Build the judgment AUD requires: distinguish engagement standards, identify assertion-level risks, choose persuasive evidence and reach defensible reporting conclusions. This guide contains 20 original practice items, including six structured task-based simulations, plus 60 worked concepts covering ethics, planning, procedures and reporting. It follows the January 2026 blueprint for study as of October 16, 2026; later versions are excluded. Read entity and engagement facts carefully because issuer, nonissuer, governmental and employee benefit plan requirements differ. The allocations are representative study allocations, not official item counts. Citations establish blueprint relevance; technical explanations apply established engagement-specific principles. These are original practice exercises, not official examination questions.
What this guide covers
Study CPA AUD with 20 original practice items, structured simulations and 60 concepts on risk, evidence and reporting.
Ethics, Professional Responsibilities and General Principles
1. Independence threats and explicit prohibitions
The AICPA conceptual framework identifies threats, evaluates their significance and applies safeguards when necessary and permitted. Threat categories include self-interest, self-review, advocacy, familiarity, adverse interest, undue influence and management participation. The framework does not override an explicit rule. A covered member's direct financial interest in an attest client impairs independence regardless of materiality, whereas certain indirect interests require a materiality evaluation. First identify the applicable rule and relationship; use the framework to resolve circumstances that are not already conclusively addressed by a prohibition.
Worked example: An audit manager owns a small number of client shares directly. An independent partner offers to review the manager's work. Because the direct interest is prohibited, the additional review does not make the ownership permissible or restore independence by itself.
Common mistake: Assuming every independence threat can be reduced through review confuses a permitted safeguard with an exception to an explicit prohibition.
Official syllabus reference: [1]
2. Issuer independence and non-audit services
Issuer auditors apply SEC and PCAOB independence requirements rather than assuming AICPA permissions transfer unchanged. Evaluate whether a service places the auditor in a management role, creates self-review, advocates for the client or otherwise conflicts with issuer independence restrictions. Audit committee preapproval is an important requirement for permitted services, but it does not legalize a prohibited service. Identify the service's actual functions, the subject being audited and the relevant period. Labels such as advisory or implementation do not determine whether the auditor would ultimately audit its own work.
Worked example: An issuer asks its audit firm to design and implement a system that generates material accounting records. Even if the audit committee is willing to preapprove the project, the firm must evaluate the applicable prohibition rather than relying on approval alone.
Common mistake: Treating audit committee preapproval as permission for any service overlooks substantive independence restrictions that approval cannot remove or override.
Official syllabus reference: [1]
3. Confidential client information in AI workflows
Confidentiality obligations follow client information into external tools, cloud platforms and AI services. Before disclosure, determine whether client consent or an applicable professional exception authorizes the use, and evaluate provider access, retention, training use and contractual protections. Data minimization reduces exposure but does not establish permission. Removing names may leave identifying contract terms or transaction details. Authorization and evidential reliability are separate questions: an approved service can still produce inaccurate summaries. Preserve confidentiality while independently checking outputs against underlying documents and the intended audit purpose.
Worked example: An auditor wants an AI tool to extract lease renewal options. The team first evaluates the provider and disclosure authorization, limits the submitted information appropriately, and then compares extracted clauses with the executed leases before using them in testing.
Common mistake: Assuming that a useful audit purpose automatically authorizes external disclosure overlooks the separate confidentiality obligations governing client information and providers.
Official syllabus reference: [1]
4. Government auditing independence and management responsibility
Government Auditing Standards require evaluating independence threats arising from nonaudit services as well as the audit relationship. Preparing accounting information can create self-review threats; assuming management responsibility impairs independence. Management must retain responsibility, oversee the service through a suitably knowledgeable individual, evaluate results and accept responsibility for decisions. The auditor assesses whether safeguards can reduce permitted threats to an acceptable level and documents the analysis. Merely having management sign a form does not establish meaningful oversight or permit the auditor to make management's decisions.
Worked example: A grant recipient asks its auditor to assist with financial statement preparation. Management assigns a knowledgeable controller to oversee the work and approve adjustments. The auditor separately evaluates self-review threats and safeguards rather than treating the controller's signature as conclusive.
Common mistake: Equating management's formal approval with substantive oversight ignores whether management can understand, evaluate and accept responsibility for the service.
Official syllabus reference: [1]
5. Conflicts of interest, disclosure and informed consent
Serving clients with competing interests can threaten a CPA's objectivity even when neither service requires independence. Identify the parties, interests and services involved, then evaluate whether safeguards can reduce the threat to an acceptable level. Depending on the circumstances, safeguards may include separate teams, restricted information access and independent review. Appropriate disclosure and informed consent may also be necessary. Confidentiality remains relevant: obtaining consent does not authorize sharing another client's protected information. If necessary disclosure cannot be made or the threat cannot be adequately addressed, decline or discontinue the affected service.
Worked example: A CPA firm advises two businesses bidding for the same property. With permission to disclose the conflict, it obtains both clients' informed consent, assigns separate teams, restricts file access and arranges independent review. After evaluating these safeguards, the firm concludes it can continue both assignments objectively.
Common mistake: Assuming that client consent alone resolves every conflict; the CPA must also evaluate objectivity threats and whether safeguards adequately address them.
Official syllabus reference: [1]
6. Professional skepticism and confirmation bias
Professional skepticism combines a questioning mind, alertness to possible misstatement and critical evaluation of evidence. Confirmation bias encourages selecting information that supports an initial explanation while discounting conflicting evidence. Anchoring can make a prior-year estimate seem reasonable despite changed conditions. Counter these mechanisms by seeking disconfirming evidence, developing alternative explanations and resolving inconsistencies. Skepticism does not require assuming dishonesty, but management's history of integrity does not replace evidence. Professional judgment then applies relevant knowledge and experience to choose and justify an appropriate response.
Worked example: Management attributes a margin increase to purchasing efficiencies. The auditor also examines supplier prices, product mix and year-end revenue entries. Discovering unchanged costs and unusual late sales prompts targeted cutoff testing rather than acceptance of the first plausible explanation.
Common mistake: Treating skepticism as distrust of every explanation misses its central requirement to evaluate both corroborating and contradictory evidence critically.
Official syllabus reference: [1]
7. Engagement objectives and assurance levels
A financial statement audit provides reasonable assurance and an opinion; a review provides limited assurance through a narrower evidence-gathering approach. A compilation assists presentation without providing assurance, and a preparation engagement generally produces statements without an accountant's report. Attestation examinations provide reasonable assurance about subject matter against criteria, while attestation reviews provide limited assurance. Agreed-upon procedures report procedures and factual findings without an opinion or assurance conclusion. Choose the governing standard from the engagement's subject and objective rather than treating every accountant-issued document as equivalent.
Worked example: A lender wants specified invoice amounts compared with supporting documents and wants the resulting differences listed. An agreed-upon procedures engagement fits that objective. It does not support presenting a general opinion that the borrower's financial statements are fairly stated.
Common mistake: Ranking engagements only by how many procedures they contain overlooks their different objectives, reporting conventions, criteria and levels of assurance.
Official syllabus reference: [1]
8. Audit preconditions and written engagement terms
Audit acceptance requires an acceptable financial reporting framework and management's acknowledgment of responsibility for financial statements, relevant internal control and necessary access to information and people. Written engagement terms establish a common understanding of objectives, scope, responsibilities and expected reporting. They do not transfer management's responsibilities to the auditor. A proposed management-imposed limitation expected to cause a disclaimer ordinarily prevents acceptance unless law or regulation requires it. Distinguish these preconditions from the firm's separate assessments of competence, resources, independence and client integrity.
Worked example: A prospective client agrees to provide ledgers but refuses access to personnel who negotiated material contracts. If the restriction is expected to cause a disclaimer, the auditor cannot treat an otherwise complete engagement letter as satisfying the acceptance preconditions.
Common mistake: Assuming a signed engagement letter resolves every acceptance problem overlooks whether its terms provide the access necessary to perform the audit.
Official syllabus reference: [1]
9. Predecessor communication and engagement downgrades
Before accepting an initial audit, the successor seeks management's authorization to communicate with the predecessor about relevant acceptance matters, including integrity concerns and disagreements. A refusal requires understanding the reasons and evaluating the implications; it is not information to ignore. A later request to change an audit to a lower-assurance engagement requires reasonable justification. Changed user needs can differ from a request motivated by unavailable evidence or a likely modified opinion. Evaluate the underlying circumstances rather than allowing an engagement change to obscure an unresolved audit problem.
Worked example: A company requests a review after records needed for its audit disappear. The auditor evaluates the missing evidence and reporting consequences instead of accepting the downgrade solely to avoid a qualification. A genuine change in financing needs would require a different analysis.
Common mistake: Assuming management can select a lower assurance level at any point overlooks the need for reasonable justification for the change.
Official syllabus reference: [1]
10. Documentation that reconstructs significant judgments
Engagement documentation should enable an experienced auditor with no previous connection to understand procedures, their timing and extent, evidence obtained, results and significant judgments. Identify the tested items, preparer, reviewer and relevant dates. Documentation must explain how conflicting evidence and important exceptions were resolved, rather than merely record a conclusion. Final assembly organizes an already completed file; it does not permit inventing evidence after the report. Assembly deadlines and retention requirements differ by governing standards, so determine the applicable regime instead of applying one universal period.
Worked example: A revenue workpaper identifies the selected contracts, acceptance dates, exceptions and related adjustments. It also explains why one disputed shipment was excluded from revenue. Another auditor can reconstruct the conclusion without relying on the original senior's memory or oral explanation.
Common mistake: Writing only 'tested without exception' omits the population, selected items, procedure details and reasoning needed to understand the actual work.
Official syllabus reference: [1]
11. Quality management and distinct report timing gates
A firm's quality management system addresses quality risks through responses involving leadership, ethics, acceptance, engagement performance, resources, information and monitoring. Engagement partners manage quality on individual engagements; required engagement quality reviews provide an objective evaluation of significant judgments. Under applicable AICPA SQMS No. 2 and SAS No. 146 requirements, a required review must be completed before the engagement report is dated. Under PCAOB requirements, concurring approval is required before report release. These are distinct gates; withholding release does not cure premature dating on an AICPA engagement.
Worked example: For an AICPA audit subject to the new requirements, the reviewer resolves a significant estimate issue on March 12. The team cannot date the report March 11 merely because it plans release on March 13. Completion must precede report dating.
Common mistake: Using 'before release' as a universal quality-review rule conflates the PCAOB release gate with the applicable AICPA report-dating requirement.
Official syllabus reference: [1]
12. Governance communication and control-deficiency severity
Governance communications address planned scope and timing, significant risks, significant findings and other required matters without disclosing details that undermine audit effectiveness. Control deficiencies are evaluated by the likelihood and potential magnitude of misstatement, individually and together. A material weakness creates a reasonable possibility that a material misstatement will not be prevented or detected and corrected timely. A significant deficiency is less severe but important enough for governance attention. Required written communications and timing depend on the engagement regime; correcting a detected error does not erase the underlying deficiency.
Worked example: One employee can create suppliers and release payments without review. The auditor evaluates possible loss magnitude and likelihood, considers other controls, and communicates the resulting deficiency at the appropriate level. Reimbursing one improper payment does not establish that the control problem disappeared.
Common mistake: Classifying deficiencies solely by the amount of errors found ignores potential misstatement magnitude, likelihood and the effects of interacting control failures.
Official syllabus reference: [1]
Assessing Risk and Developing a Planned Response
13. Overall strategy versus the detailed audit plan
The overall audit strategy establishes scope, timing and direction and guides resource allocation. The detailed plan translates that strategy into risk assessment procedures, further procedures and other required work. Strategy considers reporting deadlines, locations, engagement characteristics, significant risks and specialized skills. The plan specifies what will be tested, when and how extensively. Both evolve when evidence changes the risk assessment. Prior-year documentation is a starting point, not a substitute for evaluating new systems, transactions, personnel and economic conditions affecting the current engagement.
Worked example: An entity acquires a foreign subsidiary and changes its reporting deadline. The strategy addresses component involvement and staffing. The plan then specifies procedures over acquisition accounting, consolidation entries and the subsidiary's relevant balances, with dates and responsible team members.
Common mistake: Treating the prior-year program as the current strategy overlooks how changed scope, risk and resources should alter specific audit procedures.
Official syllabus reference: [1]
14. Elasticity and marginal profit decisions
Price elasticity compares percentage quantity change with percentage price change, using an explicitly chosen denominator convention. Absolute elasticity above one indicates relatively elastic demand over the measured range; a price increase can reduce revenue when quantity falls proportionately more. Revenue is price multiplied by quantity, so calculate the actual product rather than subtracting percentage changes. Profit maximization also considers marginal revenue and marginal cost: greater revenue alone does not establish greater profit. Auditors use these relationships to challenge sales forecasts, inventory assumptions and management explanations.
Worked example: Price rises from $50 to $55 while units fall from 2,000 to 1,700. Using original-period denominators, elasticity is 15% divided by 10%, or 1.5. Revenue falls from $100,000 to $93,500, challenging a forecast based only on higher prices.
Common mistake: Assuming a price increase necessarily improves profit ignores quantity response, variable costs and the difference between revenue growth and incremental profit.
Official syllabus reference: [1]
15. Business cycles and economic indicators
Business cycles move through expansion, peak, contraction and trough, but indicators differ in timing and interpretation. Leading indicators may suggest future direction, coincident indicators describe current activity and lagging indicators confirm established patterns. Classification can depend on the measure and context rather than a single label. Inflation, interest rates, unemployment and supply-chain conditions affect demand, financing and costs through different mechanisms. Translate economic changes into account-specific risks, such as slower collections, obsolete inventory or discount-rate sensitivity, instead of treating a recession label as a complete audit conclusion.
Worked example: A durable-goods seller experiences falling orders while borrowing costs rise. The auditor links these conditions to inventory recoverability, customer credit losses and debt compliance. Strong prior-year earnings do not resolve risks created by the changed demand and financing environment.
Common mistake: Using one favorable economic indicator to dismiss all financial reporting risks overlooks differing industries, timing relationships and account-specific exposure mechanisms.
Official syllabus reference: [1]
16. Entity governance, incentives and technology change
Understanding an entity includes ownership, governance, financing, operations, accounting policies and technology use. These factors explain incentives and opportunities for misstatement. For issuers, Sarbanes-Oxley responsibilities include management certifications and applicable internal-control reporting obligations, while audit committees oversee external auditor relationships. Do not assume every issuer has identical auditor-attestation requirements; applicable exemptions matter. New AI or automated accounting tools can change transaction initiation, estimation and review. Map those changes to financial reporting risks and accountability rather than assuming automation preserves the previous control structure.
Worked example: A founder-controlled issuer introduces an AI-generated warranty estimate while negotiating covenant-sensitive financing. The auditor examines governance oversight, model assumptions, data inputs and management incentives. Prior manual review procedures may no longer address how the current estimate is produced.
Common mistake: Assuming a new accounting system changes only efficiency overlooks its effects on authorization, data reliability, estimation bias and governance oversight.
Official syllabus reference: [1]
17. COSO components, objectives and reasonable assurance
COSO's Internal Control—Integrated Framework organizes internal control into control environment, risk assessment, control activities, information and communication, and monitoring activities. Its objectives encompass operations, reporting and compliance. The components operate together rather than as interchangeable checklists, and the framework includes seventeen supporting principles. Internal control provides reasonable assurance because judgment errors, collusion, override and other limitations remain possible. An auditor applies the framework to understand how controls address relevant financial reporting risks; the existence of policies alone does not show that components function together effectively.
Worked example: A company has detailed purchase approvals but no process for monitoring whether approvals occur. The auditor distinguishes the control activity from monitoring and evaluates the missing feedback mechanism. A well-written approval policy cannot establish effective operation of the entire system.
Common mistake: Treating COSO as a list of transaction approvals overlooks entity-level culture, risk identification, information flows and ongoing evaluation of controls.
Official syllabus reference: [1]
18. Entity-level controls and precision of review
Entity-level controls influence multiple processes, but their direct effect on assertion-level risk varies. Ethical leadership can support the control environment without detecting a particular account error. A management review control may directly address a risk only when its precision, expectations, investigation thresholds and follow-up are sufficient. Determine what information the reviewer uses, whether it is reliable and how exceptions are resolved. A signature establishes little unless the underlying review can prevent or detect the relevant misstatement at an appropriate level of detail.
Worked example: The CFO reviews total monthly revenue against budget, but offsetting product errors cancel in the total. That review may be too broad to detect a material product-level cutoff issue. A more disaggregated review with documented investigation could address the risk differently.
Common mistake: Assuming senior management's involvement makes a review sufficiently precise overlooks aggregation, weak expectations and unresolved differences in the reviewed information.
Official syllabus reference: [1]
19. IT general controls and automated-control reliance
IT general controls support reliable application operation through areas such as logical access, program changes and computer operations. An automated matching control can perform consistently yet remain vulnerable if unauthorized users can alter its code or underlying master data. Identify relevant dependencies rather than testing every IT control indiscriminately. Evaluate whether changes are authorized, tested and migrated appropriately and whether privileged access is controlled. Effective application logic does not by itself establish reliable operation throughout a period when the supporting IT environment may have changed.
Worked example: A system blocks invoices exceeding approved purchase quantities. The auditor verifies that logic, then discovers developers can modify production code without approval. Reliance requires addressing the change-access weakness and its actual effect on the control during the audit period.
Common mistake: Concluding that one successful automated test proves year-long effectiveness ignores unauthorized changes, privileged access and the reliability of supporting system data.
Official syllabus reference: [1]
20. Walkthroughs, control design and implementation
A walkthrough follows a transaction from initiation through processing, recording and financial statement presentation. Combine inquiry with inspection, observation or reperformance to understand actual data flows and controls. Design evaluation asks whether a control could address the relevant risk if performed properly. Implementation asks whether the control exists and is being used. Operating effectiveness asks whether it operated consistently as intended over the relevant period. These questions are related but distinct; a single walkthrough ordinarily does not establish the evidence needed for period-long reliance.
Worked example: An auditor traces a credit sale from order approval to shipment, invoicing and the ledger. Inspecting the credit approval demonstrates implementation for that sale. Additional testing is needed to support reliance on credit approval across the year's relevant transactions.
Common mistake: Treating inquiry alone as implementation evidence overlooks the need to inspect, observe or otherwise corroborate how the control actually operates.
Official syllabus reference: [1]
21. Segregation of duties and compensating controls
Segregation separates incompatible functions such as authorization, custody, recording and reconciliation so one person cannot both cause and conceal an error or misappropriation. Small organizations may lack staff for complete separation, making well-designed compensating controls important. A compensating review must address the specific opportunity, use reliable information and operate with adequate precision. Merely adding another signature does not resolve an incompatible duty combination. Evaluate which person can initiate a transaction, change master data, move assets and alter records before deciding what independent review is needed.
Worked example: A bookkeeper records cash receipts and prepares deposits. The owner independently compares bank-validated deposits with original customer remittances and investigates differences. This review addresses a specific concealment opportunity more directly than signing a summary prepared solely by the bookkeeper.
Common mistake: Assuming limited staffing makes segregation irrelevant overlooks compensating controls that can independently detect the specific errors or diversion opportunities created.
Official syllabus reference: [1]
22. SOC 1 Type 2 scope and user-entity dependencies
SOC 1 reports address controls relevant to user entities' internal control over financial reporting; SOC 2 addresses applicable trust services criteria. A Type 1 report concerns design at a specified date, while Type 2 also addresses operating effectiveness over a period. Evaluate the report's scope, tests, exceptions, period, subservice organizations and complementary user-entity controls. A clean Type 2 report does not cover omitted processes, later periods or unperformed client controls. Additional evidence is needed when these boundaries leave gaps in the planned financial statement audit reliance.
Worked example: A processor's report covers January through September and assumes clients approve payroll registers. For a December year-end audit, the auditor addresses the remaining quarter and tests the client's relevant approvals instead of treating the report as complete payroll-control evidence.
Common mistake: Treating SOC 1 Type 2 as blanket assurance over outsourced processing overlooks its defined period, control objectives, exceptions and user responsibilities.
Official syllabus reference: [1]
23. Management override and targeted journal-entry testing
Management can override otherwise effective controls through unusual journal entries, biased estimates or transactions lacking a genuine business purpose. Address this risk with procedures directed at journal entries and adjustments, retrospective consideration of estimate bias, and significant unusual transactions. Journal selection should reflect how entries are initiated, approved and posted, including consolidation and post-closing adjustments. Unusual timing or users can guide selection, but a normal-looking entry is not automatically safe. Validate the completeness of the entry population before relying on analytic filters or testing selected items.
Worked example: A controller posts a consolidation entry late at night that increases revenue and reduces an accrual. The auditor examines authorization, underlying support and business purpose, then considers whether similar entries or biased estimates indicate a broader override pattern.
Common mistake: Restricting override testing to entries above materiality overlooks smaller coordinated postings, biased estimates and adjustments outside the ordinary general ledger.
Official syllabus reference: [1]
24. Overall and specific materiality
Materiality concerns whether omissions or misstatements could reasonably influence users' decisions, considering size, nature and circumstances. A benchmark and percentage help determine an initial amount but do not replace judgment. A lower materiality level may be appropriate for particular classes, balances or disclosures whose smaller errors could influence users. Qualitative factors include concealing a trend, affecting a covenant or changing sensitive compensation. Reassess materiality when actual results or other information differ significantly from planning assumptions, and evaluate whether the audit work remains appropriate.
Worked example: A lender closely monitors a debt covenant. An error below overall materiality changes apparent compliance to noncompliance. The auditor evaluates the covenant's significance and related disclosures rather than dismissing the error solely because it falls below the general numerical benchmark.
Common mistake: Treating overall materiality as permission to ignore every smaller error overlooks qualitative significance and lower thresholds for particular sensitive matters.
Official syllabus reference: [1]
25. Performance materiality and tolerable misstatement
Performance materiality is set below overall materiality to reduce the probability that aggregate uncorrected and undetected misstatements exceed materiality. It reflects factors such as expected errors and prior findings rather than a mandatory universal percentage. Tolerable misstatement applies materiality considerations to a particular sampling procedure or population and may equal or be lower than the relevant performance amount. These are planning and evaluation tools, not automatic reporting cutoffs. When expectations change, revise them and reconsider sample sizes, procedures and the cumulative effect of identified differences.
Worked example: An auditor sets overall materiality at $120,000 and, under the engagement's assumptions, performance materiality at $78,000. A receivable sampling application uses $60,000 tolerable misstatement because of expected errors and aggregation risk. Neither amount replaces the final overall evaluation.
Common mistake: Assuming performance materiality is always a fixed percentage overlooks the judgment needed to address aggregation risk, expected errors and engagement circumstances.
Official syllabus reference: [1]
26. Inherent risk, control risk and detection risk
Inherent risk is susceptibility to material misstatement before considering controls. Control risk concerns failure of controls to prevent or detect and correct misstatement timely. Detection risk concerns audit procedures failing to detect an existing material misstatement. Holding acceptable audit risk constant, higher assessed misstatement risk requires lower detection risk and more persuasive evidence. The multiplicative model illustrates this relationship but does not convert every judgment into an objectively measurable probability. Assess risks at financial statement and assertion levels and connect them to procedure nature, timing and extent.
Worked example: A complex estimate has high inherent risk, and testing shows its review control is ineffective. The auditor responds with stronger substantive procedures, such as independently testing key assumptions, rather than reducing inherent risk to preserve the original audit budget.
Common mistake: Changing inherent risk merely because control testing fails confuses susceptibility before controls with the separate assessment of whether controls operate effectively.
Official syllabus reference: [1]
27. Fraud incentives, opportunities and rationalization
Fraud risk factors commonly involve incentives or pressures, opportunities, and attitudes or rationalizations. A financing deadline can create pressure; weak approval controls create opportunity; an aggressive ethical culture can support rationalization. These factors indicate risk rather than prove fraud. Distinguish fraudulent financial reporting from asset misappropriation while recognizing that concealment can affect both. Team discussions combine knowledge about where manipulation could occur and inform unpredictable or targeted responses. Evaluate revenue-related fraud risks according to the facts instead of assuming all revenue streams have identical vulnerabilities.
Worked example: A sales executive receives a bonus for meeting a year-end target and can approve side agreements. The auditor considers premature revenue and concealed return rights, then targets contract terms and acceptance evidence rather than interpreting the incentive alone as proof of fraud.
Common mistake: Treating one fraud risk factor as a finding of fraud overlooks the need for evidence about transactions, intent and financial reporting effects.
Official syllabus reference: [1]
28. Risk-assessment analytics and exception interpretation
Risk-assessment analytics identify relationships, trends and unusual items that can indicate where misstatement may occur. Disaggregate by product, location, customer or time when aggregate totals conceal meaningful patterns. Establish that the source data are complete and accurate enough for the purpose, then investigate plausible explanations for exceptions. An outlier is a lead, not a proven error, and a normal-looking item is not automatically correct. Use findings to revise risks and planned procedures; do not mistake an exploratory visualization for sufficient substantive evidence about a balance.
Worked example: Overall sales grow modestly, but one branch records a sharp December spike followed by January credits. The auditor examines contracts and returns at that branch and revises cutoff testing. The chart directs attention without itself establishing a misstatement.
Common mistake: Treating every analytic exception as fraud overlooks legitimate business explanations and the additional evidence needed to establish what actually occurred.
Official syllabus reference: [1]
29. Using internal auditors, specialists and component auditors
Using others' work requires evaluating the role, competence, objectivity or independence as applicable, and the adequacy of the work for the audit purpose. Internal auditors, management's specialists, auditor's specialists and component auditors have different relationships and responsibilities. Greater judgment and risk generally require more direct auditor involvement. Group-audit direction, supervision and evaluation differ from circumstances permitting reference to another auditor under applicable standards. Do not transfer responsibility merely by receiving a report. Determine what work must be reviewed or supplemented and whether the evidence supports the intended conclusion.
Worked example: An internal audit team tests routine purchase approvals, while a material acquisition valuation requires specialized judgment. The external auditor evaluates internal audit objectivity and competence for the first task and obtains appropriate valuation expertise and direct involvement for the second.
Common mistake: Applying one reliance checklist to every contributor overlooks differences in objectivity, independence, specialist evidence and responsibility for group-audit work.
Official syllabus reference: [1]
30. Planning procedures for attestation and review services
Procedure planning follows the engagement objective and governing standards. An attestation examination needs suitable criteria and evidence supporting reasonable assurance; a review supports limited assurance and requires further work when information suggests material problems. Agreed-upon procedures require sufficiently specific procedures that can yield factual findings, rather than vague instructions to assess reasonableness. A financial statement review under SSARS primarily uses inquiry and analytical procedures, while preparation and compilation do not provide assurance. The desired report language cannot justify performing procedures inadequate for the engagement actually accepted.
Worked example: A grantor requests verification of selected reimbursement calculations. The practitioner agrees on the population, selection method, documents and recalculation steps before performing an agreed-upon procedures engagement. A broad request to 'confirm compliance' would not define an equally precise procedure.
Common mistake: Planning every engagement as a shortened audit overlooks different criteria, evidence objectives, procedural requirements and the reports users will receive.
Official syllabus reference: [1]
Performing Further Procedures and Obtaining Evidence
31. Primary keys, foreign keys and join cardinality
A relational database stores records in tables with fields describing attributes. A primary key uniquely identifies a record; a foreign key links a record to another table. Normalization separates related entities to reduce redundancy, but joining them can repeat parent values. Determine whether relationships are one-to-one, one-to-many or many-to-many before aggregating amounts. An inner join may omit unmatched records, while an outer join can preserve them for investigation. Check uniqueness, unmatched keys and row counts so a technically successful query does not create misleading audit totals.
Worked example: An invoice header of $900 has three invoice lines totaling $900. Joining the tables repeats the header three times. Summing line values gives $900, while summing repeated headers gives $2,700; the auditor reconciles totals at the intended invoice or line level.
Common mistake: Assuming matching keys guarantee correct totals overlooks repeated parent amounts, missing matches and changes in the unit represented by each row.
Official syllabus reference: [1]
32. Measurement scales and meaningful comparisons
Nominal data identify categories without order, such as branch codes. Ordinal data have an order but not necessarily equal gaps, such as low, medium and high risk. Interval scales have meaningful equal differences without a meaningful absolute zero, while ratio scales support meaningful ratios because zero represents absence of the measured quantity. Discrete variables count separate outcomes; continuous variables measure along a range. Choose calculations and visualizations consistent with these properties. Numeric storage does not make a code quantitative, and averaging ordered labels can imply unsupported precision.
Worked example: Branches coded 10, 20 and 30 are locations, not amounts, so their mean has no business interpretation. Days outstanding can support numerical comparisons, while a three-level risk rating should retain its ordered-category meaning unless a justified scoring method is specified.
Common mistake: Treating every numeric field as measurable quantity overlooks identifiers and ordered categories whose arithmetic may have no meaningful interpretation.
Official syllabus reference: [1]
33. Extraction specifications and controlled data cleaning
A useful extraction request specifies the population, period, systems, fields, identifiers, data types and relevant status filters. Include reversals, voids or post-closing entries when the procedure requires them. Preserve a raw copy and document transformations so results can be reproduced. Cleaning may standardize dates, signs or formats, but deleting apparent duplicates requires understanding whether they are genuine separate transactions. Reconcile record counts and control totals before and after transformations. Missing values and unmatched identifiers are evidence conditions to investigate, not inconveniences to remove automatically.
Worked example: For journal testing, the auditor requests posting date, effective date, user, account, amount and reversal links, including post-closing entries. After standardizing date formats, the team reconciles debit and credit totals and retains a transformation log alongside the untouched original export.
Common mistake: Deleting duplicate-looking rows before understanding transaction identifiers can remove legitimate activity and make an incomplete population appear clean and internally consistent.
Official syllabus reference: [1]
34. Completeness, accuracy and authenticity of information
Before using information as evidence, evaluate whether it is complete, accurate, authentic and sufficiently reliable for the intended purpose. Reconcile report totals to relevant records, inspect query parameters, test selected details to original sources and consider management bias. A report generated by an established system may still omit a location or apply the wrong dates. External or AI-generated information also requires evaluation of source and limitations. Reliability testing should fit the procedure: a highly precise substantive analysis may require stronger data support than a preliminary exploratory comparison.
Worked example: An AI-produced receivables summary reconciles to a subtotal but excludes disputed invoices. The auditor inspects extraction criteria, reconciles the complete ledger and checks source invoices. A plausible narrative and correct arithmetic do not establish that the omitted population was included.
Common mistake: Assuming externally generated or automated information is inherently reliable overlooks incomplete inputs, query errors, fabricated content and bias in source selection.
Official syllabus reference: [1]
35. Substantive analytics and expectation precision
Substantive analytical procedures compare recorded amounts with sufficiently precise expectations based on plausible relationships and reliable data. Develop the expectation, determine an acceptable difference and investigate significant deviations with corroborating evidence. Predictability, disaggregation and the risk being addressed influence whether the analysis can supply persuasive evidence. A regression or ratio is not inherently strong merely because it is mathematically sophisticated. Management's explanation must be supported, and a close aggregate match may conceal offsetting errors. Distinguish evidence-producing substantive analytics from broad planning or final-review comparisons.
Worked example: An auditor estimates rental revenue using occupied unit-months and contractual rates, separately considering concessions. A material unexplained difference leads to lease and occupancy testing. Comparing only total revenue with last year would provide a much less precise expectation for the same purpose.
Common mistake: Accepting a variance explanation after inquiry alone overlooks the need to corroborate why the recorded amount differs from the supported expectation.
Official syllabus reference: [1]
36. Evidence sufficiency, relevance and reliability
Sufficiency concerns evidence quantity; appropriateness concerns relevance and reliability. Higher risk generally requires more persuasive evidence, but accumulating weak evidence does not necessarily compensate for poor quality. Relevance depends on the assertion and direction of testing: evidence that supports existence may not establish valuation. Reliability depends on source, controls, circumstances and how evidence is obtained, rather than an inflexible hierarchy. Resolve contradictions among sources and consider authenticity. Auditor-controlled external evidence can be persuasive, yet it still must address the specific question being evaluated.
Worked example: A bank confirmation supports a cash balance but does not establish that every account was identified or that year-end transfers were recorded correctly. The auditor combines confirmation with account-completeness work and transfer cutoff testing to address those separate risks.
Common mistake: Counting documents as a substitute for evaluating their relevance overlooks whether the evidence actually addresses the assertion and resolves identified contradictions.
Official syllabus reference: [1]
37. Attribute sampling and control deviations
Attribute sampling evaluates whether a control was performed as prescribed. Define the population, sampling unit and deviation before selecting items, and consider expected deviation, tolerable deviation and sampling risk. The observed sample rate alone does not establish the population rate; an upper deviation estimate may exceed the tolerable rate even when the observed rate does not. Investigate the nature and cause of deviations, including whether they indicate systematic failure. Control exceptions affect reliance and planned procedures, but they are not automatically dollar misstatements in the financial statements.
Worked example: Two of 100 tested approvals are missing. The supplied statistical evaluation gives a 6% upper deviation rate, compared with a 5% tolerable rate. The sample does not support planned reliance merely because the observed 2% rate appears low.
Common mistake: Comparing only observed deviations with tolerance overlooks sampling uncertainty and whether the exceptions reveal a broader failure in the control's operation.
Official syllabus reference: [1]
38. Projected misstatement and sampling uncertainty
Substantive sampling estimates monetary misstatement in a defined population. The projection method must fit the sample design and error characteristics; ratio projection applies a sample error rate to recorded population value when appropriate. Evaluate projected misstatement together with sampling risk and relevant known differences against tolerable misstatement. A sample error amount is not the same as a population projection, and a point estimate below tolerance may still be insufficient after uncertainty is considered. Unsatisfactory results call for responsive work or correction, not an automatic opinion modification.
Worked example: A $100,000 sample is overstated by $2,000 within a $1,000,000 population. Under an appropriate ratio method, projected overstatement is $20,000. A supplied $12,000 risk allowance creates a $32,000 upper estimate, which exceeds a $30,000 tolerance despite the lower point projection.
Common mistake: Comparing only the sample's dollar error with tolerable misstatement ignores the untested population and the uncertainty inherent in sample-based conclusions.
Official syllabus reference: [1]
39. Confirmation control and alternative evidence
The auditor maintains control over confirmation selection, preparation, sending and responses to reduce interception or manipulation. Positive requests require a response; negative requests ask recipients to respond only when they disagree and generally provide less persuasive evidence. Investigate exceptions rather than assuming they are client errors or timing differences. For nonresponses, appropriate alternatives depend on the assertion, such as matching subsequent receipts to specific invoices and delivery support. A response's authenticity matters, and management-forwarded correspondence may require additional verification before it is treated as reliable external evidence.
Worked example: A customer confirmation is unanswered, and a later receipt equals the requested balance. The auditor obtains remittance details and matches the payment to the year-end invoices because the same customer also made purchases after year-end that could explain the receipt.
Common mistake: Treating an unanswered positive confirmation as agreement mistakes absence of evidence for a customer response and bypasses necessary alternative procedures.
Official syllabus reference: [1]
40. Bank reconciliations and interbank transfer cutoff
Cash testing links bank balances, book balances and reconciling items while evaluating existence, completeness and cutoff. Inspect subsequent clearing of outstanding checks and deposits in transit, investigate unusual items and consider undisclosed accounts or restrictions. For interbank transfers, compare receipt and disbursement recording dates on both books and bank statements. Recording the receipt before year-end and the corresponding disbursement afterward can count the same funds twice. Normal bank clearing delays are not themselves kiting; the misstatement depends on inconsistent recording and inclusion in reported cash.
Worked example: A $40,000 transfer is added to the destination account on December 31 but not deducted from the source until January 2. Both book balances therefore include the funds at year-end. Matching transfer dates reveals the $40,000 overstatement despite later clearing.
Common mistake: Assuming a reconciled bank balance proves correct total cash overlooks fabricated reconciling items, omitted accounts and mismatched recording of interbank transfers.
Official syllabus reference: [1]
41. Revenue cutoff and contractual recognition conditions
Revenue cutoff tests whether transactions are recognized in the correct period under the applicable framework and contract terms. Inspect shipment, delivery, acceptance, return rights and other conditions relevant to when performance is satisfied. Invoice date alone may not determine recognition. Test transactions around year-end in both directions and consider subsequent credits or returns that reveal earlier conditions. A recorded sale supported by an invoice can still be premature. Connect the procedure to the identified risk rather than applying one shipping-date rule to every contract or revenue stream.
Worked example: A contract requires customer acceptance, which occurs January 4, although the invoice and shipment are dated December 29. Under the scenario's acceptance requirement, December recognition is premature. The auditor examines acceptance evidence and the related receivable and inventory effects.
Common mistake: Using invoice date as a universal recognition trigger overlooks contractual acceptance, delivery obligations and the applicable framework's performance requirements for revenue.
Official syllabus reference: [1]
42. Unrecorded liabilities and search direction
Completeness testing starts with evidence that can reveal obligations absent from the ledger. Examine subsequent disbursements, unmatched receiving reports, supplier statements and invoices received after year-end, then determine when the obligation arose. Vouching recorded payables mainly addresses recorded items and cannot by itself identify the omitted population. Consider goods received but not invoiced, services performed before year-end and unusual supplier balances. Payment date is evidence of settlement, not necessarily the liability's recognition date. Apply the relevant contract and accounting framework to determine the proper period.
Worked example: A January payment settles a December consulting service. The invoice arrived after closing, and no accrual was recorded. Tracing the payment to the service period identifies a year-end liability that a sample selected solely from recorded December payables would miss.
Common mistake: Selecting only positive recorded payable balances for completeness testing excludes suppliers whose entire obligations may have been omitted from the ledger.
Official syllabus reference: [1]
43. Inventory observation, count direction and valuation
Inventory observation evaluates management's count procedures and obtains evidence through observation, inspection and test counts. Tracing count-sheet items to the floor primarily addresses existence; tracing floor items to count records primarily addresses completeness. Inspect condition for damage or obsolescence, but test valuation separately using costs and the applicable measurement model. Consider ownership, consignment, third-party locations and movement during counting. When counts occur away from year-end, test intervening movements. Observation does not make the auditor responsible for conducting management's count or prove every inventory assertion.
Worked example: A floor-to-sheet test finds goods omitted from the count records, indicating a completeness issue. Another test identifies damaged products already counted correctly. Their quantities may be accurate, but the auditor separately evaluates whether their carrying values require reduction.
Common mistake: Assuming a successful quantity count proves inventory valuation overlooks obsolete condition, cost errors, ownership issues and the applicable recoverability measurement rules.
Official syllabus reference: [1]
44. Estimate uncertainty, bias and specialist evidence
Accounting estimates depend on methods, assumptions and data, with uncertainty increasing the range of reasonably possible outcomes. Audit approaches may test management's process, use relevant subsequent events or develop an independent point estimate or range. Evaluate significant assumptions individually and together, including possible management bias. When specialists contribute, assess their competence, capabilities and objectivity as appropriate and the relevance of their work. A technically valid model can still produce a misleading estimate from unsupported inputs. Evaluate disclosures explaining uncertainty as well as the recorded amount.
Worked example: A discounted cash-flow valuation uses a qualified specialist's model but management's optimistic revenue forecast. The auditor tests forecast support, discount-rate consistency and sensitivity rather than accepting the specialist's credentials as evidence that the projected cash flows are achievable.
Common mistake: Equating specialist involvement with a reliable estimate overlooks unsupported source data, biased assumptions and uncertainty that the financial statements may need to disclose.
Official syllabus reference: [1]
45. Related parties and transaction substance
Related-party procedures identify relationships and transactions that may not follow ordinary market incentives or be fully disclosed. Inspect relevant records, inquire beyond a single manager and remain alert to unusual counterparties, terms or business purposes. Evaluate authorization, accounting, disclosure and the economic substance of significant transactions. A transaction with a related party is not automatically improper, but management's claim that terms are equivalent to arm's length requires support. Undisclosed relationships can affect fraud assessment and the reliability of representations, especially when complex structures obscure who benefits.
Worked example: An entity sells equipment to a company owned by its CFO's family and leases it back on unusual terms. The auditor evaluates the relationship, contractual substance, approvals and disclosures rather than concluding the transaction is ordinary because cash changed hands.
Common mistake: Assuming a signed contract and payment establish arm's-length terms overlooks related incentives, side agreements and the need to evaluate transaction substance.
Official syllabus reference: [1]
46. Litigation evidence and suspected noncompliance
Litigation procedures combine management inquiry, review of legal expenses and minutes, and communication with external legal counsel when appropriate. Evaluate recognition and disclosure under the applicable framework rather than converting counsel's response into a universal numerical rule. Suspected noncompliance requires understanding the matter, obtaining relevant evidence and assessing financial statement and communication consequences. The auditor does not provide a legal determination simply by identifying indicators. Management-imposed restrictions or inadequate responses may create evidence limitations and raise integrity concerns requiring an engagement-specific reporting assessment.
Worked example: Legal expenses increase sharply, but management reports no claims. The auditor inspects invoices and seeks appropriate counsel information, discovering a pre-year-end dispute. The resulting accounting depends on the applicable recognition criteria and evidence, not the mere existence of a lawyer's bill.
Common mistake: Treating management's denial as sufficient despite contradictory legal evidence overlooks the need to investigate potential claims and assess recognition or disclosure.
Official syllabus reference: [1]
47. Subsequent events and underlying-condition timing
Subsequent-event evaluation distinguishes later evidence about conditions existing at the financial statement date from conditions arising afterward. The first category may require adjustment; the second may require disclosure when material under the applicable framework. Audit procedures through the report date include appropriate inquiry and review of later financial information, minutes and relevant events. Facts discovered after the report date require a different analysis of reliability and necessary action. Do not classify events solely by settlement date: identify when the underlying condition arose and what the later evidence establishes.
Worked example: A January settlement confirms the amount of a lawsuit arising before December 31, supporting a year-end adjustment. A warehouse fire that first occurs in January generally concerns a later condition and may require material-event disclosure rather than December recognition.
Common mistake: Classifying every post-year-end cash payment as a nonadjusting event overlooks payments that provide evidence about obligations already existing at year-end.
Official syllabus reference: [1]
48. Going-concern evidence and feasibility of management plans
Going-concern work evaluates conditions and events that raise substantial doubt or the applicable framework's corresponding uncertainty, then examines management's plans and supporting evidence. Relevant indicators include recurring losses, liquidity problems, debt defaults and loss of important markets. A plan matters only to the extent its implementation and effectiveness are supported, such as committed financing or credible asset-sale evidence. Applicable evaluation periods and reporting requirements vary by framework and standards. Evaluate cash-flow assumptions, timing and disclosure rather than assuming management's intent or an optimistic forecast resolves the concern.
Worked example: An entity forecasts a cash shortfall and proposes refinancing. The auditor inspects lender correspondence, commitment conditions and forecast sensitivities. An unsigned expression of interest provides different support from an enforceable financing commitment available before obligations become due.
Common mistake: Treating a proposed financing plan as equivalent to available funding overlooks conditions, timing and evidence that the plan can actually be implemented.
Official syllabus reference: [1]
49. Integrated-audit control testing and remediation
An integrated audit evaluates financial statements and internal control over financial reporting, linking control selection to risks of material misstatement. Test design and operating effectiveness of relevant controls, including the reliability of information used in them. Evaluate deficiencies individually and in combination, considering likelihood and potential magnitude. Remediation requires a changed control that is appropriately designed, implemented and supported by sufficient operating evidence by the assessment date. Correcting a financial statement error is not equivalent to remediating its control cause, and clean substantive results do not establish effective internal control.
Worked example: Management corrects an inventory error in February but does not implement a new review until March. That correction improves the statements, yet it does not demonstrate effective inventory control at the preceding December 31 assessment date for the integrated audit.
Common mistake: Using the absence of remaining statement errors to conclude controls were effective overlooks what substantive procedures achieved independently of the entity's controls.
Official syllabus reference: [1]
50. Single audits, major programs and questioned costs
A single audit combines financial statement auditing with work addressing federal award compliance and internal control over compliance under applicable requirements. Major-program selection is risk-based within prescribed rules, not simply a choice of the largest grant. The schedule of expenditures of federal awards supports the population and must be evaluated for completeness and accuracy. Compliance procedures address requirements relevant to each program, such as allowable costs or eligibility. A questioned cost identifies an amount requiring scrutiny; it is not automatically a final disallowance, and reporting consequences depend on the findings.
Worked example: A recipient charges payroll to a major program without sufficient support for the allocation. The auditor evaluates the relevant compliance requirement, tests the cost and related controls, and assesses whether the amount and deficiency require reporting as a finding.
Common mistake: Assuming every questioned cost is immediately repayable overlooks the distinction between an audit finding and the awarding agency's ultimate resolution.
Official syllabus reference: [1]
51. ERISA Section 103(a)(3)(C) certified investment information
An ERISA Section 103(a)(3)(C) audit uses qualifying certified investment information under specific conditions; it is not a general exemption from auditing the plan. Evaluate management's election, the certifying institution's eligibility and the certification's scope and completeness. Perform required procedures over the certified information's agreement and presentation and audit information not covered by the certification. Contributions, benefit payments and other plan amounts remain subject to applicable work. The resulting report follows the special engagement requirements rather than automatically treating certification as a scope limitation requiring a disclaimer.
Worked example: A plan obtains an eligible bank's certification covering specified investments. The auditor evaluates the certification and required agreement and presentation matters while separately testing participant contributions and benefit payments. Investment certification does not support omitting procedures over those unrelated plan transactions.
Common mistake: Calling the engagement an automatic disclaimer audit overlooks the distinct reporting model and continuing responsibilities for certified and noncertified plan information.
Official syllabus reference: [1]
Forming Conclusions and Reporting
52. Opinion selection: misstatement versus evidence limitation
First distinguish a known financial reporting misstatement from an inability to obtain sufficient appropriate evidence. For a known misstatement, material but nonpervasive effects generally produce a qualified opinion, while material and pervasive effects produce an adverse opinion. For an evidence limitation, potentially material but nonpervasive effects generally produce qualification, while potentially material and pervasive effects produce a disclaimer. Pervasiveness concerns the breadth or fundamental nature of effects, not a universal percentage. Apply issuer or nonissuer report terminology and structure as appropriate to the engagement.
Worked example: An auditor has evidence of a material inventory valuation departure confined to one area and concludes it is not pervasive. A qualified opinion fits. If instead evidence is unavailable with potentially pervasive effects, the relevant alternative is a disclaimer, not an adverse opinion.
Common mistake: Choosing adverse whenever a problem is large overlooks whether the auditor knows the statements are misstated or lacks evidence to decide.
Official syllabus reference: [1]
53. Emphasis, other matters and CAM/KAM reporting
An emphasis-of-matter paragraph highlights a matter appropriately presented or disclosed that is fundamental to understanding the statements. An other-matter paragraph addresses a matter outside the statements relevant to understanding the audit, responsibilities or report. Neither substitutes for a required modified opinion. Critical audit matters under PCAOB standards and key audit matters under applicable AICPA arrangements have distinct eligibility and reporting requirements. A difficult audit issue is not automatically every type of paragraph. Determine the governing standards, required communications and purpose before selecting report treatment.
Worked example: A properly disclosed major catastrophe may warrant emphasis under applicable circumstances. An undisclosed material loss instead requires evaluating a reporting departure. Labeling it an emphasis matter cannot compensate for missing disclosure or preserve an otherwise inappropriate unmodified opinion.
Common mistake: Treating emphasis, other-matter, CAM and KAM sections as interchangeable overlooks their different subjects, triggering conditions and relationships to the audit opinion.
Official syllabus reference: [1]
54. Separate financial statement and ICFR opinions
An integrated audit addresses two subjects: financial statement fairness and internal control over financial reporting effectiveness. One material weakness means ICFR is ineffective and supports an adverse ICFR opinion when sufficient evidence is available. The financial statements can still receive an unqualified opinion if material errors are corrected and evidence supports fair presentation. Reports may be separate or combined under applicable requirements, but the conclusions remain distinct. A scope limitation requires its own evaluation and should not be confused with a known material weakness or automatically treated identically.
Worked example: Expanded substantive tests identify and resolve a material revenue error, but the underlying review weakness existed at year-end. The issuer can receive an unqualified statement opinion and an adverse ICFR opinion because correction of the statements did not repair controls at that date.
Common mistake: Assuming an adverse ICFR opinion requires an adverse financial statement opinion overlooks the different subjects and the effect of sufficient substantive evidence.
Official syllabus reference: [1]
55. Attestation examination and review conclusions
Attestation reporting identifies the subject matter, suitable criteria, responsibilities and assurance provided. An examination provides reasonable assurance and an opinion; a review provides limited assurance and a conclusion using the applicable review form. Assertion-based examinations evaluate subject matter or assertions as specified, while direct examinations involve the practitioner's measurement or evaluation against criteria. Reporting problems may involve departures from criteria, inadequate disclosure or evidence limitations, and their significance affects modifications. Do not import financial statement review wording or audit terminology without checking the specific attestation engagement requirements.
Worked example: A practitioner examines reported energy usage against specified measurement criteria. The opinion addresses conformity with those criteria, not overall financial statement fairness. If performing a permitted review instead, the report communicates limited assurance rather than simply shortening the examination opinion.
Common mistake: Assuming all reports titled review use identical standards overlooks differences between attestation subject matter and financial statement review engagements under SSARS.
Official syllabus reference: [1]
56. Agreed-upon procedures and factual findings
An agreed-upon procedures engagement reports specified procedures and their factual findings without an opinion or assurance conclusion. Procedures should be sufficiently precise to be performed consistently and findings sufficiently objective to be understood. Identify the subject matter, responsible party and relevant engagement conditions. Users evaluate the findings for their purposes rather than receiving a general conclusion about fairness or compliance. Avoid vague procedures such as determine whether controls are adequate unless converted into objectively defined steps. Applicable report-use restrictions depend on circumstances and are not assumed universally.
Worked example: The practitioner compares 25 reimbursement amounts with identified invoices and reports that three differ by specified amounts. Stating that the reimbursement system is effective would exceed those procedures. Reporting the actual comparisons and exceptions preserves the engagement's factual nature.
Common mistake: Adding an overall compliance conclusion because findings seem favorable converts factual reporting into unsupported assurance beyond the agreed procedures performed.
Official syllabus reference: [1]
57. Preparation and compilation reporting boundaries
Preparation and compilation engagements under SSARS provide no assurance, but their reporting arrangements differ. A preparation engagement generally does not require an accountant's report and requires an appropriate indication that no assurance is provided, subject to applicable alternatives. A compilation includes an accountant's report explaining the lack of audit or review assurance. Independence is not required for either service, but a compilation report discloses a lack of independence when applicable. Known material departures or misleading information still require an appropriate response; no assurance does not permit association with clearly misleading statements.
Worked example: An accountant compiles statements while not independent and appropriately discloses that fact in the compilation report. The same engagement does not become a review merely because the accountant discusses account balances with management or helps correct an obvious classification error.
Common mistake: Assuming every accountant-prepared financial statement needs a compilation report overlooks preparation engagements and their distinct no-assurance presentation and reporting requirements.
Official syllabus reference: [1]
58. Financial statement reviews and interim reviews
A SSARS financial statement review provides limited assurance primarily through inquiry and analytical procedures, with additional procedures when information suggests material misstatement. Independence is required. The conclusion does not state that an audit was performed or provide an audit opinion. Reviews of interim financial information performed by an entity's auditor may instead fall under applicable auditing or PCAOB standards, with engagement-specific knowledge and reporting requirements. Identify the entity and engagement before choosing the report. A review's limited scope does not justify ignoring contradictory evidence or known departures.
Worked example: During a nonissuer review, a large unexplained margin increase conflicts with management's description of unchanged operations. The accountant performs appropriate additional work rather than issuing the standard conclusion solely because the engagement normally relies on inquiry and analytical procedures.
Common mistake: Treating inquiry and analytics as an absolute ceiling on review work overlooks the additional procedures required when possible material misstatements arise.
Official syllabus reference: [1]
59. Reporting perimeter: frameworks, comparatives and other information
Determine which information the report covers and what reporting responsibilities attach to accompanying material. Special-purpose statements require clear identification of the framework and appropriate report treatment. Comparative reporting depends on the periods covered and the auditor's involvement, including predecessor circumstances. Other information accompanying audited statements generally involves reading and considering material inconsistencies, not automatically auditing it. Required supplementary information and supplementary information can involve different procedures and reporting objectives. An in-relation-to opinion requires appropriate work and conditions; proximity to audited statements alone does not confer audit assurance.
Worked example: An annual report includes audited statements, a management narrative and a supplementary cost schedule. The auditor distinguishes reading responsibilities for the narrative from any separately engaged in-relation-to procedures over the schedule. Binding the three sections together does not give them identical assurance.
Common mistake: Assuming all pages accompanying an audit report are audited overlooks the report's defined scope and differing responsibilities for accompanying information.
Official syllabus reference: [1]
60. Final evaluation, representations and report readiness
Before reporting, evaluate corrected and uncorrected misstatements individually and collectively, perform required overall review procedures and consider disclosure adequacy. Obtain required written representations from appropriate management, but do not use them as substitutes for other necessary evidence. Assess going-concern reporting under the applicable standards: adequate uncertainty disclosure may require a dedicated report section without a modified opinion, while inadequate disclosure can require modification. The report date must reflect completed necessary evidence and applicable quality-review gates. Unresolved contradictions, missing required representations or incomplete reviews require resolution before ordinary report issuance.
Worked example: Management signs representations stating that all liabilities are recorded, but subsequent-payment testing identifies unresolved omitted obligations. The auditor investigates and evaluates adjustments before reporting. The representation letter does not neutralize contradictory evidence or permit the remaining misstatements to be ignored.
Common mistake: Treating signed representations as the final proof of fairness overlooks unresolved evidence, aggregate misstatements, disclosure issues and required report-readiness conditions.
Official syllabus reference: [1]