CPA — Auditing & Attestation (AUD) [Core] practice questions and exam guide

The AICPA CPA Exam Blueprint for AUD assigns the LARGEST weight to which content area?

1. Ethics, professional responsibilities, and general principles
2. Assessing risk and developing a planned response
3. Forming conclusions and reporting
4. Performing further procedures and obtaining evidence

Answer: D — Performing further procedures and obtaining evidence

A) Ethics is weighted 15-25%. B) Risk assessment is weighted 25-35%. D) Correct — performing further procedures and obtaining evidence carries the highest weight, 30-40%, of the AUD Blueprint. C) Forming conclusions and reporting is weighted 10-20%.

The requirement to be independent applies:

1. Only in appearance and never in fact
2. Only in fact and never in appearance
3. In fact and appearance for attest work
4. Only when specifically required by the client

Answer: C — In fact and appearance for attest work

A) Independence in fact is also required. B) Appearance is equally required for third-party trust. C) Correct — the AICPA Code requires independence BOTH in fact and in appearance for audit and other attest engagements. D) The client cannot waive independence requirements.

A firm provides a valuation service to a nonissuer attest client to value the client's employee stock ownership plan (ESOP) shares for the client's use in a regulatory filing. Under the AICPA independence rules, this service:

1. Always impairs independence regardless of materiality or subjectivity, because any client valuation service is management responsibility by definition
2. Impairs independence if the valuation involves a significant degree of subjectivity and the results are material to the financial statements, because the auditor would effectively be auditing its own subjective valuation judgment
3. Never impairs independence as long as the firm bills separately from the audit fee
4. Is permitted without restriction because ESOP valuations are specifically exempted from the valuation-services independence rule

Answer: B — Impairs independence if the valuation involves a significant degree of subjectivity and the results are material to the financial statements, because the auditor would effectively be auditing its own subjective valuation judgment

A) An absolute rule ignoring materiality and subjectivity overstates the restriction — the AICPA rule is calibrated to materiality and subjectivity, not an unconditional bar on all valuation work. C) Separate billing does not cure the underlying self-review concern; the issue is the nature and materiality of the service, not invoicing structure. D) There is no blanket ESOP exemption from the valuation-services independence provisions. B) Correct — the independence concern scales with the subjectivity of the valuation and its materiality to the financial statements; highly subjective, material valuations threaten a self-review impairment.

Under the AICPA Conceptual Framework, accepting a small holiday gift from a client is best characterized as:

1. Always prohibited under the integrity rule
2. A self-interest threat requiring evaluation
3. Automatically acceptable if under $100
4. Permitted only if disclosed to the audit committee

Answer: B — A self-interest threat requiring evaluation

A) The Code does not flatly prohibit all gifts; it applies a threats-and-safeguards framework. B) Correct — gifts and entertainment create a self-interest or familiarity threat; the auditor evaluates significance and applies safeguards, accepting only if clearly insignificant. C) There is no dollar bright line; significance depends on context. D) Audit-committee disclosure is not the operative rule for gifts to individual staff.

The engagement letter should describe the respective responsibilities of the auditor and of management. Which of the following is properly described as a responsibility of the AUDITOR, not management, under AU-C 210?

1. Establishing and maintaining internal control relevant to the preparation of the financial statements
2. Providing the auditor with access to all information relevant to the preparation of the financial statements
3. Conducting the audit in accordance with generally accepted auditing standards and forming an opinion on the financial statements
4. Correcting material misstatements identified by the auditor before the report is issued

Answer: C — Conducting the audit in accordance with generally accepted auditing standards and forming an opinion on the financial statements

A) Establishing and maintaining relevant internal control is explicitly management's responsibility. B) Providing access to information is likewise a management responsibility under the engagement preconditions. D) While management typically corrects identified misstatements, the decision and responsibility to record or not record the correction rests with management, not the auditor. C) Correct — conducting the audit under GAAS and forming the opinion are the auditor's defined responsibilities.

Which of the following would LEAST likely cause a firm to decline continuance of an existing audit client?

1. Persistent, unresolved disagreements with management over the application of accounting principles
2. Evidence that management lacks integrity and has misled the auditor in a prior engagement
3. The client requests that fieldwork begin two weeks earlier than in the prior year
4. Significant, unresolved threats to independence that cannot be reduced to an acceptable level

Answer: C — The client requests that fieldwork begin two weeks earlier than in the prior year

A), B), and D) each represent substantive integrity, independence, or relationship concerns that would appropriately trigger reconsideration of continuance. C) Correct as the exception — a scheduling request to start fieldwork earlier is an operational/logistics matter with no bearing on integrity, independence, or the firm's ability to serve the client appropriately.

A risk factor by itself, without other corroborating conditions, is BEST understood as:

1. sufficient on its own to conclude that fraud has occurred
2. a condition that automatically requires an adverse opinion on the financial statements
3. irrelevant to the auditor's risk assessment unless management admits wrongdoing
4. something that indicates a heightened possibility fraud may exist, but not by itself proof that fraud exists

Answer: D — something that indicates a heightened possibility fraud may exist, but not by itself proof that fraud exists

A) No single risk factor is conclusive proof of fraud on its own. C) Risk factors remain relevant to risk assessment even absent any admission by management. B) A single risk factor does not automatically drive an adverse opinion; opinion modifications depend on the actual audit findings. D) Correct — fraud risk factors are conditions that indicate an incentive/pressure, opportunity, or attitude that may increase the possibility of fraud, but their presence alone does not establish that fraud has actually occurred.

In a first-year audit, the successor auditor's incremental procedures typically include:

1. Reissuing the predecessor's prior-year opinion
2. Reading prior-period financials and predecessor workpapers
3. Auditing every prior-period balance from inception
4. Substituting the current opinion for prior years

Answer: B — Reading prior-period financials and predecessor workpapers

A) The successor does not reissue the predecessor's opinion. B) Correct — AU-C 510 requires the successor to obtain sufficient appropriate evidence about opening balances, often by reading prior statements and reviewing predecessor workpapers with client consent. C) Full re-audit from inception is not required. D) The current opinion does not replace prior-period opinions.

A control deficiency exists when a control is designed, implemented, or operated in a manner that:

1. does not allow management or employees to prevent or detect misstatements on a timely basis
2. results in an immediate SEC enforcement referral
3. is documented but never actually implemented
4. is identified by the external auditor rather than management

Answer: A — does not allow management or employees to prevent or detect misstatements on a timely basis

A) Correct — AU-C 265 / AS 2201 define a control deficiency as one where the design or operation does not allow timely prevention or detection of misstatements. B) SEC referral is not part of the definition. C) An undocumented or unimplemented control describes one possible cause of a deficiency, not the general definition. D) Who identifies the deficiency (auditor vs. management) doesn't determine whether it exists.

Under COSO 2013, the Monitoring Activities component is supported by principles addressing:

1. segregation of duties and physical controls over assets
2. identification of risks arising from significant business change
3. ongoing and/or separate evaluations, and the evaluation and communication of deficiencies
4. selection and development of general controls over technology

Answer: C — ongoing and/or separate evaluations, and the evaluation and communication of deficiencies

A) Segregation of duties and physical safeguards fall under Control Activities, not Monitoring. B) Identifying risk from significant change is a Risk Assessment principle. D) Selecting/developing technology general controls also falls under Control Activities. C) Correct — Monitoring Activities is supported by Principle 16 (ongoing and/or separate evaluations) and Principle 17 (evaluating and communicating deficiencies on a timely basis).

An auditor identifies that a client's IT general controls over program change management are ineffective — unauthorized changes to the revenue application were made without testing or approval during the year. The MOST likely effect on the auditor's strategy is to:

1. Reduce planned reliance on automated application controls within the affected application and increase substantive testing
2. Disregard the deficiency, since application controls are tested independently of general controls
3. Conclude that the deficiency affects only IT department efficiency, not the financial statement audit
4. Issue an adverse opinion on the financial statements without further procedures

Answer: A — Reduce planned reliance on automated application controls within the affected application and increase substantive testing

A) Correct — because ineffective change management undermines confidence that application controls operated consistently throughout the period, the auditor typically reduces reliance on those controls and shifts to substantive procedures, evaluating whether the deficiency is a control deficiency, significant deficiency, or material weakness. B) Application controls' reliability depends on the underlying IT general control environment; they cannot be evaluated in isolation. C) Unauthorized, untested changes to a financial application are a financial-statement-relevant control matter, not merely an IT efficiency issue. D) An opinion decision requires evaluating the actual effect on the financial statements, not an automatic adverse conclusion from one deficiency.

SOX §404(b) requires the external auditor to attest to:

1. Management's forecasts of future earnings
2. The completeness of the client's tax provision
3. Management's assessment of ICFR effectiveness
4. The reasonableness of the client's dividend policy

Answer: C — Management's assessment of ICFR effectiveness

A) Forecasts are not §404 subject matter. B) Tax provisions fall within the financial-statement audit generally. C) Correct — §404(b) requires the auditor's opinion on the effectiveness of ICFR for accelerated filers (integrated audit under AS 2201). D) Dividend policy is a governance matter, not §404.

When observing a physical inventory count, the auditor primarily performs:

1. Preparation of the client's inventory tags
2. Test counts and observation of count procedures
3. Recomputation of the standard cost variances
4. Confirmation of on-hand quantities with vendors

Answer: B — Test counts and observation of count procedures

A) Preparing tags is a client function. B) Correct — AU-C 501 / AS 2510 require observation of the count process, performance of test counts, and evaluation of the client's procedures. C) Cost-variance recomputation is a separate substantive test. D) On-hand confirmation with vendors is not a standard procedure.

Which inventory audit procedure primarily addresses the VALUATION assertion?

1. Observation of the physical inventory count
2. Confirmation of consigned goods with holders
3. Testing lower of cost or net realizable value
4. Vouching year-end additions to receiving reports

Answer: C — Testing lower of cost or net realizable value

A) Observation addresses existence and condition. B) Confirmation addresses existence at third-party locations. C) Correct — testing lower of cost or NRV (and obsolescence reserves) directly addresses the valuation assertion. D) Vouching to receivers tests existence/occurrence.

Analytical procedures are required to be performed:

1. During risk assessment and near the end of the audit
2. Only when management provides expectations
3. Only during substantive testing phases
4. Only when a fraud risk has been identified

Answer: A — During risk assessment and near the end of the audit

C) They are required at risk assessment AND at the end of the audit. B) The auditor develops expectations independently. A) Correct — AU-C 315 requires analytical procedures in risk assessment; AU-C 520 requires them near the audit's conclusion as an overall review. D) They are not limited to fraud-risk situations.

Which characteristic makes PPS sampling particularly effective when testing accounts, such as accounts receivable or inventory, where the primary concern is overstatement?

1. It automatically emphasizes larger-dollar items, which have the greatest potential to individually cause a material overstatement
2. It always requires a smaller sample size than classical variables sampling, regardless of circumstances
3. It performs equally well for populations expected to contain understatements
4. It removes the need to define tolerable misstatement before sampling

Answer: A — It automatically emphasizes larger-dollar items, which have the greatest potential to individually cause a material overstatement

B) Sample size comparisons between PPS and classical variables sampling depend on the specific parameters used, not a universal rule favoring PPS. C) PPS is not equally effective for understatement testing — because selection is weighted by recorded (not true) amount, understated items are less likely to be selected. D) Tolerable misstatement must still be defined before determining the PPS sampling interval and sample size. A) Correct — the dollar-weighting inherently focuses testing on the items most capable of causing material overstatement.

Before an auditor's specialist begins work, AU-C 620 requires the auditor to agree with the specialist on all of the following EXCEPT:

1. the nature, scope, and objectives of the specialist's work
2. the respective roles and responsibilities of the auditor and the specialist
3. the specialist's personal retirement or succession plan within their own firm
4. the nature, timing, and extent of communication between the auditor and the specialist

Answer: C — the specialist's personal retirement or succession plan within their own firm

A) Agreeing on the nature, scope, and objectives is an explicit AU-C 620 requirement. B) Clarifying respective roles and responsibilities is also required. D) Agreeing on communication protocols is likewise required. C) Correct as the exception — the specialist's internal retirement or succession planning within their own firm has no bearing on the auditor's use of the specialist's work and is not an AU-C 620 requirement.

'Tickmarks' in audit workpapers are used to:

1. Number the pages of the audit report
2. Rank the importance of engagement partners
3. Indicate specific procedures performed on items
4. Sign the auditor's independence letter

Answer: C — Indicate specific procedures performed on items

C) Correct — tickmarks are standardized symbols that indicate what procedures were performed on which items, explained in a legend. B) They are not used for personnel ranking. A) Page numbering is a separate function. D) Independence letters are not signed with tickmarks.

A successor auditor is unable to obtain sufficient appropriate evidence concerning opening inventory balances because the predecessor's workpapers are unavailable and no alternative procedures can substitute. The auditor's report on the current period would MOST likely reflect a:

1. qualified opinion or disclaimer of opinion due to a scope limitation on opening balances
2. standard unmodified opinion, since opening balances are the predecessor's responsibility
3. adverse opinion on the entire set of current-period financial statements
4. emphasis-of-matter paragraph added to an otherwise unmodified opinion

Answer: A — qualified opinion or disclaimer of opinion due to a scope limitation on opening balances

B) The successor auditor remains responsible for evaluating opening balances even though the predecessor audited the prior year. C) An adverse opinion reflects pervasive misstatement, not an inability to obtain evidence. D) An emphasis-of-matter paragraph does not resolve an unresolved scope limitation on a material item. A) Correct — an inability to obtain sufficient evidence about material opening balances (e.g., inventory affecting cost of sales) is a scope limitation, generally resulting in a qualified opinion or disclaimer, depending on pervasiveness.

Audit documentation should be sufficient to enable an experienced auditor with no prior connection to:

1. Recompute every balance already tested
2. Understand nature, timing, and extent of work
3. Draft an alternative audit opinion draft
4. Prepare an entire new set of workpapers

Answer: B — Understand nature, timing, and extent of work

A) The purpose is understanding, not full recomputation from documentation. B) Correct — AU-C 230 / AS 1215 specify that documentation must allow an experienced auditor to understand nature, timing, and extent of procedures, results, and significant matters. C) The purpose is not alternative opinion drafting. D) Documentation is not required to reconstruct all work from scratch.

A financial forecast differs from a financial projection primarily in that a forecast:

1. Can never be examined by an independent accountant
2. Is always prepared using hypothetical 'what-if' assumptions
3. Reflects conditions expected to exist and the course of action expected to be taken, based on the responsible party's best estimate
4. Is restricted to use by parties negotiating directly with the entity

Answer: C — Reflects conditions expected to exist and the course of action expected to be taken, based on the responsible party's best estimate

A) Forecasts can be examined, compiled, or subjected to agreed-upon procedures under AT-C 305 — examination is available. B) Hypothetical 'what-if' assumptions describe a projection, not a forecast. C) Correct — a forecast reflects expected future conditions and the expected course of action, based on the responsible party's best-estimate assumptions, and may be for general use. D) General-use restriction is characteristic of hypothetical projections, not forecasts, which may have general distribution.

In an agreed-upon procedures (AUP) engagement performed under AT-C 215, responsibility for the sufficiency of the procedures for the intended purpose rests PRIMARILY with:

1. the practitioner performing the procedures
2. the AICPA's Auditing Standards Board
3. the engaging party and specified parties who agreed to the procedures
4. the practitioner's independent peer reviewer

Answer: C — the engaging party and specified parties who agreed to the procedures

A) The practitioner performs the procedures but does not take responsibility for whether they are sufficient for the users' purposes. B) The ASB sets the overarching standard but doesn't bear engagement-specific responsibility for procedure sufficiency. D) A peer reviewer's role relates to firm quality assessment, not this engagement-specific responsibility. C) Correct — under AT-C 215, the engaging party and other specified parties take responsibility for the sufficiency of the procedures for their purposes, since they agreed to them.

Under PCAOB AS 2201, an integrated audit of an accelerated filer requires opinions on:

1. The client's financial statements only
2. Internal control over financial reporting only
3. The client's forecasts and projections only
4. The financials AND internal control on reporting

Answer: D — The financials AND internal control on reporting

A) An integrated audit expressly covers both areas. B) ICFR alone is not the scope; the financials are also covered. C) Forecasts are not part of an integrated audit. D) Correct — AS 2201 requires the auditor to opine on BOTH the financial statements and the effectiveness of ICFR for accelerated filers.

Post-SOX audit-committee responsibilities include:

1. Appointing and compensating the external auditor
2. Setting individual salaries of engagement staff
3. Personally executing tests of controls annually
4. Serving as the concurring engagement quality reviewer

Answer: A — Appointing and compensating the external auditor

B) Staff salaries are a firm-internal matter. A) Correct — SOX §301 requires the audit committee to appoint, compensate, and oversee the external auditor and to preapprove non-audit services. C) The committee provides oversight; it does not perform tests of controls. D) The EQR is performed within the audit firm, not by the committee.

If the auditor spots a material inconsistency between XBRL-tagged data and the audited statements, what should happen?

The auditor should be alert to it (similar to the 'other information' concept) and take appropriate action, such as asking management to correct it, even though the opinion doesn't cover tagging.

Must the EQR reviewer be independent of the engagement team's chain of command?

Yes — the reviewer must not be part of the engagement team and must have sufficient objectivity to evaluate the significant judgments made.

If the omitted procedure is important and reliance continues, what should the auditor do?

Apply the omitted procedure, or an appropriate alternative, as promptly as practicable.

Which body sets auditing standards for nonissuer (private-company) audits in the U.S.?

The AICPA Auditing Standards Board (ASB), through the clarified Statements on Auditing Standards (AU-C sections).

Updating vs. reissuing a predecessor's report on comparative statements — key difference?

Updating expresses a current opinion in light of new information as of the current report date; reissuing uses the original report date and does not reflect later-discovered information.

Significant deficiency?

Less severe than material weakness. Worth reporting to those charged with governance.