quick Review: Auditing and Attestation

CPA AUD Quick Review

This independent quick review is for candidates preparing for the AICPA U.S. CPA AUD - Auditing and Attestation exam, code CPA AUD. Use it as a final-pass review before moving into topic drills, mock exams, and detailed explanations in an independent companion practice question bank.

The AUD mindset is not “memorize every report.” It is:

1. Identify the engagement type.
2. Identify the applicable standards.
3. Decide the level of assurance.
4. Evaluate evidence, risk, materiality, and independence.
5. Choose the correct report or modification.

AUD Exam Mindset: The Core Decision Pattern

Most CPA AUD questions test professional judgment through a small set of recurring decisions.

Assurance Levels: Know the Engagement Before Answering

Quick rule: Audit/examination = reasonable assurance. Review = limited assurance. Compilation/preparation/AUP = no assurance.

Audit Risk Model

For audits, the auditor plans work to reduce audit risk to an acceptably low level.

\[ \text{Audit Risk} = \text{Risk of Material Misstatement} \times \text{Detection Risk} \]\[ \text{Risk of Material Misstatement} = \text{Inherent Risk} \times \text{Control Risk} \]

High-Yield Risk Relationship

Common trap: Higher inherent/control risk does not mean higher detection risk. It means the auditor must accept lower detection risk and perform stronger procedures.

Planning and Engagement Acceptance

Before accepting or continuing an audit, the auditor considers:

• Independence and ethical requirements.
• Management integrity.
• Competence and availability of engagement team.
• Whether the financial reporting framework is acceptable.
• Whether management acknowledges its responsibilities.
• Whether scope limitations are likely.
• Communication with predecessor auditor when applicable.

Engagement Letter: What It Usually Covers

Common trap: The auditor does not accept responsibility for preventing fraud or maintaining internal control. Those are management responsibilities.

Materiality: How AUD Questions Use It

Materiality is judged from the perspective of a reasonable user. It includes quantitative and qualitative factors.

Common Qualitative Red Flags

• Turns a loss into income.
• Helps meet analyst, lender, or bonus targets.
• Masks a trend.
• Affects debt covenant compliance.
• Involves fraud or illegal acts.
• Affects related-party disclosures.
• Concerns a sensitive estimate or significant disclosure.

Assertions: Match Procedure to Objective

Transaction Assertions

Account Balance Assertions

Directional Testing

Common trap: Confirming accounts receivable primarily tests existence, not completeness.

Evidence: Reliability Ranking

Evidence must be sufficient and appropriate. Sufficiency is quantity; appropriateness is relevance and reliability.

Procedure Strengths and Weaknesses

Internal Control: COSO Components

Control Deficiency Severity

Common trap: A material weakness means there is a reasonable possibility of material misstatement, not that a misstatement definitely occurred.

Testing Controls vs Substantive Procedures

    flowchart TD
	    A[Assess risk of material misstatement] --> B{Plan to rely on controls?}
	    B -->|Yes| C[Test design and operating effectiveness]
	    C --> D{Controls effective?}
	    D -->|Yes| E[Reduce substantive testing as appropriate]
	    D -->|No| F[Increase substantive procedures]
	    B -->|No| G[Perform substantive procedures]
	    A --> H{Substantive procedures alone insufficient?}
	    H -->|Yes| C

When Tests of Controls Are Needed

• Auditor plans to rely on controls.
• Substantive procedures alone cannot provide sufficient appropriate evidence.
• Compliance or integrated audit requirements apply.
• Controls address high-volume automated processing.

Control Testing Procedures

Inquiry alone is rarely sufficient for testing operating effectiveness.

Fraud: High-Yield Review

Fraud includes fraudulent financial reporting and misappropriation of assets.

Required Fraud Mindset

• Maintain professional skepticism.
• Discuss fraud risks with engagement team.
• Inquire of management, internal audit, and others.
• Consider management override.
• Evaluate unusual journal entries.
• Review accounting estimates for bias.
• Consider whether revenue recognition presents a fraud risk.

Common trap: An audit is designed to obtain reasonable assurance, not to guarantee fraud detection.

Management Override: Typical Responses

High-yield procedures include:

• Test journal entries and other adjustments.
• Review accounting estimates for bias.
• Evaluate business rationale for significant unusual transactions.
• Consider related-party transactions.
• Incorporate unpredictability into audit procedures.

Analytical Procedures

Analytical procedures are strongest when:

• Data is reliable.
• Relationships are predictable.
• Expectation is precise.
• Difference threshold is appropriate.
• Unexpected differences are investigated and corroborated.

Common trap: Inquiry alone does not resolve an unexpected analytical difference. The auditor needs corroborating evidence.

Sampling: Fast Rules

Control Sampling

Substantive Sampling

Sampling Risk Effects

Sample Size Direction

Monetary-Unit Sampling Trap

Monetary-unit sampling is efficient for detecting overstatements in populations with recorded book values. It is less effective for understatements, zero balances, or negative balances.

High-Yield Audit Areas by Cycle

Revenue and Receivables

Common trap: Negative confirmations are appropriate only when risk is low, controls are effective, balances are small/homogeneous, and recipients are expected to respond if incorrect.

Inventory

If inventory observation is impracticable, the auditor performs alternative procedures. If sufficient evidence cannot be obtained, consider a scope limitation.

Purchases, Payables, and Expenses

Search for unrecorded liabilities usually focuses on understatement, so it starts with subsequent cash disbursements, unmatched receiving reports, vendor statements, and invoices.

Cash

Payroll

Debt and Equity

Estimates and Fair Value

Common trap: The auditor does not simply accept management’s estimate because it is complex. Complexity often increases inherent risk.

Confirmations

If a positive confirmation is not returned, the auditor should perform follow-up and alternative procedures, such as examining subsequent cash receipts and supporting documents.

Written Representations

Written representations are required audit evidence but do not replace other procedures.

Common representations include:

• Management responsibility for financial statements.
• Management responsibility for internal control.
• All relevant information and access provided.
• Disclosure of fraud or suspected fraud.
• Disclosure of known noncompliance.
• Related-party relationships and transactions disclosed.
• Subsequent events evaluated.
• Uncorrected misstatements acknowledged.

Common trap: Refusal to provide written representations is a serious scope limitation and may affect the auditor’s ability to issue an opinion.

Attorney Letters, Contingencies, and Litigation

Loss contingency accounting generally depends on likelihood and estimability. AUD questions often test whether the auditor has enough evidence and whether disclosure is adequate.

Related Parties

Related-party transactions are not automatically improper, but they require careful evaluation.

High-yield procedures:

• Inquire of management and governance.
• Inspect minutes, contracts, and conflict-of-interest statements.
• Review unusual transactions.
• Confirm terms with related parties when appropriate.
• Evaluate business purpose.
• Ensure proper disclosure.

Common trap: A transaction with a related party may need disclosure even if recorded at the correct amount.

Subsequent Events

Subsequent Events Periods

Common trap: If a subsequent event provides evidence about conditions existing at year-end, it usually affects recognition. If it relates to new conditions after year-end, it usually affects disclosure.

Going Concern

The auditor evaluates whether substantial doubt exists about the entity’s ability to continue as a going concern for a reasonable period under applicable standards.

Common trap: Going concern uncertainty does not automatically mean adverse opinion. The key is whether the financial statements and disclosures are appropriate.

Audit Reports: Opinion Modifications

Opinion Types

Emphasis-of-Matter vs Other-Matter

Examples of emphasis matters may include going concern, significant uncertainty, or a major subsequent event when properly disclosed. The exact placement and wording depend on the applicable standards and report type.

Issuer vs Nonissuer Reporting: Quick Distinctions

Common trap: Do not mix report elements from one standard-setter into the other unless the question facts support it.

Integrated Audit and ICFR Concepts

For audits involving internal control over financial reporting:

Common trap: An adverse ICFR opinion does not automatically mean the financial statement opinion is adverse. The auditor may still obtain enough substantive evidence for an unmodified financial statement opinion.

Service Organizations and SOC Reports

Common trap: A SOC report does not eliminate the user auditor’s responsibility to understand the user entity’s controls and assess risk.

Use of Specialists, Internal Auditors, and Component Auditors

Specialist

The auditor may use a specialist for valuation, actuarial estimates, environmental obligations, complex instruments, or other specialized areas.

Evaluate:

• Competence.
• Capability.
• Objectivity.
• Work performed and assumptions used.
• Relevance and reasonableness of findings.

Internal Auditors

The external auditor may use internal audit work when appropriate, but evaluates:

• Objectivity.
• Competence.
• Systematic and disciplined approach.
• Nature and risk of the area.

More judgmental or high-risk areas require more direct external auditor work.

Group Audits

For group audits, the group auditor considers:

• Component significance.
• Component auditor competence and independence.
• Group-wide controls.
• Consolidation process.
• Communication with component auditors.

Common trap: The group auditor cannot simply outsource responsibility without evaluating the work and determining the effect on the group audit.

Communications

With Management and Those Charged With Governance

Predecessor and Successor Auditor

Before accepting an engagement, the successor auditor asks management for permission to communicate with the predecessor. Topics include:

• Management integrity.
• Disagreements with management.
• Reasons for auditor change.
• Communications about fraud, noncompliance, or internal control matters.

Common trap: If management refuses permission, that is a major red flag for acceptance.

SSARS: Preparation, Compilation, Review

SSARS Traps

• Compilation does not provide assurance.
• Review does not provide an opinion.
• Preparation is not an attest service.
• Lack of independence can be disclosed in a compilation, but not in a review.
• Review evidence is much less extensive than audit evidence.

SSAE Attestation Engagements

Attestation Essentials

• Subject matter must be capable of evaluation.
• Suitable criteria are required.
• Practitioner independence is generally required.
• Management or responsible party is responsible for the subject matter.
• AUP reports present procedures and findings, not assurance.

Common trap: In an agreed-upon procedures engagement, the practitioner does not decide whether the subject matter is fairly stated. Users evaluate the findings.

Prospective Financial Information

High-yield points:

• Prospective information is not historical fact.
• Assumptions are central to the engagement.
• Reports avoid guaranteeing future results.
• Projections often require careful attention to purpose and user limitations.

Government Auditing and Compliance Concepts

For government and compliance-oriented audits, AUD candidates should recognize:

Common trap: Compliance reporting is not the same as a standard financial statement opinion, even when performed alongside a financial statement audit.

IT and Data Concepts

Modern AUD questions may include automated systems, IT general controls, and audit data analytics.

Common trap: A strong automated application control may still be unreliable if relevant general IT controls are weak.

Common AUD Candidate Mistakes

Fast Opinion Modification Drill

Use this decision table when practicing report questions.

Final Review Checklist Before Practice

Before starting mixed AUD mock exams, confirm you can answer these quickly:

• Which standards apply: GAAS, PCAOB, SSARS, SSAE, government/compliance?
• What assurance level is provided?
• What assertion is being tested?
• Is the procedure a risk assessment, test of control, substantive test, or analytical procedure?
• Is the evidence sufficient and appropriate?
• Does the issue affect independence?
• Is the misstatement material? Pervasive?
• Is the issue a GAAP departure or a scope limitation?
• Does the report need modification, emphasis, or other-matter language?
• Are management representations required but not sufficient by themselves?
• Is the event Type I or Type II?
• Is the service organization report Type 1 or Type 2?
• Is the sampling question about controls or dollar misstatement?

How to Use This Quick Review With Practice Questions

For CPA AUD, quick review only helps if you immediately apply it. After reading a section:

1. Do focused topic drills on that area.
2. Review detailed explanations for both correct and incorrect answers.
3. Track whether mistakes are due to standards knowledge, assertion matching, report selection, or wording traps.
4. Rework missed questions after a delay.
5. Move to mixed sets only after individual weak areas improve.

A practical next step is to use an independent companion practice question bank with original practice questions, topic drills, mock exams, and detailed explanations focused on AICPA U.S. CPA AUD - Auditing and Attestation (CPA AUD).