Certified Public Accountant (CPA) Auditing and Attestation (AUD) — Core Syllabus

Distinguish overall materiality, performance materiality, and the clearly trivial threshold.

Overall (planning) materiality is the misstatement level affecting users' decisions for the statements as a whole; performance materiality is set below overall materiality to reduce aggregation risk for procedures; clearly trivial is a much smaller amount below which misstatements need not be accumulated.

What common benchmarks are used to determine overall materiality?

Commonly a percentage of a chosen benchmark such as income before tax (e.g., ~5%), total revenue, total assets, or net assets, selected based on the nature of the entity and users' focus.

What should an auditor do if it becomes aware during the audit of information that would have caused a different (lower) initial materiality?

Reassess and revise materiality (and performance materiality), and evaluate whether the nature, timing, and extent of further audit procedures remain appropriate given the revised amounts.

What is the difference between qualitative and quantitative materiality?

Quantitative materiality is based on size/dollar amount; qualitative materiality considers the nature of an item (e.g., misstatements affecting loan covenants, changing a loss to income, illegal acts, fraud) that may be material regardless of amount.

What are the five risk assessment procedures used to understand the entity and its environment?

Inquiries of management and others, analytical procedures, observation and inspection, and (per current standards) discussion among the engagement team plus information from client acceptance/continuance and prior engagements.

List the five components of internal control under the COSO framework.

Control Environment, Risk Assessment, Control (Information) and Communication, Monitoring Activities, and Control Activities. (Mnemonic: CRIME — Control environment, Risk assessment, Information & communication, Monitoring, Existing control activities.)

How many principles support the five COSO components, and what is their role?

There are 17 principles; all relevant principles must be present and functioning, and the five components must operate together in an integrated manner, for internal control to be effective.

Define the COSO 'control environment' component.

The set of standards, processes, and structures that provide the foundation for internal control — including integrity and ethical values, board oversight, organizational structure, commitment to competence, and accountability ('tone at the top').

What is the fraud triangle, and what are its three elements?

The fraud triangle explains conditions present when fraud occurs: incentive/pressure, opportunity, and rationalization/attitude.

What are the two main types of misstatement arising from fraud the auditor considers?

Fraudulent financial reporting (intentional misstatement of amounts/disclosures to deceive users) and misappropriation of assets (theft of an entity's assets, i.e., defalcation).

What is the purpose of the required fraud 'brainstorming' session among the engagement team?

To discuss how and where the financial statements might be susceptible to material misstatement due to fraud, emphasizing professional skepticism and how management could perpetrate and conceal fraud; it is required and may not be omitted.

Which fraud risk is presumed significant on every audit, and how must the auditor respond?

Improper revenue recognition is a presumed (rebuttable) fraud risk, and the auditor must address it. The risk of management override of controls is also always present, requiring procedures such as testing journal entries, reviewing estimates for bias, and evaluating significant unusual transactions.

Distinguish the audit strategy from the audit plan.

The overall audit strategy sets the scope, timing, and direction of the audit and guides development of the more detailed audit plan; the audit plan describes the nature, timing, and extent of risk assessment procedures, further audit procedures, and other required procedures.

When using the work of a management's specialist, what must the auditor evaluate?

The competence, capabilities, and objectivity of the specialist; obtain an understanding of the specialist's work; and evaluate the appropriateness of that work as audit evidence for the relevant assertion.

Can the auditor use the work of the entity's internal audit function to obtain audit evidence, and does it reduce the auditor's responsibility?

Yes, the external auditor may use internal audit work (or direct assistance) after evaluating its objectivity, competence, and systematic/disciplined approach, but the external auditor retains sole responsibility for the audit opinion.

What are the two ways an external auditor may make use of the internal audit function?

(1) Using the body of work already performed by internal audit as audit evidence; and (2) using internal auditors to provide direct assistance under the external auditor's direction, supervision, and review.

What two qualities must audit evidence possess to support the auditor's opinion?

It must be sufficient (a measure of quantity) and appropriate (a measure of quality — relevance and reliability).

List factors that generally increase the reliability of audit evidence.

Evidence from independent external sources, evidence from effective internal control, evidence obtained directly by the auditor, evidence in documentary/written form, and original documents over copies.

List the assertions about classes of transactions and events during the period.

Occurrence, completeness, accuracy, cutoff, and classification (and presentation).

List the assertions about account balances at period end.

Existence, rights and obligations, completeness, and valuation and allocation (accuracy, valuation, and allocation).

Distinguish tests of controls from substantive procedures.

Tests of controls evaluate the operating effectiveness of controls in preventing/detecting material misstatements (supporting a lower control risk); substantive procedures detect material misstatements at the assertion level and consist of tests of details and substantive analytical procedures.

When are tests of controls required to be performed?

When the auditor intends to rely on the operating effectiveness of controls to reduce substantive testing, or when substantive procedures alone cannot provide sufficient appropriate evidence (e.g., highly automated processing with little documentary evidence).

What is the difference between a Type I and Type II error in attribute (controls) sampling?

Type I (risk of assessing control risk too high / underreliance) leads to inefficiency; Type II (risk of assessing control risk too low / overreliance) leads to ineffectiveness because the auditor relies on controls that are not effective.

What two sampling risks affect substantive tests of details?

Risk of incorrect rejection (affects efficiency) and risk of incorrect acceptance (affects effectiveness — the more serious risk because it can lead to an incorrect audit opinion).

In attribute sampling, how is the sample deviation rate compared to thresholds to reach a conclusion?

The auditor computes the upper deviation rate (sample deviation rate plus allowance for sampling risk) and compares it to the tolerable deviation rate; if the upper deviation rate does not exceed the tolerable rate, the control can be relied upon.

What three factors increase the required sample size in attribute sampling?

A higher expected population deviation rate, a lower tolerable deviation rate, and a lower acceptable risk of overreliance (higher desired confidence) each increase sample size.

What are the four basic analytical procedure techniques, and at which audit phases are analytics required?

Trend analysis, ratio analysis, reasonableness/regression, and common-size (vertical) analysis. Analytical procedures are required during risk assessment (planning) and during the overall final review; they are optional as substantive procedures.

How does data analytics enhance substantive testing compared with traditional sampling?

Data analytics can test 100% of a population (full-population testing) to identify outliers, anomalies, and exceptions, improving precision and the auditor's ability to detect misstatements relative to testing only a sample.

What is the positive versus negative confirmation, and when may negatives be used?

A positive confirmation asks the recipient to respond whether or not they agree; a negative confirmation asks for a response only if they disagree. Negatives may be used only when RMM is low, controls are effective, many small homogeneous balances exist, and a low exception rate is expected.

Why are external confirmations considered strong audit evidence, and which assertion do accounts receivable confirmations primarily test?

They are obtained directly by the auditor from independent third parties, increasing reliability. AR confirmations primarily test the existence assertion (not completeness or valuation/collectibility).

What should the auditor do when no response is received to a positive confirmation request?

Send second (and possibly third) requests, and for remaining nonresponses perform alternative procedures such as examining subsequent cash receipts, shipping documents, and sales invoices to obtain evidence about the balance.