Try 78 free Certified Public Accountant Auditing and Attestation (CPA AUD) questions across the AUD blueprint areas, with answers and explanations, then continue in Mastery Exam Prep.
This free full-length Certified Public Accountant Auditing and Attestation (CPA AUD) multiple-choice diagnostic includes 78 original Mastery Exam Prep questions across the AUD blueprint areas.
The CPA AUD section also involves task-based simulations and exhibit-heavy work, so use this page as a multiple-choice diagnostic rather than a complete simulation of every item type. The questions are original practice questions and are not official exam questions.
Practice count note: exam sponsors can describe total questions, scored questions, task-based simulations, duration, or unscored/pretest-item rules differently. Always confirm current exam-day rules with the sponsor.
For concept review before or after this diagnostic, use the CPA AUD guide on CPAExamsMastery.com.
CPA means Certified Public Accountant. AUD means Auditing and Attestation. This page is useful when you want one uninterrupted AUD multiple-choice diagnostic before moving into the full practice route.
Use the score as a diagnostic signal, not as a guarantee. AUD also involves task-based simulations and exhibit-heavy work, so a high score here should be paired with continued review of audit-document interpretation, evidence evaluation, and reporting judgment.
| Diagnostic result | Practical next step |
|---|---|
| Below 70% | Return to topic drills. Start with the topic that produced the most misses, then retake mixed sets after the explanations make sense. |
| 70-79% | Review every miss and classify it as ethics, risk assessment, evidence, or reporting. Drill the weak category before another full timed attempt. |
| 80%+ | Move to timed mixed practice and focus on pacing, careful stem reading, and avoiding overconfidence on familiar audit wording. |
| Repeated 75%+ on unseen timed attempts | Schedule or proceed when you can explain why each best answer fits. More repetition should build judgment, not memorization. |
| If your misses cluster around… | What to drill next |
|---|---|
| independence, confidentiality, due care, or engagement acceptance | Ethics and professional-responsibility questions . Separate the rule, threat, safeguard, documentation, and communication requirement. |
| risk of material misstatement, fraud, materiality, or assertions | Risk-assessment questions . Name the assertion and risk driver before choosing the planned response. |
| confirmations, inspection, recalculation, sampling, analytics, or data reliability | Audit-evidence questions . Ask whether the procedure is sufficient, appropriate, and tied to the assertion. |
| modified opinions, going concern, subsequent events, ICFR, or report wording | Conclusion and reporting questions . Decide materiality, pervasiveness, correction status, disclosure quality, and scope before choosing the report effect. |
| timing pressure or repeated recognition of familiar stems | Timed mixed practice in the full route. Use larger unseen sets so practice builds audit judgment instead of answer memorization. |
| Item | Detail |
|---|---|
| Issuer | American Institute of Certified Public Accountants (AICPA) |
| Exam route | CPA AUD |
| Official exam name | CPA AUD — Auditing and Attestation |
| Full-length set on this page | 78 questions |
| Exam time | 240 minutes |
| Topic areas represented | 4 |
| Topic | Approximate official weight | Questions used |
|---|---|---|
| Ethics, Professional Responsibilities and General Principles | 20% | 16 |
| Assessing Risk and Developing a Planned Response | 30% | 23 |
| Performing Further Procedures and Obtaining Evidence | 35% | 27 |
| Forming Conclusions and Reporting | 15% | 12 |
Topic: Ethics, Professional Responsibilities and General Principles
During an audit of a nonissuer, an associate is testing revenue cutoff for sales recorded near year-end. A December 30 invoice was recorded as current-year revenue, and the sales terms state that title transfers when the goods are shipped. The warehouse shipping log shows shipment on January 3, but the controller says the log is often updated late and provides only an internal email stating that the order was “ready to ship” on December 31. Which action should the associate take?
Best answer: D
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The shipping log conflicts with the recorded sale, and management’s explanation is not adequately corroborated. Appropriate professional skepticism calls for a questioning evaluation of the evidence and additional procedures to resolve whether shipment occurred before year-end.
Professional skepticism does not mean automatically disbelieving management, but it does require the auditor to be alert to contradictory audit evidence and to avoid accepting incomplete support at face value. Here, the terms make the shipping date critical to revenue cutoff. The invoice date alone does not establish shipment, and the internal email that the order was “ready to ship” does not prove that title transferred before year-end. The auditor should seek more persuasive evidence, such as a bill of lading, carrier record, tracking documentation, or other corroborating evidence, and then evaluate whether a cutoff adjustment is necessary.
Professional skepticism requires the auditor to investigate contradictory or incomplete evidence rather than rely solely on an uncorroborated management explanation.
Topic: Performing Further Procedures and Obtaining Evidence
During the audit of a nonissuer, the allowance for credit losses is a significant accounting estimate. Management’s worksheet applies supported loss rates to each aging bucket. The auditor agreed the aging report to the accounts receivable subsidiary ledger and found that the worksheet’s total expected loss formula includes only the current, 1-30, 31-60, and 61-90 day buckets; it omits the over-90-day bucket, which is material and has the highest supported loss rate. Management recorded the allowance based on the worksheet total. What is the best audit response?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: A formula omission in a significant estimate is a calculation error that directly affects the recorded allowance. The auditor should have management correct the calculation, reperform it, and evaluate whether an adjustment is necessary.
For significant accounting estimates, the auditor should test both the reasonableness of assumptions and the mathematical accuracy and completeness of management’s calculation. Here, the loss rates were supported, and the aging data was agreed to the subsidiary ledger, but the worksheet omitted a material aging bucket from the total formula. Because the recorded allowance is based on that flawed total, the auditor should obtain a corrected calculation, reperform the computation, and determine the effect on the financial statements. The issue is not solved merely by having reasonable assumptions, because a supported input was excluded from the estimate.
The auditor should validate the estimate calculation by correcting the omitted supported input, reperforming the calculation, and evaluating the misstatement effect.
Topic: Assessing Risk and Developing a Planned Response
An audit firm has completed client continuance procedures and signed the engagement letter for a recurring audit of Rylee Components, a nonissuer. In prior years, Rylee was a small, single-location manufacturer that issued income tax basis financial statements. During the current year, Rylee acquired an online distributor, converted to U.S. GAAP reporting for a new bank loan, implemented a new inventory and revenue system, and agreed to provide audited financial statements to the bank 45 days after year-end. The prior-year audit was staffed by two first-year associates, and no current-year detailed audit plan has been finalized. What should the engagement partner do next in establishing the overall audit strategy?
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The partner should first update the overall audit strategy for the significant current-year changes. The acquisition, GAAP conversion, new system, accelerated deadline, and prior staffing level all affect the scope, timing, direction, and resources needed for the audit.
The overall audit strategy sets the scope, timing, and direction of the audit and guides development of the detailed audit plan. It should consider the entity’s size and complexity, the applicable reporting framework, significant risk factors, reporting deadlines, and the nature and extent of engagement resources. Here, Rylee is no longer comparable to the prior-year audit: it has acquired a new business, changed from income tax basis to U.S. GAAP, implemented a new system affecting revenue and inventory, and accepted a tight reporting deadline. Those facts may require experienced personnel, different timing, IT involvement, and expanded risk assessment before detailed procedures are finalized.
The overall audit strategy should be updated for changes in reporting framework, complexity, risk, deadline, and staffing before the detailed audit plan is finalized.
Topic: Ethics, Professional Responsibilities and General Principles
During the audit of a nonissuer software company, the engagement team evaluated whether a $1.2 million year-end license sale should be recognized as revenue. Management asserted that the contract was final, but the audit team found an internal sales email suggesting the customer could cancel after a pilot period. The team later inspected the signed contract, obtained confirmation from the customer, and concluded that no cancellation right existed. Which audit documentation is most appropriate?
Best answer: D
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The best documentation captures the significant judgment, the conflicting evidence, the audit work performed, and the rationale for the conclusion. This supports professional skepticism by showing how the team addressed evidence that initially contradicted management’s assertion.
Audit documentation for significant findings or issues should be sufficient for an experienced auditor to understand the matter, the evidence obtained, and the basis for the auditor’s conclusion. When contradictory evidence exists, the documentation should not ignore it; it should explain how the team evaluated and resolved it. Here, the sales email raised doubt about revenue recognition, so the workpaper should connect that contradiction to the signed contract, customer confirmation, and final conclusion that no cancellation right existed.
Significant professional judgments should be documented with the contradictory evidence considered, how it was resolved, and the conclusion reached.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a nonissuer manufacturer, the engagement team identifies an increased risk of material misstatement related to inventory obsolescence. Which item of audit evidence best supports the conclusion that the risk is driven by an internal business risk rather than an external economic risk?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The strongest support is evidence showing that management’s own strategic and operational decisions created obsolete inventory. Board minutes and engineering change orders are internal source documents that directly connect the valuation risk to internal business factors.
When assessing risks of material misstatement, auditors distinguish internal business risks from external economic risks. Internal business risks arise from the entity’s objectives, strategies, operations, governance decisions, systems, or technology use. Here, management’s decision to replace a product line and the resulting engineering changes directly explain why prior-version components may be obsolete. External economic conditions, such as interest rates, market price changes, or competitor discounting, may also affect valuation, but they do not support the specific conclusion that the risk is internally driven.
This evidence links the obsolescence risk to management’s internal strategy and product-design decisions.
Topic: Assessing Risk and Developing a Planned Response
During planning for a financial statement audit, an auditor evaluates a control over program changes to the revenue application. The workpaper note states:
How should the auditor characterize this control based on the note?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The control has an appropriate design because it requires owner approval and segregates development from production migration. Inspection of system configuration and a current-period ticket supports that the control was placed in operation, although it does not prove operating effectiveness over the period.
Design and implementation evaluation is different from testing operating effectiveness. A control is suitably designed if it is capable, individually or with other controls, of preventing or detecting and correcting a relevant misstatement risk. Here, the design addresses unauthorized program changes by requiring application-owner approval and preventing developers from moving code to production. A control is placed in operation when the auditor obtains evidence that it exists and the entity is using it. Inspecting the configured approval requirement and a current-period approved ticket supports implementation. However, the note does not establish whether the control operated effectively throughout the audit period, which would require further testing if the auditor plans to rely on it.
The note shows the control could prevent unauthorized changes and provides evidence that it exists and has been used in the current period.
Topic: Assessing Risk and Developing a Planned Response
A CPA is planning the audit of a nonissuer manufacturing company. The audit senior prepared the following risk-assessment excerpt:
| Risk-assessment fact | Current-year observation |
|---|---|
| Financing | The company is close to violating a debt covenant based on year-end EBITDA. |
| Compensation | The CEO and CFO receive significant bonuses if EBITDA meets the annual budget. |
| Governance | The audit committee met once during the year and did not review significant accounting estimates. |
| Accounting environment | The controller resigned after objecting to several CEO-approved manual journal entries recorded near year-end. |
| Prior audit results | Last year’s audit identified no material misstatements. |
Which conclusion about the risk of material misstatement is best supported by the excerpt?
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The exhibit shows multiple pervasive fraud risk factors: covenant pressure, bonus incentives, weak oversight, and concerns about CEO-approved manual entries. These factors affect the control environment and management override risk, so the risk assessment should be elevated at the financial statement level.
Financial statement-level risks are risks that may have a pervasive effect on the financial statements rather than being confined to one account balance or assertion. Incentives to meet EBITDA, ineffective governance, and possible management override through year-end manual journal entries all suggest broader susceptibility to intentional misstatement. A clean prior-year audit does not eliminate current-year risk when conditions have changed. The resignation of the controller after objecting to entries heightens, rather than reduces, concern about management integrity and override. The auditor should use this assessment to design overall responses, such as increased professional skepticism, more experienced staff, and heightened attention to journal entries and estimates.
The facts indicate incentives, weak governance, and possible management override, which can affect the financial statements pervasively.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a nonissuer manufacturer, the auditor learns that senior management’s annual bonuses vest only if revenue increases by at least 8%. Two days before year-end, the CFO emailed sales staff to “invoice all pending orders now; customer acceptance paperwork can catch up in January.” The audit team has not yet tested any related invoices. How should the auditor treat this information?
Best answer: C
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The facts indicate a fraud risk factor, not merely a business objective or control issue. Management has a revenue-based incentive and directed staff to invoice before customer acceptance, creating a specific risk of intentional premature revenue recognition.
Fraud risk indicators include incentives or pressures, opportunities, and attitudes or rationalizations that may lead to fraudulent financial reporting. Here, management’s bonus depends on meeting a revenue target, and the CFO’s instruction suggests revenue may be recorded before the earnings process is complete. Because the team has not tested the invoices, the auditor should not yet conclude that a known misstatement exists. The proper planning response is to identify a fraud risk, especially for revenue occurrence and cutoff, and design further procedures responsive to that risk.
The bonus threshold and instruction to invoice before customer acceptance indicate pressure and possible intentional premature revenue recognition.
Topic: Performing Further Procedures and Obtaining Evidence
During a Uniform Guidance audit, an auditor tests procurement transactions for a major federal program. One selected transaction lacks evidence that the required suspension and debarment verification was performed before the vendor was paid. Management states that the verification was likely performed but cannot immediately locate the documentation. Which follow-up procedure is most appropriate?
Best answer: B
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The auditor should first follow up to determine whether the missing verification represents actual noncompliance and whether it is isolated or indicates a broader problem. That may include inspecting additional records, inquiring further, and testing similar transactions as needed.
In Uniform Guidance compliance testing, an apparent exception is not ignored or automatically projected into the most severe reporting consequence. The auditor should obtain additional evidence to understand the nature and cause of the exception, determine whether noncompliance occurred, assess whether the matter is isolated or systemic, and evaluate the effect on questioned costs, internal control over compliance, and the major program opinion. The follow-up work should be targeted to the applicable compliance requirement and the population affected.
A possible compliance exception should be followed up by obtaining evidence about its cause, validity, and possible pervasiveness before concluding on reporting effects.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA is completing the audit of a nonissuer’s financial statements. The CPA concludes that a recorded revenue transaction is materially misstated under the applicable financial reporting framework. The CFO refuses to adjust the financial statements, says the audit committee should not be told, and offers to sign a management representation letter supporting the accounting. The client’s bank loan officer calls the CPA directly to ask whether the audit identified any problems; the client has not authorized the CPA to discuss the audit with the bank, and no legal requirement to disclose exists. Which response best maintains integrity and complies with applicable professional standards?
Best answer: C
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The CPA may not subordinate professional judgment to management or ignore a known material misstatement. The appropriate response is to require correction or modify the audit response, communicate with those charged with governance, and protect confidential client information unless disclosure is authorized or required.
Integrity requires a CPA to be honest and not knowingly associated with materially misstated information. A management representation letter is evidence, but it does not override contradictory audit evidence or cure a material departure from the reporting framework. If management refuses to correct a material misstatement, the auditor should communicate the matter to those charged with governance and determine the effect on the auditor’s report or whether withdrawal is necessary. Separately, the AICPA confidentiality rule generally prohibits disclosing confidential client information to a third party, such as a bank officer, without client consent unless an exception applies, such as a valid legal requirement or a professional standards obligation.
This response preserves the CPA’s integrity, follows audit communication and reporting responsibilities, and respects the confidentiality rule.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA is the audit manager for a nonissuer audit. The client’s controller, a former college roommate of the CPA, asks the CPA to drop a proposed adjustment reclassifying a material debt balance from long-term to current. The controller says the client may move its tax work to another firm if the audit is delayed, and the audit evidence supports the reclassification. Which action best preserves the CPA’s objectivity?
Best answer: C
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The CPA must base the audit position on sufficient appropriate evidence and avoid subordinating judgment to the client. The friendship, threatened loss of fees, and deadline pressure create threats to objectivity, so the CPA should escalate and maintain the evidence-supported adjustment.
Under the AICPA Code, objectivity requires a CPA to remain impartial and not knowingly misrepresent facts or subordinate professional judgment. Here, the audit evidence supports a material debt reclassification, so dropping the adjustment because of a personal relationship or threatened loss of tax work would impair objectivity. The appropriate response is to maintain the evidence-based conclusion, communicate the pressure within the engagement team, and use the firm’s consultation or escalation procedures. If management refuses to correct a material misstatement, the engagement partner would consider the reporting implications, but the manager’s immediate ethical responsibility is not to yield to the pressure.
Objectivity is preserved by not subordinating professional judgment to client pressure, personal familiarity, or fee concerns.
Topic: Assessing Risk and Developing a Planned Response
An audit senior is reviewing a staff note prepared during planning under the COSO framework: “Internal control consists of control activities that ensure the company’s financial statements are correct. The client has approvals and reconciliations, so internal control is effective.” The audit team has not yet documented the control environment, risk assessment, information and communication, monitoring, or inherent limitations. What should the senior do next?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The staff note is incomplete and overstates what internal control can accomplish. Under COSO, internal control is a process involving people, five components, multiple objectives, and only reasonable assurance because inherent limitations exist.
COSO defines internal control as a process effected by the board of directors, management, and other personnel that is designed to provide reasonable assurance about achieving objectives related to operations, reporting, and compliance. The five components are control environment, risk assessment, control activities, information and communication, and monitoring activities. In planning an audit, the team should obtain and document an understanding that reflects these elements before drawing conclusions about risk or reliance. Controls can reduce risk, but they cannot eliminate it because of inherent limitations such as human judgment, mistakes, collusion, management override, and cost-benefit constraints.
COSO defines internal control broadly as a process designed to provide reasonable assurance over operations, reporting, and compliance through five interrelated components subject to inherent limitations.
Topic: Assessing Risk and Developing a Planned Response
An auditor is planning a financial statement audit of a nonissuer manufacturer and is evaluating controls over purchase authorization. The auditor documented the following process-summary excerpt:
| Control feature | Workpaper note |
|---|---|
| ERP approval rule | A single purchase order over $75,000 requires CFO approval before issuance. |
| Monitoring control | The purchasing director initials a monthly report of purchase orders between $70,000 and $75,000. |
| Exception observed | Three related purchase orders for the same vendor, each for $74,500, were created on the same day after the CFO directed the purchasing clerk to split one requisition. The monthly report was initialed as reviewed. |
Which conclusion is best supported by the exhibit?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: Internal control provides reasonable assurance, not absolute assurance. The exhibit shows classic inherent limitations: a manager directed a workaround of the approval threshold, and the manual monitoring review did not detect or address the split purchases.
Under the COSO framework, internal control is designed to reduce risk to an acceptable level, but it cannot eliminate risk. Inherent limitations include management override, collusion, human error, poor judgment, and cost-benefit constraints. Here, the ERP approval rule appears to address large purchase approvals, and a monitoring control exists for purchases just below the threshold. However, the CFO directed the clerk to split one requisition into three purchase orders, and the purchasing director’s manual review was initialed despite not identifying the issue. The appropriate audit implication is to consider how these limitations affect the assessed risks and planned audit response, rather than assuming the controls are fully effective.
The exhibit shows that approval thresholds and manual monitoring can be circumvented by override and can fail through human review limitations.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a manufacturer, the engagement team is evaluating whether to design expanded procedures over inventory obsolescence and net realizable value. Which evidence best supports a conclusion that the inventory valuation assertion has an increased risk of material misstatement?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The strongest planning evidence is current, auditor-prepared information that directly relates to inventory obsolescence. A reconciled aging analysis showing substantial slow-moving finished goods supports a higher assessed risk for the valuation assertion and justifies expanded procedures.
When preparing or evaluating an engagement plan, the auditor should link identified risks to the relevant assertion and planned response. For inventory obsolescence, evidence about slow-moving, excess, or unsalable items is directly relevant to valuation and net realizable value. An auditor-prepared aging analysis that is reconciled to the underlying inventory records and general ledger is more persuasive than management’s unsupported assertion and more relevant than evidence about physical quantities. This type of planning evidence supports designing additional procedures such as testing subsequent sales, reviewing markdowns, inspecting aged items, and evaluating management’s reserve methodology.
An auditor-prepared, reconciled aging analysis directly supports increased valuation risk because slow-moving finished goods may be obsolete or carried above net realizable value.
Topic: Performing Further Procedures and Obtaining Evidence
A nonissuer client holds two investments measured at fair value at year-end: publicly traded common stock with a quoted closing price in an active market, and a private debt security valued by management using a discounted cash flow model with significant unobservable inputs. Which distinction should most directly affect the auditor’s procedures over fair value measurement and disclosure?
Best answer: C
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The key distinction is the observability of fair value inputs. A quoted price in an active market provides strong, direct evidence, whereas a model-based fair value using unobservable inputs requires more extensive audit work on the model, assumptions, source data, and disclosures.
Fair value evidence varies in reliability depending on the nature of the inputs. For an investment traded in an active market, the auditor can often obtain persuasive evidence by agreeing the recorded fair value to quoted market prices as of the measurement date. For a private security valued with a discounted cash flow model, the auditor must address greater estimation uncertainty by evaluating whether the valuation technique is appropriate, whether significant assumptions such as discount rates and projected cash flows are reasonable, whether underlying data are reliable, and whether required disclosures, including fair value hierarchy classification, are appropriate.
Observable active-market prices generally provide more direct evidence, while model-based fair values require testing management’s method, inputs, assumptions, data, and disclosures.
Topic: Assessing Risk and Developing a Planned Response
During planning of a nonissuer audit, the engagement team learns that the client sold a warehouse to its chief executive officer three days before year-end. The sale is outside the client’s normal operations, includes seller financing, and generated a material gain. What is the most appropriate planning response?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The sale involves an executive officer, occurred near year-end, is outside normal operations, and produced a material gain. Those facts indicate a related-party and significant unusual transaction that should affect risk assessment and the planned audit response.
In planning an audit, the auditor should give special attention to related parties, executive officer transactions, and significant unusual transactions, particularly when they are material or occur near year-end. The auditor should plan procedures to understand the transaction’s business purpose, inspect agreements, evaluate authorization and terms, and assess whether the accounting and disclosures are appropriate. Confirmation of a receivable may provide evidence about existence or terms, but it is not enough by itself to address the broader risks of management bias, non-arm’s-length terms, or incomplete disclosure.
A material, unusual year-end transaction with an executive officer creates related-party and significant-risk planning implications requiring targeted audit procedures.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is testing a nonissuer’s year-end warranty liability. The auditor recalculated the liability using management’s warranty policy and the sales report provided by management, and the recalculation supports the recorded balance. However, subsequent cash disbursements and correspondence with the third-party repair provider indicate significantly higher warranty claims related to pre-year-end sales. Which additional procedure is most appropriate?
Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The auditor cannot ignore evidence that conflicts with a recalculation. The appropriate response is to investigate and perform additional procedures to resolve the inconsistency before concluding on the warranty liability.
Recalculation provides evidence about mathematical accuracy, but it depends on the completeness and accuracy of the inputs used. When recalculation results conflict with other evidence, such as subsequent payments or third-party correspondence, the auditor should determine the cause of the inconsistency. That often involves tracing data to source records, reconciling to independent or external evidence, and evaluating whether the original data were incomplete, inaccurate, or not relevant to the period under audit. A management representation may supplement other evidence, but it does not resolve contradictory evidence by itself.
Conflicting audit evidence requires the auditor to perform additional procedures to resolve the inconsistency and evaluate the reliability of the evidence used.
Topic: Performing Further Procedures and Obtaining Evidence
During further procedures over revenue cutoff for a nonissuer wholesaler, an audit data analytic compared sales invoices, shipment dates, and post-year-end credit memos. The client recognizes revenue when goods are shipped.
| ADA output item | Result |
|---|---|
| Invoice population reconciled to sales ledger | $0 difference |
| Average monthly sales, January-November | $4.8 million |
| December sales | $8.9 million |
| December 29-31 invoices with shipment dates of January 2-8 | $1.6 million |
| January credit memos linked to December 29-31 invoices | $1.2 million |
The staff documented “no exception” because the invoice population reconciled to the sales ledger. Which correction to the audit response is most appropriate?
Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The reconciliation to the sales ledger supports population agreement, but it does not resolve whether revenue was recorded in the proper period. The ADA output shows invoices recorded before year end even though shipment occurred after year end, creating a cutoff exception under the client’s revenue policy.
Audit data analytic outputs should be used to identify notable relationships and exceptions, not merely to confirm that summarized data agrees to the general ledger. Here, the key relationship is between invoice date and shipment date. Because the client recognizes revenue when goods are shipped, invoices dated December 29-31 but shipped January 2-8 were recorded too early unless other evidence changes that conclusion. The proper audit response is to treat those items as cutoff exceptions and propose an adjustment for revenue and receivables not earned by December 31. The January credit memos further support targeted follow-up, but the most direct correction is the cutoff adjustment for the identified shipped-after-year-end invoices.
The ADA output identifies a cutoff anomaly because the client recognizes revenue on shipment and $1.6 million of year-end invoices were shipped after year end.
Topic: Assessing Risk and Developing a Planned Response
During planning of an audit of a nonissuer, the audit team documents the following issue: The client’s ERP system automatically calculates sales discounts and posts revenue and accounts receivable. The draft audit strategy relies on these automated application controls to assess control risk below maximum for revenue occurrence and accuracy and to reduce year-end substantive testing. However, the IT walkthrough shows that user-access changes are not reviewed, terminated users retain ERP access for up to 60 days, and no compensating monitoring controls have been identified. What is the best correction to the draft audit strategy?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The access-control weakness affects whether the auditor can rely on automated application controls. Because no compensating controls were identified, the audit strategy should increase control risk for the affected assertions and expand substantive procedures rather than reduce them.
IT general controls support the continued operation and reliability of automated application controls. If user access is not properly controlled, unauthorized or inappropriate changes or transactions could affect revenue processing, so the auditor cannot simply rely on automated discount and posting controls as planned. When controls are not suitably designed, implemented, or supported by effective IT general controls, the auditor should assess control risk higher, often at maximum for the affected assertions, unless effective compensating controls are identified and tested. The planned audit response should then shift toward more persuasive substantive procedures, such as increased detailed testing and procedures performed closer to year-end.
Weak IT general controls over access undermine reliance on related automated controls, requiring a higher control risk assessment and expanded substantive procedures.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA firm is engaged to audit a 401(k) plan’s financial statements to be filed with the plan’s Form 5500 under ERISA. During the plan year and the audit period, the firm’s employee benefit plan services group maintained the plan’s participant account balances and transaction records as the plan recordkeeper. The firm proposes assigning a separate audit team and having plan management review all audit work. How should this relationship be characterized?
Best answer: B
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: Department of Labor independence rules for employee benefit plan audits prohibit an auditor from maintaining the plan’s financial records. Because the CPA firm acted as the plan recordkeeper, it is not independent for the ERISA plan audit and should not serve as the independent qualified public accountant.
Employee benefit plan audits filed under ERISA are subject to Department of Labor independence requirements in addition to general professional standards. A firm that maintains the financial records of the plan, such as participant account balances and transaction records, has a prohibited relationship with the plan. This is not merely a threat to be evaluated with safeguards; it directly impairs independence for the plan audit. Using a separate audit team or obtaining management review does not remove the prohibited relationship. The appropriate engagement response is to decline or withdraw from serving as the plan’s independent auditor.
Maintaining the plan’s financial records is a prohibited relationship for an ERISA plan auditor and cannot be cured by separate staffing or management review.
Topic: Assessing Risk and Developing a Planned Response
An auditor is planning substantive procedures for a nonissuer manufacturer. Revenue is a significant class of transactions. The company’s terms are FOB shipping point, and revenue should be recognized when goods are shipped. The auditor identifies a risk that December sales invoices may have been recorded before shipment to meet a revenue target. Which procedure best addresses the relevant assertion for this risk?
Best answer: C
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The identified risk is that recorded December revenue may not have been earned because shipment had not occurred. Selecting recorded sales and vouching them to shipping documents directly addresses occurrence and cutoff for revenue recorded near year-end.
When revenue recognition depends on shipment, the relevant evidence for recorded year-end sales is documentation showing when goods were actually shipped. Because the risk is overstatement—sales recorded before shipment—the auditor should start with recorded sales invoices and vouch them to bills of lading or shipping logs. This direction tests whether recorded transactions occurred and were recorded in the correct period. Starting from shipping documents and tracing to the sales journal would primarily test completeness, not overstatement. Control approvals and analytical procedures may provide useful information, but they do not directly test whether the specific recorded sales met the shipment condition for recognition.
Vouching recorded year-end sales to shipping evidence directly tests whether recorded revenue occurred and was recognized in the proper period.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA firm is asked by a nonissuer client to report on management’s assertion that the company met specified criteria for the percentage of recycled content in its products during the year. Management accepts responsibility for the assertion and the criteria. The client wants the CPA to obtain sufficient appropriate evidence and express an opinion on whether the assertion is fairly stated. Which engagement classification is most appropriate?
Best answer: A
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: This is an attestation examination because the CPA is engaged to express an opinion on management’s assertion about subject matter other than historical financial statements. The subject matter is measured against specified criteria, and management is responsible for the assertion.
In an attestation examination, a practitioner obtains sufficient appropriate evidence to provide reasonable assurance and express an opinion on subject matter or an assertion that is the responsibility of another party. Here, the recycled-content assertion is nonfinancial subject matter, management accepts responsibility for it, specified criteria exist, and the requested report is an opinion. Those facts point to an examination engagement under the SSAEs. A financial statement audit would address historical financial statements under GAAS. A SSARS review applies to historical financial statements and provides limited assurance, not an opinion on nonfinancial subject matter. An agreed-upon procedures engagement reports procedures performed and findings, not an overall opinion.
The CPA would report with an opinion on nonfinancial subject matter that is management’s responsibility and measured against suitable criteria.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is testing Brightline Co.’s year-end customer rebate accrual. Based on the workpaper note, which additional procedure should the auditor perform next to address the conflicting evidence?
Workpaper note:
Recorded year-end rebate accrual: $420,000, based on 2% of eligible sales.
The auditor recalculated management’s schedule at 2% and agreed the amount to the general ledger.
During subsequent-disbursements testing, 6 of 20 January rebate payments were made at 4% of Q4 sales to national distributors.
The sales vice president stated that certain national distributors received a revised rebate rate late in the year, but accounting has not provided the revised agreements.
A. Obtain an additional management representation that no unrecorded rebate obligations exist.
B. Conclude the recorded accrual is reasonable because the auditor’s recalculation agreed to the general ledger.
C. Treat the matter only as a potential control deficiency and stop substantive testing of the accrual.
D. Inspect the revised distributor agreements and recalculate the rebate accrual for all affected Q4 eligible sales.
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The recalculation agreed to management’s schedule only because it used the same 2% assumption. Subsequent payments and inquiry indicate some agreements may require a 4% rate, so the auditor needs additional corroborating evidence and a revised recalculation for the affected population.
When audit evidence from recalculation, reperformance, or tests of details conflicts with other evidence, the auditor should not simply accept the favorable result. The inconsistency must be investigated and resolved by performing additional procedures. Here, the auditor’s recalculation proves only that the client’s schedule is mathematically accurate at 2%. It does not establish that 2% is the correct contractual rate for all distributors. January payments at 4% and the sales vice president’s statement suggest that a portion of the year-end obligation may be understated. Inspecting the revised agreements and recalculating the accrual for the affected Q4 sales directly addresses the source and amount of the possible misstatement.
The auditor should resolve the inconsistency by obtaining corroborating evidence and recalculating the amount using the terms that may apply.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is evaluating the allowance for expected credit losses for a nonissuer. Management changed the loss-rate model from a 5-year historical average to a 12-month average, which reduced the allowance materially. Management states that the shorter period better reflects improved credit quality. Which item of audit evidence best supports a conclusion that the estimate includes an indicator of management bias?
Best answer: C
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The strongest support for management bias is evidence that management selectively excluded unfavorable data from the estimate. Omitting charge-offs and delinquencies that met the model’s criteria suggests biased data selection, not merely a reasonable change in method.
When auditing estimates, the auditor evaluates whether management’s methods, assumptions, data, and disclosures are reasonable and free from indicators of bias. A change in method is not automatically biased, but it becomes suspicious when management applies the method selectively or excludes relevant data without support. Here, the omitted recent charge-offs and delinquencies directly affect the loss-rate estimate, meet the model’s own inclusion criteria, and would increase the allowance. That evidence supports a conclusion that management’s data selection may be biased toward understating the allowance.
Selective exclusion of unfavorable data that should have been included under the model is strong evidence of biased data selection in the estimate.
Topic: Forming Conclusions and Reporting
A CPA firm is engaged to report on a customer’s compliance with selected provisions of a supply contract. The engagement partner concludes that the report should be an agreed-upon procedures report, rather than an examination, review, audit, or compilation report. Which item in the engagement file best supports that conclusion?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: The strongest support is documentation that the CPA will perform specified procedures agreed to by the relevant users and report only the resulting findings. That reporting model distinguishes agreed-upon procedures from assurance reports and from compilations.
In an agreed-upon procedures engagement, the practitioner performs procedures that are specified in advance and objectively described, then reports the procedures performed and the findings obtained. The practitioner does not provide an opinion, a conclusion, or assurance; users evaluate the findings for themselves. An examination or audit provides reasonable assurance, a review provides limited assurance, and a compilation presents information without performing agreed procedures or reporting findings. Therefore, the engagement letter describing specified procedures, user responsibility for their sufficiency, and no assurance best supports the AUP reporting conclusion.
An agreed-upon procedures engagement is characterized by performing specified procedures and reporting findings without providing assurance.
Topic: Assessing Risk and Developing a Planned Response
An audit senior reviews a staff workpaper that maps a client issue to the COSO framework:
“The company implemented a new online order-entry system during the year. Management did not evaluate how automated pricing, order completeness, or the interface to the general ledger changed risks to reliable financial reporting. Staff mapped the issue to the Information and Communication component and recommended sending employees a notice about the new system.”
Which revision best corrects the workpaper?
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The deficiency is that management did not consider how a significant operational and IT change affected financial reporting risks. Under COSO, that belongs in the Risk Assessment component, specifically the principle addressing identification and assessment of significant changes.
COSO’s internal control framework has five components supported by principles. Risk Assessment includes identifying and analyzing risks to achieving objectives and considering changes that could significantly affect internal control. A new online order-entry system can affect pricing, order completeness, and the general ledger interface, all of which can change risks relevant to reliable financial reporting. The best correction is to reclassify the issue from Information and Communication to Risk Assessment and focus management’s response on updating its risk assessment and related control design considerations. Communicating the change or testing controls may be useful later, but those responses do not correct the misidentified COSO component and principle.
A major system change that management has not evaluated is a COSO risk assessment issue involving identification and assessment of significant change.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a nonissuer wholesaler, the engagement team identifies an elevated risk that year-end revenue may be recorded from system-generated sales invoices before the related goods are shipped. The company’s policy is to recognize revenue when goods are shipped and a bill of lading is issued. Which planned audit procedure best responds to this assessed risk?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The risk is that revenue was recorded too early, before shipment occurred. The planned response should start with recorded sales and obtain evidence that shipment had occurred by the recognition date.
When the assessed risk is overstatement of revenue or premature cutoff, the auditor generally tests from the recorded accounting population back to source documents that support occurrence and timing. Here, sales invoices near year-end are the recorded revenue items at risk. Inspecting the related bills of lading provides evidence about whether the goods were shipped before revenue was recognized. Tracing from shipping documents to invoices primarily tests completeness, not whether recorded revenue is overstated. Analytical procedures and receivable confirmations may provide useful evidence, but they do not as directly address whether specific recorded sales were recognized before shipment.
Vouching recorded revenue to shipping evidence directly addresses the risk of overstated revenue or improper cutoff.
Topic: Performing Further Procedures and Obtaining Evidence
An audit staff member is preparing a purchase-disbursement data file for further audit procedures. The client provided a field named vendor_risk_score with values 1, 2, 3, and 4, where 1 = low risk, 2 = moderate risk, 3 = high risk, and 4 = critical risk. The staff member calculated the average vendor_risk_score by purchasing agent and plans to treat a difference of 1.0 in the average as meaning the same increase in risk for every agent. What is the best correction to the staff member’s treatment of this field?
vendor_risk_score as an ordinal, discrete field and use category counts, percentages, or rank-based comparisons rather than assuming equal numeric intervals.vendor_risk_score as a nominal field and remove the ordering among low, moderate, high, and critical risk.vendor_risk_score as a ratio, continuous field because the values are numeric and have a lowest value of 1.Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The field is coded with ordered categories, not measurements with equal units. The best correction is to treat it as ordinal and discrete, using procedures that preserve the ranking without assuming equal intervals between risk levels.
Measurement scale matters when preparing audit data because it affects which transformations and analyses are valid. A numeric code does not automatically make a field interval or ratio data. Here, the values 1 through 4 represent ordered categories of vendor risk, so they are ordinal and discrete. The categories can be ranked from low to critical, but the difference between low and moderate risk is not necessarily equivalent to the difference between high and critical risk. Audit procedures should therefore use category distributions, stratification, filtering, or rank-based analysis rather than relying on averages as though each step were an equal unit of risk.
The risk codes have a meaningful order but do not establish equal distances between categories, so ordinal treatment is more appropriate.
Topic: Performing Further Procedures and Obtaining Evidence
During an audit, management provides an AI-generated schedule used to support its year-end sales returns reserve. The AI tool imports current-year sales and post-year-end returns from the ERP, matches returns to original sales by invoice number, and applies reserve percentages by product line. Management personnel can change input files and override the percentages before exporting the schedule. The auditor has separately evaluated the reasonableness of the reserve percentages and now needs evidence about the reliability of the AI-generated schedule. Which item best supports the auditor’s conclusion that the schedule is reliable for use as audit evidence?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The strongest support combines reliable source data, evidence about possible management intervention, and auditor reperformance of the AI-generated output. Because management can alter inputs and override rules, the auditor needs evidence beyond representations or report metadata.
When an auditor uses information produced by the entity, including schedules generated with technology or AI, the auditor should evaluate whether the information is sufficiently reliable for the intended audit purpose. That includes considering the source and completeness of input data, whether the information was changed or biased by management, and whether the processing produced accurate results. An auditor-obtained read-only export reconciled to the general ledger supports authenticity and completeness of the underlying data. Logs or control evidence addressing unapproved overrides responds to susceptibility to management bias. Reperformance of matching and calculations provides direct evidence that the AI output was processed accurately.
This evidence directly addresses source-data authenticity, management override risk, and the accuracy of the AI tool’s processing.
Topic: Ethics, Professional Responsibilities and General Principles
During fieldwork for a nonissuer audit, a CPA firm discovers that the firm, not an individual employee, directly owns common stock of the audit client. The firm concludes that the financial interest creates an independence threat that cannot be eliminated or reduced to an acceptable level, and the firm is able to withdraw from the engagement. Under the AICPA independence framework, which engagement response is appropriate?
Best answer: A
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: Independence is required to perform and report on an audit. Because the firm itself holds a direct financial interest in the audit client and no safeguard can reduce the threat to an acceptable level, the appropriate response is to withdraw and not issue an audit opinion.
Under the AICPA independence conceptual framework, a CPA evaluates threats to independence and applies safeguards when available. If a threat cannot be eliminated or reduced to an acceptable level, independence is impaired. A direct financial interest in an audit client held by the firm is a severe self-interest threat and is not cured by disclosure, client consent, or a report paragraph. When the impairment exists during the engagement and the firm can withdraw, the firm should discontinue the attest engagement rather than continue as though the report can be modified to make the impairment acceptable.
A firm-level direct financial interest impairs independence, and an attest engagement should be discontinued when the threat cannot be reduced to an acceptable level.
Topic: Forming Conclusions and Reporting
A CPA firm is engaged under AICPA attestation standards to perform agreed-upon procedures on a nonissuer’s royalty schedule. The engagement letter identifies two procedures: compare selected sales amounts to the general ledger and recompute the royalty percentage. The letter states that the firm will not provide an opinion or conclusion. After completing the procedures with no exceptions, management asks the firm to add the statement, “Nothing came to our attention that the royalty schedule is misstated.” What should the CPA firm do next?
Best answer: B
What this tests: Forming Conclusions and Reporting
Explanation: The requested wording is negative assurance, which is characteristic of a review, not an agreed-upon procedures report. In an AUP engagement, the practitioner reports the procedures performed and the findings obtained, but does not express an opinion or conclusion.
Agreed-upon procedures reporting is different from examination, review, audit, and compilation reporting. In an AUP engagement, the practitioner performs procedures that are specified in the engagement and reports the results as factual findings. Even if no exceptions are found, the report should not say that nothing came to the practitioner’s attention or that the subject matter is fairly stated. Those statements imply assurance beyond the scope of an AUP engagement. The proper next step is to keep the report within the agreed-upon procedures format unless the engagement is changed and sufficient appropriate work is performed under another type of engagement.
An agreed-upon procedures report presents procedures and findings without providing negative assurance, an opinion, or a conclusion.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA is evaluating whether to continue as auditor of a nonissuer. Management will sign an engagement letter only if it omits management’s acknowledgment of responsibility for designing, implementing, and maintaining internal control relevant to the preparation and fair presentation of the financial statements. The audit is not required by law or regulation. Given these facts, what should the CPA do next?
Best answer: B
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: Before accepting or continuing an audit, the auditor must obtain management’s agreement that it acknowledges certain responsibilities. If management refuses a required acknowledgment and the audit is not legally required, the auditor should not accept or continue the engagement.
Audit preconditions include management’s use of an acceptable financial reporting framework and management’s agreement to acknowledge its responsibilities. Those responsibilities include preparation and fair presentation of the financial statements, design and maintenance of relevant internal control, and providing the auditor access to information and persons needed for the audit. This acknowledgment is not merely a report disclosure issue or an audit procedure to be replaced by more testing. Because management refuses to acknowledge responsibility for internal control and the engagement is not required by law or regulation, the CPA should decline to continue unless management agrees to the required term.
Management’s agreement to acknowledge its responsibilities is an audit precondition, so the CPA should not continue the engagement if management refuses.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is testing the operating effectiveness of a control requiring documented credit manager approval before shipment for sales to new customers over $25,000. In a sample of 40 transactions, one shipment occurred before the approval was documented. The auditor verified that the invoice amount was accurate, the receivable was properly recorded, and the customer subsequently paid in full. Given these facts, what should the auditor do next?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The finding relates to whether the control operated as designed, not whether the recorded dollar amount was misstated. Missing required approval is a control exception that must be evaluated for its cause and effect on control reliance, even if the transaction was recorded correctly and collected.
A test of controls evaluates whether a specified control was properly designed and operated effectively. Here, the control required documented credit manager approval before shipment. Because one shipment occurred before the required approval was documented, the auditor identified a control deviation. The fact that the invoice was accurate, the receivable was recorded properly, and the customer paid in full may indicate there is no monetary misstatement in that transaction, but it does not eliminate the control exception. The auditor should consider the nature and cause of the deviation, the deviation rate compared with the tolerable deviation rate, and whether planned reliance on the control remains appropriate. Any needed changes to substantive procedures would follow from that evaluation.
The missing required approval is a control deviation even though related substantive testing did not identify a monetary misstatement.
Topic: Forming Conclusions and Reporting
A CPA is engaged to compile annual financial statements for a nonissuer under U.S. GAAP. The CPA’s spouse is the client’s controller. Management elects to omit substantially all note disclosures, and the CPA concludes the omission is not intended to mislead users. Which reporting treatment is appropriate?
Best answer: A
What this tests: Forming Conclusions and Reporting
Explanation: The appropriate report is still a compilation report, but it must address both key facts. Lack of independence does not prohibit a compilation, but it must be disclosed, and management’s election to omit substantially all GAAP disclosures requires explanatory language in the report.
In a SSARS compilation engagement, the accountant assists management in presenting financial statements and issues a compilation report that provides no assurance. Independence is not required to perform a compilation; however, if the accountant is not independent, the compilation report must disclose that fact. Also, when management elects to omit substantially all disclosures required by the applicable financial reporting framework, the accountant may report on the statements if the omission is not intended to mislead users, but the report should state that management elected to omit those disclosures and that the statements are not designed for users who are not informed about such matters.
A compilation may be performed when the accountant is not independent if the report discloses the lack of independence, and omitted GAAP disclosures require appropriate report language.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is auditing a nonissuer’s December 31, 20X5 financial statements under GAAS. The auditor completed fieldwork and dated the auditor’s report March 5, 20X6, but the report has not been released. On March 9, management informs the auditor that a lawsuit filed before year-end for an alleged breach occurring before year-end was settled for $1.2 million. The client had accrued $700,000 at December 31 based on counsel’s estimated loss range, and the additional $500,000 is material. Management agrees to revise the financial statements to increase the liability and disclose the settlement. By March 10, the auditor has performed additional procedures only on the settlement and related revision. Which interpretation is best?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The lawsuit arose from conditions that existed at December 31, so the later settlement provides evidence about the amount of a year-end liability. Because the auditor performed additional procedures only for this matter, dual dating is appropriate to avoid taking responsibility for all subsequent events through March 10.
Subsequent events that provide additional evidence about conditions existing at the balance sheet date generally require recognition in the financial statements. Here, the lawsuit was filed before year-end and related to an alleged breach before year-end; the post-report-date settlement refines the amount of the existing loss contingency. Because management revises the financial statements, the auditor must perform procedures on the revision. When the auditor limits those additional procedures to the specific subsequent event, the auditor may dual-date the report, using the original report date except for the revised note and adjustment, which are dated as of the completion of the related procedures.
The settlement provides additional evidence about a year-end condition, and dual dating limits the auditor’s subsequent-events responsibility to the revised matter.
Topic: Forming Conclusions and Reporting
An auditor is completing a nonissuer audit of a county’s basic financial statements prepared under U.S. GAAP. The audit evidence supports an unmodified opinion on the basic financial statements, and there were no scope limitations. The applicable accounting framework requires management’s discussion and analysis (MD&A) to accompany the basic financial statements as required supplementary information, but management omitted the MD&A and refuses to present it. What is the best interpretation of the reporting effect?
Best answer: A
What this tests: Forming Conclusions and Reporting
Explanation: Required supplementary information is not part of the basic financial statements, so its omission does not by itself require a modified opinion on those statements. Because the framework requires the MD&A, the auditor must call attention to the omission in an other-matter paragraph.
When required supplementary information is omitted, the auditor reports the omission but does not treat it as a misstatement of the audited basic financial statements. The auditor’s opinion remains unmodified if sufficient appropriate audit evidence supports fair presentation of the basic financial statements and there is no audit scope limitation. The reporting response is to include an other-matter paragraph explaining that management omitted information the applicable framework requires to supplement the basic financial statements and that the auditor’s opinion on the basic financial statements is not affected by the omission.
Omitted required supplementary information is reported in an other-matter paragraph and does not modify the opinion when the basic financial statements are fairly presented.
Topic: Assessing Risk and Developing a Planned Response
During planning for a nonissuer audit, an auditor documented the following IT general control over access changes to the sales application:
| Item | Workpaper note |
|---|---|
| Control objective | Access changes are authorized by the application owner and accurately recorded. |
| Control description | The IT security administrator can create and modify user access. Each Friday, the same administrator prints a system report of all access changes and initials it after comparing the changes to help-desk tickets. The tickets identify the requestor and user ID, but application owner approval is not required or documented. |
| Procedures performed | The auditor inquired of the administrator and inspected the prior Friday’s initialed report. |
| Draft conclusion | The control is suitably designed and has been placed in operation. |
Which correction should the auditor make to the draft conclusion?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The observed initialed report supports that the control was placed in operation as described. However, the design does not meet the stated objective because the review is not tied to documented application owner approval of access changes.
Design and implementation testing is different from testing operating effectiveness. A control is suitably designed if, assuming it operates as prescribed, it would prevent, or detect and correct, the relevant misstatement or control failure. Here, the objective is authorization of access changes by the application owner. Comparing changes to help-desk tickets that do not include required owner approval does not establish authorization, especially when the reviewer is the same person who can make access changes. The auditor’s inquiry and inspection of an initialed report provide evidence that the control exists and has been placed in operation, but the design conclusion should be revised because the control would not achieve its stated objective.
Inquiry and inspection support implementation, but the described review does not address the authorization objective.
Topic: Performing Further Procedures and Obtaining Evidence
Near completion of a nonissuer audit, the auditor performs final analytical procedures after proposed adjustments have been recorded. The auditor’s understanding is that the client had no change in credit terms, but an October billing-system conversion caused invoice errors and delayed collections through year-end.
| Relationship | Prior year audited | Current year preliminary |
|---|---|---|
| Credit sales | $40.0 million | $42.0 million |
| Accounts receivable | $8.4 million | $8.8 million |
| Receivables over 90 days past due | 7% of receivables | 18% of receivables |
| Allowance for doubtful accounts | 3.4% of receivables | 2.1% of receivables |
Which interpretation is most appropriate?
Best answer: B
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: Final analytical procedures are used near the end of the audit to evaluate whether the financial statements are consistent with the auditor’s understanding. Here, increased aging deterioration combined with a lower allowance percentage is an unexpected relationship that requires follow-up.
At the overall review stage, analytical procedures help the auditor identify unusual or unexpected relationships that may indicate an unrecognized misstatement or an incomplete understanding of the entity. The client’s delayed collections and higher percentage of receivables over 90 days past due would ordinarily suggest increased collectibility risk. A decrease in the allowance as a percentage of receivables moves in the opposite direction and is not adequately explained by the facts provided. The auditor should obtain and evaluate management’s explanation and perform additional procedures as needed before concluding whether the financial statements are fairly presented.
Final analytical procedures should identify whether financial statement relationships are inconsistent with the auditor’s understanding and require further evaluation.
Topic: Assessing Risk and Developing a Planned Response
An auditor is assessing the design of controls in a nonissuer client’s revenue cycle. Management states the following control objective: “Exempt sales are processed only when a valid sales tax exemption certificate is on file for the customer.” The auditor concludes that this objective is primarily a compliance objective. Which item of evidence best supports that conclusion?
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The stated objective concerns whether exempt sales comply with sales tax rules by requiring valid exemption certificates. Evidence that the billing system rejects exempt tax treatment without a current certificate best supports classification as a compliance objective.
Control objectives may relate to broad COSO categories, such as operations, reporting, and compliance, or to transaction-level objectives, such as completeness, accuracy, authorization, and safeguarding. A compliance objective focuses on adherence to laws, regulations, or contractual requirements. Here, the key concern is not whether all sales are billed, whether invoice amounts are accurate, or whether assets are protected. The concern is whether the entity processes tax-exempt sales only when the required exemption documentation exists. A system rule preventing exempt tax codes without a current certificate directly supports that compliance classification.
This evidence links the control objective to adherence with sales tax requirements for exempt transactions.
Topic: Assessing Risk and Developing a Planned Response
During planning for a nonissuer audit, the engagement team reviewed management’s documentation of internal control over financial reporting. Based on the workpaper note, which COSO component and principle are most specifically illustrated by management’s separate discussion of incentives and opportunities for fraudulent revenue recognition?
Workpaper note:
Management conducts a quarterly meeting with accounting, sales, and IT process owners to update the financial reporting risk register. For each financial reporting objective, the group identifies events that could prevent the objective from being achieved and assesses likelihood and impact. The agenda requires a separate discussion of incentives and opportunities for fraudulent revenue recognition before control owners design or modify responses.
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The exhibit most directly describes risk assessment, not the design or monitoring of controls. COSO includes a specific Risk Assessment principle requiring the organization to consider the potential for fraud when assessing risks to achieving objectives.
Under COSO, internal control is organized into five components, each supported by principles. The Risk Assessment component includes identifying and analyzing risks to objectives and specifically considering the potential for fraud. The workpaper note states that management updates a financial reporting risk register, evaluates likelihood and impact, and separately discusses incentives and opportunities for fraudulent revenue recognition. Those facts support a conclusion about the Risk Assessment component and the fraud-risk principle. The later design or modification of control responses may involve control activities, but the described activity is the assessment that precedes those responses.
The separate evaluation of fraud incentives and opportunities directly supports COSO’s Risk Assessment principle of considering fraud risk.
Topic: Ethics, Professional Responsibilities and General Principles
An engagement manager is reviewing the required communications workpaper for a nonissuer audit under U.S. GAAS before the auditor’s report is released. The audit committee is those charged with governance.
| Communication item | Draft status |
|---|---|
| Planned scope and timing | Communicated at planning |
| Significant findings from the audit | No items noted |
| Significant deficiencies or material weaknesses | No items noted |
Completion notes:
Given these facts, what should the engagement manager do next?
Best answer: B
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The workpaper should be updated before report release because the audit identified required communications that are missing from the draft schedule. A material corrected misstatement and a significant difficulty caused by management’s delay are significant audit findings for communication to those charged with governance.
Under U.S. GAAS, auditors communicate significant findings from the audit to those charged with governance. These include corrected misstatements that could have a significant effect on the entity’s financial reporting process and significant difficulties encountered during the audit, such as unreasonable management delays in providing information. The fact that management recorded the material cutoff adjustment does not eliminate the communication requirement. Likewise, obtaining sufficient appropriate evidence after the delay avoids a scope limitation, but the delay may still be a significant difficulty to communicate. The $12,000 reclassification is below the clearly trivial amount, so it is not the item driving the required communication. No control deficiencies were identified, so a deficiency communication is not the next step.
Material corrected misstatements and significant difficulties encountered during the audit are required communications to those charged with governance.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a privately held electronics distributor, the engagement team identifies the following facts:
The draft audit plan states: “No change is needed to the inventory audit approach because the team will observe the physical inventory count.” Which correction to the audit plan is most appropriate?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The external business condition directly increases the risk that inventory is overstated. Observing the count provides evidence about existence and quantity, but the audit plan must also address valuation through procedures focused on lower of cost and net realizable value.
Audit planning should respond to external conditions that affect inherent risk. A market decline caused by replacement products creates a risk that older inventory may not be recoverable at recorded cost. The appropriate correction is to add valuation-focused procedures, such as reviewing current selling prices, testing subsequent sales, analyzing slow-moving or obsolete items, and evaluating management’s write-down assumptions. Physical observation remains useful, but it does not provide sufficient evidence about whether inventory should be written down. The response should be targeted to the affected assertion and should not jump directly to a reporting modification before obtaining evidence.
External price declines increase inherent risk for inventory valuation, so the plan should add procedures addressing lower of cost and net realizable value rather than only quantity.
Topic: Forming Conclusions and Reporting
An auditor is completing the final review of a nonissuer audit of financial statements prepared under U.S. GAAP. Overall materiality for the financial statements as a whole is $800,000, and performance materiality used in planning and testing was $350,000. Management corrected all other identified misstatements but declined to correct the following items. No projected sampling misstatements or other unresolved matters remain.
| Uncorrected misstatement | Effect |
|---|---|
| Allowance for doubtful accounts understated | Assets and income before tax overstated by $210,000 |
| Accrued expenses understated | Liabilities understated and income before tax overstated by $160,000 |
| Depreciation expense overstated | Property, plant, and equipment understated and income before tax understated by $90,000 |
The auditor found no fraud indicators, no covenant or compensation threshold affected, and no trend affected by the uncorrected misstatements. Final analytical procedures showed gross margin declined from 41% to 35%; supplier invoices showed a 15% increase in raw material costs, sales prices were unchanged, and production volumes were consistent with management’s explanation.
Which conclusion is most consistent with the audit evidence obtained?
Best answer: D
What this tests: Forming Conclusions and Reporting
Explanation: The final evaluation uses overall materiality and qualitative factors, not performance materiality alone. Here, the uncorrected misstatements are not material individually or in aggregate, and the gross margin fluctuation has been corroborated by other audit evidence.
In forming an opinion, the auditor evaluates whether uncorrected misstatements are material individually or in the aggregate, considering both quantitative and qualitative factors. Performance materiality is used to plan and perform audit procedures; it is not the final threshold that automatically requires a modified opinion. The aggregate absolute uncorrected misstatements are $460,000, and the net income overstatement is $280,000, both below the $800,000 overall materiality amount. The stem also states that no qualitative factors, such as fraud indicators, covenant effects, compensation effects, or trend changes, make the items material. The gross margin decline does not create an unresolved issue because it is supported by corroborating evidence from invoices, pricing, and production data.
The uncorrected misstatements are below overall materiality individually and in aggregate, no qualitative factors indicate materiality, and the analytical fluctuation is corroborated.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor tests a client’s control requiring electronic approval before cash disbursements are released. The auditor selects a random sample of 60 disbursements from the complete disbursement population. During review, the audit manager finds that the staff auditor misunderstood the approval screen and recorded several unapproved items as approved. Which conclusion best classifies this issue?
Best answer: B
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The issue is nonsampling risk because the error arose from the auditor’s misunderstanding of the evidence. Sampling risk concerns the chance that a properly evaluated sample leads to a different conclusion than testing the entire population would have produced.
Sampling risk relates to representativeness: even a properly selected and evaluated sample may not reflect the population closely enough, causing the auditor to reach the wrong conclusion. Nonsampling risk arises from causes other than the sample itself, such as using an inappropriate procedure, failing to detect an exception, or misinterpreting audit evidence. Here, the population was complete and the sample was randomly selected, but the staff auditor incorrectly evaluated the approval evidence. That is an execution or judgment error, so it is nonsampling risk.
Misinterpreting evidence is an auditor performance error unrelated to whether the selected sample represents the population.
Topic: Assessing Risk and Developing a Planned Response
A CPA is planning the audit of a nonissuer electronics manufacturer for the year ended December 31, 20X6. The client obtains a key microchip from a single overseas supplier, and new export restrictions in that country caused uncertain delivery schedules in the fourth quarter. The client’s finished goods have short product life cycles because models are replaced annually. Which planning conclusion is most appropriate?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: External conditions can increase susceptibility to material misstatement before considering internal controls. Here, supplier disruption and short technology cycles create a heightened risk that inventory may be obsolete or not recoverable at recorded amounts.
Inherent risk is affected by economic, industry, regulatory, supply-chain, technology, and financial reporting framework factors. A single-source overseas supplier subject to export restrictions is a supply-chain and regulatory condition that can disrupt production or sales. Short product life cycles are an industry and technology condition that can make inventory become obsolete quickly. Together, those facts most directly affect the valuation assertion for inventory, including whether recorded cost is recoverable under the applicable financial reporting framework. The conclusion is not about control risk unless facts indicate a control design or operating issue, and it is not detection risk, which relates to the auditor’s procedures.
These external supply-chain and industry technology conditions make inventory more susceptible to valuation misstatement before considering controls.
Topic: Forming Conclusions and Reporting
An auditor is completing an audit of a nonissuer’s comparative financial statements prepared under U.S. GAAP. During the current year, management changed its inventory cost-flow method from FIFO to weighted-average. The auditor concludes the new method is preferable, the change was accounted for in accordance with GAAP, and the notes adequately disclose the nature and effect of the change. The change has a material effect on comparability. How should the auditor characterize this reporting issue?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: The change is not an opinion issue because the auditor concluded it is preferable, GAAP-compliant, and adequately disclosed. A material change in accounting principle affecting comparability is ordinarily communicated with an emphasis-of-matter paragraph while the opinion remains unmodified.
Report modifications, such as qualified, adverse, or disclaimer opinions, address opinion issues like material misstatements or insufficient appropriate audit evidence. By contrast, emphasis-of-matter paragraphs draw users’ attention to matters that are appropriately presented or disclosed in the financial statements. Here, the accounting change is justified, properly accounted for, and adequately disclosed, so it is not a GAAP departure. Because it materially affects comparability, the auditor should highlight it in an emphasis-of-matter paragraph referring to the related disclosure, while issuing an unmodified opinion.
A justified, properly accounted for, and adequately disclosed change in accounting principle that materially affects comparability is highlighted in an emphasis-of-matter paragraph and does not modify the opinion.
Topic: Performing Further Procedures and Obtaining Evidence
During the audit of a nonissuer, the allowance for credit losses was identified as a significant risk because management uses a spreadsheet model with multiple assumptions. The engagement team selected the commercial-loan Grade B segment for reperformance of the model application. Based on the exhibit, which conclusion is best supported?
Workpaper excerpt—Grade B allowance component
Documented method: Allowance = Amortized cost balance × probability of default (PD) × loss given default (LGD)
Clearly trivial threshold for audit differences: \$50,000
Audited input data:
- Amortized cost balance per reconciled loan file: \$40,000,000
- PD per approved risk committee assumption file: 3.0%
- LGD per approved recovery study: 45.0%
Management's recorded Grade B allowance component: \$360,000
Auditor's reperformance: \$40,000,000 × 3.0% × 45.0% = \$540,000
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: Reperformance tests whether management correctly applied the selected method using the relevant data and assumptions. Here, the audited inputs and approved assumptions produce an allowance of $540,000, not $360,000, so the exhibit supports a potential understatement that should be accumulated and discussed.
For a significant accounting estimate, the auditor may obtain evidence by testing management’s process, including whether the method was applied accurately. Reperformance is especially useful when the method is formula-driven, such as a credit loss model using balance, PD, and LGD. In this exhibit, the data and assumptions appear to agree to audited or approved sources, but management’s recorded amount does not agree to the documented formula. The difference is $540,000 minus $360,000, or $180,000. Because that amount exceeds the clearly trivial threshold, it should not be ignored; it should be accumulated as an audit difference and discussed with management for correction or further explanation.
The auditor’s reperformance using audited data and approved assumptions produces $540,000, which is $180,000 above management’s recorded amount and exceeds the clearly trivial threshold.
Topic: Assessing Risk and Developing a Planned Response
During the audit of a nonissuer, the user auditor is deciding how to use the following workpaper note about a payroll service organization. Which planned audit response is most appropriate?
| Fact | Detail |
|---|---|
| Service organization | PayServ processes all payroll transactions and maintains programmed controls over employee master-file changes. |
| User entity year-end | December 31, 20X6. |
| SOC 1 report obtained | Type 2 report for January 1 through September 30, 20X6, with an unmodified service auditor’s opinion. |
| Relevant SOC results | Controls over authorization and processing of employee master-file changes were tested with no exceptions. |
| Complementary user controls stated in report | The user entity’s HR department must approve pay-rate changes and review payroll exception reports. |
| Procedures to date | No procedures have been performed for PayServ controls or the complementary HR controls for October through December. |
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: A SOC 1 Type 2 report provides evidence about the design and operating effectiveness of relevant service organization controls only for the period and control objectives covered. Here, it may reduce direct testing of PayServ controls for January through September, but the user auditor still must address complementary user controls and the October-through-December gap.
A user auditor may use a SOC 1 Type 2 report as audit evidence about controls at a service organization when those controls are relevant to the user entity’s financial reporting and the report covers the period being relied on. The Type 2 report is stronger than a Type 1 report because it includes operating effectiveness testing, but it does not automatically cover periods outside the report date range. Also, if the report assumes complementary user entity controls, the user auditor must evaluate and, when relying on them, test those controls at the user entity. For the uncovered October-through-December period, the auditor should perform additional procedures, such as obtaining a bridge letter, inquiring about changes, extending control testing, or modifying substantive procedures.
A SOC 1 Type 2 report can support reliance for the covered period, but the user auditor must address complementary user controls and any gap period.
Topic: Performing Further Procedures and Obtaining Evidence
An audit manager is reviewing engagement-team documentation for a complex fair value estimate of an acquired technology intangible asset. Management used an external valuation specialist, and the recorded fair value is material.
| Workpaper excerpt | Details |
|---|---|
| Specialist competence and objectivity | Valuation credential verified; no financial interest or other relationship with the client identified. |
| Method used | Relief-from-royalty method; engagement team recalculated the model without exception. |
| Key assumptions in specialist report | Royalty rate of 6%; discount rate of 9%. |
| Other evidence in the file | Recent comparable licenses show royalty rates of 2% to 3%; guideline company data indicate discount rates of 12% to 14%. |
| Engagement-team note | Management stated the 6% rate reflects expected premium pricing but provided no customer contracts, market studies, or other corroborating support. |
Which review comment is most appropriate based on the workpaper excerpt?
Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The workpaper shows that significant assumptions used in the specialist’s valuation are inconsistent with other evidence and lack corroboration. The appropriate review comment is to perform further procedures focused on those assumptions, not to accept the estimate based only on credentials, arithmetic accuracy, or management representations.
When management uses a specialist for a complex estimate, the auditor evaluates whether the specialist’s work provides sufficient appropriate audit evidence. That includes considering the specialist’s competence and objectivity, but it also requires evaluating the relevance and reasonableness of significant assumptions, methods, and source data. Here, the royalty rate and discount rate materially drive the relief-from-royalty valuation. The engagement team documented evidence suggesting lower royalty rates and higher discount rates than management used, and management has not provided corroborating support for its premium-pricing assertion. The reviewer should require additional audit procedures, such as obtaining market support, testing source data, challenging assumptions, or developing an independent expectation or range.
The file identifies unsupported significant assumptions that conflict with available market evidence, so recalculation and specialist credentials alone are insufficient.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor of a nonissuer plans to use a substantive analytical procedure to test the completeness and accuracy of interest expense. Audit documentation includes the following:
| Fact or result | Amount or description |
|---|---|
| Debt population | Confirmed directly with lenders; no unrecorded debt identified from minutes or subsequent cash disbursements |
| Interest terms | Fixed rates in loan agreements; no modifications during the year |
| Expected interest expense | $842,000 |
| Recorded interest expense | $834,500 |
| Acceptable difference for this procedure | $30,000 |
Which is the best interpretation of these results for the specified assertion?
Best answer: C
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: Substantive analytical procedures are most persuasive when the account has a predictable relationship and the auditor can develop a precise expectation from reliable data. Here, confirmed debt amounts, fixed contractual rates, and the absence of modifications make expected interest expense highly predictable, and the difference is within the stated threshold.
A substantive analytical procedure may support an assertion when the auditor can form a sufficiently precise expectation, the underlying data are reliable, and any difference from the recorded amount is acceptably small or otherwise explained. Interest expense often fits this model because it can be recomputed from principal, contractual rates, and time outstanding. In this scenario, the debt population has been addressed through confirmations and other procedures, loan terms are fixed, and the $7,500 difference is well below the $30,000 acceptable difference. Therefore, the procedure is suitable evidence for completeness and accuracy of interest expense, although it does not automatically resolve every debt-related audit area.
Interest expense has a predictable relationship to confirmed debt terms, and the unexplained difference is smaller than the planned acceptable difference.
Topic: Ethics, Professional Responsibilities and General Principles
A nonissuer asks a CPA firm to perform inquiry and analytical procedures on its annual GAAP financial statements for use by its lender. Management states that it does not want an audit. The draft engagement letter says, “We will perform a review and issue a report expressing an opinion that the financial statements present fairly in accordance with GAAP; this engagement provides reasonable assurance.” Which correction should be made?
Best answer: C
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The requested work—primarily inquiry and analytical procedures on nonissuer financial statements—matches a review engagement. A review provides limited assurance and reports a conclusion about whether the CPA is aware of material modifications needed, rather than expressing an audit opinion or reasonable assurance.
A financial statement review under SSARS is designed to provide limited assurance, not reasonable assurance. The accountant primarily performs inquiry and analytical procedures and issues a report stating whether the accountant is aware of any material modifications that should be made for the financial statements to be in accordance with the applicable financial reporting framework. Reasonable assurance and an opinion on fair presentation are features of an audit. Because management specifically requested no audit and described review-level procedures, the best correction is to align the engagement letter’s scope, assurance level, and reporting language with a review engagement.
A review of a nonissuer’s financial statements provides limited assurance based primarily on inquiry and analytical procedures and reports a conclusion, not an audit opinion.
Topic: Forming Conclusions and Reporting
A CPA has a signed engagement letter under SSARS to prepare a nonissuer’s annual financial statements from management’s trial balance. Management will send the prepared statements to its bank. The CPA firm also performs bookkeeping services for the client and is not independent. A staff member added this conclusion to the file: “Because the statements will be used by a third party and the firm lacks independence, the engagement must be changed to a compilation with a report disclosing the lack of independence.” What is the best correction to the staff member’s conclusion?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: The staff member is incorrectly applying compilation requirements to a preparation engagement. Third-party use and lack of independence do not, by themselves, require a compilation or review. A preparation engagement provides no assurance and normally uses a no-assurance statement on each page of the financial statements.
Under SSARS, an accountant engaged to prepare financial statements prepares the statements from information provided by management and does not issue an assurance report. Independence is not required for a preparation engagement, and third-party distribution does not automatically change the engagement to a compilation. The accountant should have an appropriate engagement agreement and should ensure that the prepared financial statements communicate that no assurance is provided, typically by including that statement on each page. In this scenario, the signed preparation engagement can continue; the error is the staff member’s conclusion that bank use and nonindependence require a compilation report.
A SSARS preparation engagement may be performed without independence and for third-party use, but the prepared statements should clearly communicate that no assurance is provided.
Topic: Performing Further Procedures and Obtaining Evidence
During the audit of a nonissuer’s December 31 accounts receivable, an auditor sent a positive confirmation for a $240,000 customer balance. The customer replied directly to the auditor: “We agree that we owe $150,000. The remaining $90,000 relates to goods received on January 4; title passes on delivery.” Management says the $90,000 is only a timing difference because the goods were shipped on December 30. What follow-up should the auditor perform?
Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The customer did respond, but the response disputes part of the recorded balance. That makes the $90,000 an exception, not a nonresponse, and the auditor must investigate the cause with relevant corroborating evidence such as shipping terms and delivery documentation.
A confirmation exception exists when information returned directly by the confirming party differs from the client’s recorded information. The auditor should evaluate whether the difference is a misstatement or a valid timing difference. Here, the customer’s statement raises a cutoff issue because title passes on delivery and delivery occurred after year-end. The auditor should inspect documents such as the sales invoice, shipping terms, bill of lading, proof of delivery, and related cutoff records to determine whether the receivable and revenue should have been recorded at December 31. Subsequent cash receipt evidence may help support collectibility or existence, but it does not by itself resolve whether the sale was recorded in the correct period.
A disputed amount in a direct confirmation response is an exception that requires investigation and corroborating evidence, especially for cutoff.
Topic: Forming Conclusions and Reporting
A CPA firm is engaged under AICPA attestation standards to perform a review, not an examination, of management’s written assertion that Green Co.’s greenhouse gas emissions schedule is prepared in accordance with stated, suitable criteria. The criteria are available to all intended users. The CPA completes the review and is not aware of any material modifications needed to management’s assertion. Which report conclusion is appropriate?
Best answer: A
What this tests: Forming Conclusions and Reporting
Explanation: An attestation review report expresses limited assurance using negative assurance language. Because the CPA performed a review and found no material modifications, the report should state that the CPA is not aware of needed material modifications to the assertion.
In an attestation examination, the practitioner provides reasonable assurance and expresses a positive opinion. In an attestation review, the practitioner provides limited assurance, so the conclusion is phrased negatively, such as “we are not aware of any material modifications” needed for the assertion to be fairly stated based on the criteria. The stem states that the engagement is a review, the criteria are suitable and available, and no material modifications were identified. Therefore, an unrestricted review conclusion using negative assurance is appropriate.
A review engagement provides limited assurance expressed in negative form when no material modifications are identified.
Topic: Assessing Risk and Developing a Planned Response
An auditor is planning substantive procedures over a client’s significant revenue transaction class. The client sells inventory FOB shipping point and recognizes revenue when goods are shipped. Planning analytics for the year ended December 31, 20X5 show:
| Result | Observation |
|---|---|
| Shipments | Shipping volume from December 29-31 was consistent with the normal daily run rate. |
| Recorded sales | Sales recorded from December 29-31 were 30% below the normal daily run rate. |
| Subsequent sales | Sales recorded from January 2-5 were 35% above the normal daily run rate. |
Which substantive procedure is best supported by these results?
Best answer: A
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The analytics suggest some goods shipped before year-end may have been recorded as sales after year-end. The best procedure starts with the shipping log, which is the source of potentially unrecorded revenue, and traces to the accounting records to test completeness and cutoff.
When the risk is understated revenue or improper cutoff for shipments made before year-end, the auditor should test from source documents to the accounting records. Because FOB shipping point revenue is earned when goods are shipped, December 29-31 shipping documents should have corresponding sales invoices and sales journal entries in the proper period. Tracing from the shipping log to recorded sales is the correct direction for testing completeness. Starting with recorded sales would primarily test occurrence, while confirmations and pricing recalculations address different assertions.
Tracing pre-year-end shipments to recorded sales directly tests revenue completeness and cutoff for goods shipped before year-end.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a nonissuer manufacturer, the auditor reads industry publications showing that a newly enacted safety regulation will prohibit sales of the client’s main product unless it is redesigned. The rule becomes effective shortly after year-end and may affect inventory valuation and sales forecasts. No control exceptions or unreasonable accounting estimates have been identified. How should this condition be characterized in planning?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The new safety regulation is an external condition that may increase inherent risk in areas such as inventory valuation and forecast-based estimates. The stem does not identify a failed control, unreasonable estimate, or detected misstatement.
In audit planning, external factors include industry, regulatory, economic, technological, and competitive conditions that may affect the risks of material misstatement. A new regulation that restricts the client’s main product is outside management’s control and may create valuation, obsolescence, impairment, or going-concern risks. That classification differs from an internal control deficiency, which requires a problem in the design or operation of controls, and from management bias, which requires evidence that management judgments are unreasonable or systematically slanted. Here, the auditor should treat the regulation as an external risk indicator and design further procedures responsive to the affected assertions.
A regulatory change outside the entity can increase inherent risk, such as valuation risk for inventory, without by itself indicating a control deficiency or bias.
Topic: Performing Further Procedures and Obtaining Evidence
Near the end of a nonissuer audit, after most substantive testing has been completed, the auditor performs final analytical procedures to assist in forming an overall conclusion.
| Final analytical review item | Prior year audited | Current year unaudited | Auditor’s understanding/expectation |
|---|---|---|---|
| Net sales | $20.0 million | $21.2 million | About a 6% increase due to a price increase |
| Year-end accounts receivable | $2.1 million | $3.4 million | Should generally move with sales |
| Days sales outstanding | 38 days | 58 days | Should remain near prior-year level |
| Allowance for doubtful accounts as % of receivables | 4.0% | 2.5% | Should remain near prior-year level |
Management states that credit terms, customer mix, and collection policies did not change. Which action is most appropriate based on these final analytical procedures?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The sales trend is consistent with expectations, but receivables, days sales outstanding, and the allowance percentage are not. Final analytical procedures are used to evaluate whether the financial statements are consistent with the auditor’s understanding and may reveal areas requiring further audit work.
Final analytical procedures are performed near the end of the audit to help the auditor form an overall conclusion about whether the financial statements are consistent with the auditor’s understanding of the entity. Here, sales increased about as expected, but receivables increased much faster, collection days worsened, and the allowance percentage declined despite no change in credit terms, customer mix, or collection policies. Those relationships suggest a possible unrecognized risk or misstatement affecting receivables, revenue cutoff, collectibility, or the allowance. The auditor should investigate the inconsistency and perform additional procedures as necessary before concluding on the financial statements.
Final analytical procedures identified relationships inconsistent with the auditor’s understanding, so the auditor should investigate and obtain additional evidence as needed.
Topic: Assessing Risk and Developing a Planned Response
During planning for a nonissuer audit, staff documented the client’s revenue process as follows: “Sales orders are entered into the order-entry system. Approved orders are shipped. The billing system records invoices and posts monthly sales totals to the general ledger.” The workpaper does not identify source documents, system interfaces, reports used for recording and review, or how revenue data are accumulated for financial statement presentation and disclosure. The audit senior asks staff to correct the walkthrough documentation. Which correction is most appropriate?
Best answer: B
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The best correction is to document the complete transaction and data flow, not merely add more testing or a representation. A walkthrough should follow a transaction from initiation through recording, processing, reporting, and disclosure while identifying the relevant documents, systems, interfaces, reports, and controls.
In planning an audit, the auditor obtains an understanding of significant business processes and related information systems. For a revenue process, adequate walkthrough documentation should show how transactions are initiated, authorized, processed, recorded in the general ledger, summarized for reporting, and reflected in financial statement presentation and disclosure. It should also identify the source documents, IT applications, interfaces, reports, and key control points that affect the flow of relevant data. The deficiency in the workpaper is incomplete process documentation, so the appropriate correction is to revise the narrative or flowchart to show the end-to-end flow.
Walkthrough documentation should show the end-to-end transaction and data flow for the significant process, including documents, systems, reports, and control points.
Topic: Forming Conclusions and Reporting
A city’s financial statements are audited under GAAS and Government Auditing Standards, and the city is also subject to a single audit under the Uniform Guidance. The auditor’s results include:
| Area | Result |
|---|---|
| Financial statements | Unmodified opinion |
| Internal control over financial reporting | One significant deficiency; no material weaknesses |
| Compliance affecting the financial statements | No instances of noncompliance required to be reported under Government Auditing Standards |
| Major federal program compliance | Material noncompliance with an eligibility requirement |
| Internal control over compliance for the major program | Material weakness |
Which is the best interpretation of the required reporting?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: The unmodified financial statement opinion does not eliminate Government Auditing Standards reporting. The auditor reports the significant deficiency in internal control over financial reporting and reports the major program compliance problem through the single audit compliance opinion, while not expressing an opinion on internal control itself.
In a financial statement audit performed under Government Auditing Standards, the auditor reports on internal control over financial reporting and on compliance with provisions of laws, regulations, contracts, and grant agreements that could have a material effect on the financial statements. This reporting describes the scope and results of testing and includes significant deficiencies and material weaknesses, but it does not provide an opinion on internal control effectiveness unless separately engaged to do so. In a single audit, the auditor also reports on compliance for each major federal program and on internal control over compliance. Material noncompliance with an eligibility requirement for a major program affects the compliance opinion for that program; the related material weakness is reported, but not as an opinion on internal control.
Government Auditing Standards require reporting significant deficiencies in internal control over financial reporting without expressing an internal control opinion, while the single audit requires an opinion on major program compliance.
Topic: Ethics, Professional Responsibilities and General Principles
A nonissuer client asks a CPA firm to assist with a lender’s request related to a debt covenant calculation. The lender has specified the exact procedures it wants performed, including agreeing selected inputs to the general ledger and recalculating the ratio. The lender and client want a report that lists the procedures performed and the CPA’s findings, without an opinion or conclusion. Which engagement type best fits this request?
Best answer: A
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The request is for specified procedures and factual findings, not an overall assurance conclusion. That matches an agreed-upon procedures engagement, which provides no opinion or conclusion on the subject matter.
In an agreed-upon procedures engagement, the practitioner performs specific procedures and reports the resulting findings. The report does not provide reasonable assurance, limited assurance, an opinion, or a conclusion. Here, the lender identified the exact procedures and wants only a list of procedures and findings about the covenant calculation. That decisive fact rules out assurance engagements that express an opinion or conclusion, and it also rules out a compilation, which is generally associated with presenting financial information without undertaking specified attestation procedures.
An agreed-upon procedures engagement reports procedures and findings without providing an opinion or conclusion.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is testing a nonissuer’s investment securities measured at fair value at year-end. The financial statements use the fair value hierarchy disclosures required by GAAP.
| Investment | Carrying amount | Management’s valuation support | Other facts |
|---|---|---|---|
| Exchange-traded equity fund | $1,800,000 | Closing price from a national exchange | Shares traded daily; disclosed as Level 1 |
| Private company preferred shares | $2,400,000 | Management discounted cash flow model | No active market; discount rate and revenue growth assumptions supplied by the CFO; disclosed as Level 2 |
| Corporate bond | $1,200,000 | Price from an independent pricing service | Pricing service uses observable yields for similar bonds; disclosed as Level 2 |
Which audit response is best supported by this exhibit?
Best answer: B
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The exhibit indicates the private company preferred shares have no active market and are valued using a management DCF model with internally supplied assumptions. Those facts point to significant unobservable inputs, so the auditor should test the assumptions and consider whether Level 3 disclosure is appropriate.
For investments measured at fair value, the auditor considers both measurement evidence and required disclosures. Quoted prices in active markets generally provide strong evidence and support Level 1 classification. Prices based on observable market data for similar instruments generally support Level 2 classification. A DCF model for a private security with no active market depends heavily on assumptions such as discount rates and projected revenue growth. When those inputs are significant and unobservable, the auditor should perform procedures to evaluate management’s model, data, and assumptions, and should assess whether the financial statement fair value hierarchy disclosure properly reflects Level 3 inputs.
The private shares rely on significant management-developed unobservable inputs, requiring substantive evaluation of assumptions and likely Level 3 disclosure consideration.
Topic: Forming Conclusions and Reporting
A CPA firm was engaged by a borrower and its lender to perform procedures selected by the lender on the borrower’s debt covenant certificate. The report lists the procedures performed, including comparing amounts on the certificate to the general ledger and recalculating the current ratio, and lists the related findings. The report also states that the CPA does not express an opinion or conclusion and that users are responsible for determining whether the procedures are sufficient for their purposes. Which interpretation of the report is best?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: The described report is characteristic of an agreed-upon procedures engagement. The practitioner reports the specific procedures and findings but does not express an opinion or conclusion, and users evaluate the results for their own purposes.
In an agreed-upon procedures engagement, the practitioner performs procedures that specified users or the engaging party have determined are appropriate for the intended purpose. The report describes the procedures performed and the findings obtained. Unlike an examination, review, or audit, the practitioner does not provide reasonable assurance, limited assurance, or an audit opinion. Unlike a compilation, the practitioner is not merely assisting in presenting information; the practitioner performs procedures and reports factual findings. Here, the report’s language that no opinion or conclusion is expressed and that users decide whether the procedures are sufficient points directly to agreed-upon procedures reporting.
Agreed-upon procedures reporting presents procedures and findings without an opinion, conclusion, or assurance.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is evaluating a management-prepared allowance for credit losses analysis generated with the company’s analytics platform, which uses an embedded artificial intelligence tool to classify receivables by expected collectibility. The auditor noted the following:
| Observation | Fact |
|---|---|
| Source data | The controller imported accounts receivable aging and dispute-log files; the platform did not retain a system-generated import log or audit trail of filters applied. |
| AI instructions | The saved prompt instructed the tool to “avoid over-reserving for normal seasonal delays.” |
| Manual changes | The controller manually changed several customer classifications, and the final output does not identify overrides. |
| Exception noted | The tool excluded all invoices over 180 days from a new product line as “data anomalies”; the excluded balance is material to the allowance. |
| Reconciliation | The final schedule agrees to the accounts receivable trial balance after a year-end adjusting entry posted by the controller. |
Which interpretation is best?
Best answer: B
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: Agreement to the trial balance does not establish that an AI-assisted analysis is reliable. The auditor must consider whether the underlying data, processing, prompts, filters, and management overrides are authentic, complete, accurate, and free from undue management bias.
Audit evidence from analyses, schedules, or reconciliations prepared with technology or artificial intelligence is not reliable merely because it is automated or reconciles to a ledger total. The auditor should evaluate the authenticity and reliability of the information used, including data provenance, completeness and accuracy of inputs, controls over processing, and whether management could bias assumptions, prompts, classifications, or exclusions. Here, the lack of import logs, missing override trail, biased prompt language, and material exclusion of older invoices create reliability concerns. The trial balance reconciliation addresses only one aspect of consistency with the accounting records and does not validate the model output or the completeness of items considered.
Unauthenticated data lineage, unflagged overrides, biased prompting, and material exclusions impair the reliability of the AI-assisted analysis as audit evidence.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is testing a nonissuer’s control that requires the warehouse supervisor to observe inventory cycle counts and immediately resolve count discrepancies. The auditor wants evidence about whether the supervisor performs this control as designed while the process is occurring. Which procedure best provides observation evidence about the control?
Best answer: B
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: Observation consists of watching a process or control being performed. It provides direct evidence that the control operated as observed, but only for the time the auditor was present.
Observation is an audit procedure in which the auditor watches others perform a process or control. It is especially relevant when the evidence sought is about how a control is carried out, such as whether a supervisor actually oversees a cycle count and resolves discrepancies during the count. However, observation provides evidence only about performance at the observed point in time; personnel may perform differently when being watched, and additional evidence may be needed for other periods.
Watching the supervisor perform the control as it occurs provides observation evidence limited to that point in time.
Topic: Performing Further Procedures and Obtaining Evidence
An audit team is auditing a nonissuer’s goodwill impairment estimate. Management measured the reporting unit’s fair value using a discounted cash flow model. The engagement team’s valuation specialist has issued a draft memo concluding that fair value exceeds carrying amount by a small margin. The audit team has already evaluated the specialist’s competence and objectivity and checked the mathematical accuracy of the model, but it has not tested the management forecasts used in the model or evaluated the significant assumptions. What should the audit team do next?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The audit team cannot rely on a specialist’s conclusion solely because the specialist is competent and the model is mathematically accurate. For a complex estimate, the auditor must evaluate the methods, significant assumptions, and underlying data before concluding whether the estimate is reasonable.
When an auditor uses the work of an engagement-team specialist for a complex accounting estimate, the auditor remains responsible for obtaining sufficient appropriate audit evidence. Evaluating competence and objectivity is only part of the process. The auditor also should evaluate whether the specialist’s work is adequate for audit purposes, including whether the model is appropriate, the significant assumptions are reasonable, and the source data are relevant and reliable. Because the estimate has a narrow cushion and the audit team has not tested management’s forecasts or assumptions, the next step is to perform those procedures before accepting the conclusion or determining any reporting effect.
Before relying on the specialist’s conclusion, the auditor must evaluate whether the underlying data, methods, and significant assumptions provide sufficient appropriate audit evidence.
Topic: Ethics, Professional Responsibilities and General Principles
During client acceptance, a CPA firm is classifying employee benefit plan-related engagements for independence review. Which engagement should be characterized as subject to Department of Labor independence requirements for the audit?
Best answer: D
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: DOL independence requirements affect audits of employee benefit plans subject to ERISA when the audit report is filed with the plan’s Form 5500. The correct engagement is the large ERISA 401(k) plan audit, not merely any pension-related audit or disclosure.
For an employee benefit plan audit, the Department of Labor independence rules are relevant when the plan is subject to ERISA and the independent qualified public accountant’s audit report is included in the plan’s annual Form 5500 filing. These requirements are in addition to applicable AICPA independence requirements. Governmental plans and many church plans are generally outside ERISA unless special facts bring them within ERISA. Also, auditing the plan sponsor’s financial statements is not the same as performing a separate ERISA plan audit for Form 5500 purposes.
DOL independence requirements apply to ERISA plan audits when the auditor’s report is included with the plan’s Form 5500 filing.
Topic: Assessing Risk and Developing a Planned Response
During planning for the audit of a nonissuer, the engagement team runs a revenue data analytic over all invoices recorded from December 26 through January 5. The client recognizes revenue when goods are shipped, and all sales terms are FOB shipping point.
| Analytic exception | Current year result | Prior-year comparable result |
|---|---|---|
| December invoices with shipment dates after December 31 | 48 invoices totaling $2.4 million | 5 invoices totaling $180,000 |
| December invoices with manual shipment-date override | 41 of the 48 exceptions | 2 of the 5 exceptions |
| January credit memos linked to the 48 December exceptions | $620,000 | $35,000 |
Which planned audit procedure best responds to the risk indicator shown by this analytic?
Best answer: D
What this tests: Assessing Risk and Developing a Planned Response
Explanation: The analytic points to a specific revenue cutoff risk: December invoices may have been recorded before shipment occurred. A planned response should directly test the identified exception population using reliable shipment evidence and evaluate period recognition.
Data analytic exceptions should be translated into audit responses that address the specific risk indicated. Here, revenue is recognized when goods are shipped, but the report identifies a large increase in December invoices with shipment dates after year-end, many with manual shipment-date overrides and related January credit memos. Those facts indicate a risk of premature revenue recognition and overstatement of revenue and receivables at year-end. The most responsive procedure is targeted substantive cutoff testing of the exceptions, using carrier records or similar evidence to verify actual shipment dates and determine whether the revenue belongs in the current period.
The analytic indicates elevated cutoff risk from December revenue recorded before shipment, especially where shipment dates were manually overridden.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA firm audits Lake Co., a privately held nonissuer. Lake asks the firm to prepare the year-end financial statements and recurring depreciation entries from client-provided records. Lake’s controller has sufficient skill, knowledge, and experience and will select the accounting policies, approve all entries and financial statements, evaluate the results, and accept responsibility. The firm will not authorize transactions or have custody of assets. Which conclusion is most appropriate under the AICPA independence framework?
Best answer: A
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: Because Lake is a nonissuer, certain nonattest bookkeeping and financial statement preparation services are not automatically prohibited. The decisive safeguard is that qualified client management, not the auditor, makes decisions, oversees the work, evaluates results, and accepts responsibility.
Under AICPA independence rules for nonissuer attest clients, services such as preparing financial statements or recurring depreciation entries create self-review and management participation threats. Those threats may be reduced to an acceptable level if the client designates a person with suitable skill, knowledge, and experience to oversee the service, make significant judgments, evaluate the adequacy of the results, and accept responsibility. The auditor also must avoid management functions, such as authorizing transactions or taking custody of assets. In this scenario, Lake’s controller performs the required oversight and responsibility functions, so independence may be maintained.
For a nonissuer, these nonattest services may be permitted when client management with suitable skill oversees the work and assumes the management responsibilities.
Topic: Ethics, Professional Responsibilities and General Principles
During an audit of a nonissuer, the auditor tests a material sale recorded on December 31. The invoice is dated December 31, and management states that title transferred before year-end. However, the independent carrier’s bill of lading shows pickup on January 3 under FOB shipping point terms. Management explains that the carrier “often uses later administrative dates” and offers to include that explanation in the management representation letter. Which characterization best describes the auditor’s appropriate skeptical response?
Best answer: C
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The bill of lading conflicts with management’s explanation about when title transferred. Professional skepticism requires the auditor to investigate inconsistent evidence and obtain corroboration rather than accept an unsupported management representation.
When audit evidence is inconsistent, the auditor should not resolve the matter by choosing the explanation that is most convenient or persuasive. Here, the recorded sale depends on cutoff: under FOB shipping point terms, shipment timing is central to when title transfers. An independent carrier document dated after year-end is more objective evidence than management’s unsupported explanation. The appropriate skeptical response is to perform additional procedures, seek corroborating evidence, and evaluate whether revenue was misstated or whether risk assessments need revision. A management representation letter may support other evidence, but it ordinarily is not sufficient by itself to resolve contradictory external evidence.
The independent shipping evidence conflicts with management’s explanation, so professional skepticism requires investigating and corroborating the cutoff conclusion.
Topic: Performing Further Procedures and Obtaining Evidence
While testing a nonissuer manufacturer’s revenue cutoff, an auditor identifies sales invoices dated December 31 that were recorded in current-year revenue. The related customer orders specify FOB shipping point. The controller states that the goods were placed on the shipping dock on December 31, but the shipping log shows carrier pickup dates of January 2 for 12 of 25 sampled December 31 invoices. The auditor’s objective is to determine whether those sales were recorded in the proper period. Which procedure best addresses the auditor’s objective?
Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The key issue is cutoff, not invoice accuracy or later collection. Because management’s explanation conflicts with the shipping log, inquiry alone is insufficient; the auditor should inspect source evidence showing when shipment actually occurred under the FOB shipping point terms.
When an audit exception creates doubt about management’s explanation, the auditor should obtain corroborating evidence from a more reliable source. For revenue recorded at year-end under FOB shipping point terms, the critical evidence is whether the goods were shipped before year-end. Inspecting bills of lading, carrier pickup confirmations, or similar shipping documents directly addresses the cutoff objective by linking the recorded sale to shipment timing and contractual shipping terms. A management explanation may help the auditor understand the exception, but it does not provide enough appropriate evidence when documentary records suggest a different date.
Source shipping documents directly corroborate when shipment occurred and whether year-end revenue cutoff was appropriate under FOB shipping point terms.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA is completing an audit of a nonissuer’s financial statements. The audit documentation includes this control finding:
The payroll supervisor can add employees to the payroll master file and approve weekly payroll changes. No independent review of master-file changes is performed. The auditor concluded that the deficiency is less severe than a material weakness but important enough to merit attention by those charged with governance.
The audit manager’s draft disposition states: “Treat as a control deficiency. Discuss orally with the controller at the closing meeting; no written communication to the board is required.” Which correction should the engagement partner make?
Best answer: A
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The finding meets the definition of a significant deficiency because it is important enough to merit attention by those charged with governance but is not a material weakness. For a nonissuer audit, significant deficiencies are communicated in writing to governance and appropriate management on a timely basis, no later than 60 days after report release.
A control deficiency exists when a control is missing or not properly designed or operating. A significant deficiency is less severe than a material weakness but important enough to merit attention by those charged with governance. A material weakness involves a reasonable possibility that a material misstatement will not be prevented, or detected and corrected, on a timely basis. Here, the auditor already concluded the issue is less severe than a material weakness but important to governance, so the draft disposition understates both the classification and required communication. In a nonissuer financial statement audit, significant deficiencies and material weaknesses identified during the audit should be communicated in writing to those charged with governance and appropriate management on a timely basis, with a deadline no later than 60 days after the report release date.
A deficiency important enough for governance attention but less severe than a material weakness is a significant deficiency requiring timely written communication.
Topic: Performing Further Procedures and Obtaining Evidence
During the audit of a nonissuer’s December 31 financial statements, the auditor identifies recurring operating losses, negative operating cash flows, and a large note payable that matures six months after the expected auditor’s report date. Management has not prepared a formal going-concern evaluation but orally states that it expects to refinance the note and reduce payroll costs. Given the current facts, what should the auditor do next?
Best answer: C
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The auditor has identified conditions that may raise substantial doubt, but the reporting conclusion cannot be made until management’s evaluation and plans are assessed. The next step is to obtain and evaluate evidence about whether those plans are feasible and likely to alleviate the conditions.
Going-concern indicators such as recurring losses, negative cash flows, and near-term debt maturities require the auditor to perform additional procedures. If management has not prepared a formal evaluation, the auditor should request one and evaluate management’s plans, such as refinancing or cost reductions. Oral assertions alone are not sufficient audit evidence. The auditor should inspect support such as lender correspondence, draft or executed financing agreements, cash-flow forecasts, board approvals, and cost-reduction analyses. Only after evaluating the evidence can the auditor conclude whether substantial doubt exists and whether any disclosures or report modifications are necessary.
When going-concern indicators exist, the auditor should evaluate management’s assessment and plans using appropriate supporting audit evidence before determining the reporting effect.
Topic: Performing Further Procedures and Obtaining Evidence
An auditor is performing a substantive analytical procedure over interest expense for the year ended December 31, 20X5. The auditor established a tolerable difference of $12,000 for this procedure.
Workpaper note:
| Debt instrument | Source of terms | Principal | Interest rate | Period outstanding in 20X5 |
|---|---|---|---|---|
| Term loan | Direct lender confirmation | $1,200,000 | 6% fixed | Full year |
| Equipment note | Direct lender confirmation | $900,000 | 8% fixed | April 1–December 31 |
No other debt was outstanding during 20X5. The client recorded interest expense of $126,000.
Best answer: C
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: A precise expectation can be developed by applying confirmed fixed interest rates to confirmed principal amounts for the periods the debt was outstanding. The expected interest is $72,000 on the term loan plus $54,000 on the equipment note, totaling $126,000, which equals the recorded amount.
For a substantive analytical procedure, the expectation should be based on relevant, reliable data and a relationship precise enough to identify a material misstatement. Direct lender confirmations provide reliable evidence of principal, interest rates, and timing. Because the debt has fixed rates and known outstanding periods, interest expense can be estimated precisely: $1,200,000 × 6% for 12 months = $72,000, and $900,000 × 8% for 9 months = $54,000. The total expected amount is $126,000. Since the client recorded $126,000 and the difference is zero, the result is within the $12,000 tolerable difference.
Confirmed principal, rates, and time outstanding provide reliable data and a precise relationship that produces expected interest expense of $126,000.
Topic: Ethics, Professional Responsibilities and General Principles
A CPA firm audits Baxter Co., a privately held nonissuer. Baxter asks the firm to prepare monthly bank reconciliations and propose correcting journal entries using Baxter’s bank statements and check register. Baxter’s controller has sufficient skill, knowledge, and experience to oversee the work, reviews and approves each proposed entry before any posting, and accepts responsibility for the accounting records. The firm assigns personnel who are not on the audit engagement team to perform the reconciliation work. How should the independence effect be characterized under the AICPA independence rules?
Best answer: D
What this tests: Ethics, Professional Responsibilities and General Principles
Explanation: The service creates a self-review threat, but the facts include safeguards that address it. Because Baxter’s qualified controller oversees, approves, and accepts responsibility for the work, and the firm does not take on management responsibilities, independence is not impaired under AICPA rules for a nonissuer engagement.
Under the AICPA independence framework, a CPA firm may provide certain nonattest services, such as bookkeeping assistance, to a nonissuer attest client if the firm does not assume management responsibilities and the client meets its responsibilities. The client must designate a qualified individual to oversee the service, evaluate the results, accept responsibility, and make management decisions. Here, Baxter’s controller has appropriate competence, reviews and approves proposed entries, and accepts responsibility for the records. Using personnel outside the audit team also helps address the self-review threat. Therefore, the safeguards reduce the independence threat to an acceptable level.
For a nonissuer attest client, certain bookkeeping assistance may be permissible when the client accepts responsibility and qualified client personnel oversee the service.
Topic: Performing Further Procedures and Obtaining Evidence
During Uniform Guidance compliance testing of a major federal award, an auditor selected a $42,000 professional-services invoice charged to the award. The award period began July 1, 20X5, and the award terms state that costs must be for services performed during the period of performance unless pre-award costs are specifically approved in writing. The invoice was paid on July 20, 20X5, but the detailed billing shows all services were performed in June 20X5. No written approval for pre-award costs exists. What is the best correction?
Best answer: D
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: The key compliance condition is when the services were performed, not when the invoice was paid. Because the services occurred before the award period and there was no written approval for pre-award costs, the amount is not allowable as charged to the federal award.
When testing federal award transactions, the auditor should compare the transaction to the applicable compliance requirements, including award terms and conditions. Here, the award permits costs only for services performed during the period of performance unless pre-award costs are specifically approved in writing. The invoice detail shows the services were performed before the award began, and no approval exists. Therefore, the auditor should identify the charge as a compliance exception and propose that management remove the amount from the costs claimed to the federal award, which may result in a questioned cost depending on reporting thresholds and evaluation of the finding.
The services were performed before the period of performance and lacked required written approval, so the cost should not be claimed to the award.
Topic: Forming Conclusions and Reporting
A nonissuer is subject to a single audit under the Uniform Guidance. For one major program, the auditor identified a material weakness in internal control over compliance related to eligibility. After performing additional substantive procedures, the auditor found no instances of noncompliance and obtained sufficient appropriate evidence to support compliance with the applicable compliance requirements. Which reporting treatment is required?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: A material weakness in internal control over compliance is reportable even when the auditor finds no actual noncompliance. The compliance opinion can remain unmodified, but the weakness must be reported in the internal control over compliance report and included in the schedule of findings and questioned costs.
In a single audit, the auditor reports both on compliance for each major program and on internal control over compliance. The compliance opinion addresses whether the auditee complied with applicable compliance requirements; it is modified for material noncompliance, not solely because a control weakness exists. A material weakness in internal control over compliance is separately reported in the internal control over compliance section and is also a federal award finding included in the schedule of findings and questioned costs. The absence of questioned costs does not eliminate the requirement to report a material weakness.
A control material weakness affects internal control reporting and the schedule of findings, but it does not by itself require modifying the compliance opinion when compliance evidence supports an unmodified opinion.
Topic: Forming Conclusions and Reporting
An auditor is completing an integrated audit of an issuer for the year ended December 31. The auditor’s workpapers include the following findings:
| Finding | Details |
|---|---|
| Revenue cutoff control | The control did not operate effectively in November and December. |
| Audit adjustment | A material revenue cutoff error was identified by substantive procedures and corrected by management before the financial statements were issued. |
| New control | Management implemented a replacement review control on December 20, but it operated only once before year-end. |
| Compensating control | A monthly gross-margin review was performed, but it was not precise enough to detect material cutoff errors. |
Which is the best interpretation of these facts when forming the auditor’s opinion on internal control over financial reporting?
Best answer: C
What this tests: Forming Conclusions and Reporting
Explanation: In an integrated audit, the ICFR opinion focuses on whether controls were effective as of the balance sheet date. A material weakness requires an adverse ICFR opinion even if the related financial statement misstatement was corrected before issuance.
When forming an opinion on ICFR, the auditor evaluates whether identified control deficiencies, individually or in combination, represent a material weakness as of the specified date. The presence of a material misstatement that was not prevented or detected by the company’s controls is a strong indicator of a material weakness. Management’s late replacement control does not demonstrate effective remediation unless the auditor obtains sufficient evidence that the new control was designed and operating effectively as of year-end. Substantive audit procedures may support the financial statement opinion, but they do not cure ineffective ICFR. Because the compensating review was not precise enough to detect material cutoff errors, it does not reduce the severity of the deficiency enough to avoid an adverse ICFR opinion.
A material corrected misstatement and ineffective cutoff control, without effective remediation or precise compensating controls as of year-end, support a material weakness and an adverse ICFR opinion.
Topic: Performing Further Procedures and Obtaining Evidence
In an audit of a nonissuer’s December 31 financial statements, the auditor selected a material accounts receivable balance for positive confirmation. The auditor sent the initial and second requests directly to Customer Z at an independently verified address, but no response was received. The receivable relates to goods shipped on December 28, FOB shipping point, with payment terms of net 120 days, and no cash has been collected as of the fieldwork date. Which procedure is the best alternative procedure for the confirmation nonresponse?
Best answer: A
What this tests: Performing Further Procedures and Obtaining Evidence
Explanation: A nonresponse to a positive confirmation does not provide audit evidence about the receivable. When subsequent cash receipts are not available, the auditor should inspect other evidence supporting the transaction, such as the customer order, shipping evidence, and billing documents.
For a positive confirmation request, the auditor needs a response or alternative procedures; silence from the customer is not evidence of agreement. For accounts receivable, a common alternative procedure is to examine subsequent cash receipts and trace them to the specific receivable. Here, no cash has been collected because the receivable is not yet due. The next best alternative is to inspect documents that support the existence of the receivable at year-end, especially evidence that the customer ordered the goods, the goods were shipped before year-end under the stated shipping terms, and the client billed the customer. Those procedures provide more relevant evidence than internal schedules or management representations alone.
Because no subsequent cash receipt is available, inspecting source documents that evidence the customer order, shipment, and billing is the best alternative evidence for the receivable’s existence.
Use the CPA AUD Practice Test page for the full practice route, mixed-topic practice, timed mock exams, and explanations.
Read the CPA AUD guide on CPAExamsMastery.com for concept review, then return here for Mastery Exam Prep practice.