Practice Auditing & Attestation (AUD) questions for the Certified Public Accountant Exam. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1medium
An auditor is assessing audit risk for a client that recently entered a new line of business with complex revenue recognition terms. Select all that apply regarding the audit risk model and its components in this scenario.
- A.If inherent risk increases, the auditor must reduce detection risk to maintain the same level of audit risk.✓
- B.Control risk is set by the auditor based on the results of substantive testing.
- C.Detection risk is the only component of audit risk that the auditor can directly control.✓
- D.Audit risk can be eliminated entirely if the auditor performs sufficient substantive procedures.
- E.A higher inherent risk assessment for the new revenue stream would typically require a lower acceptable detection risk.✓
Correct answer: A, C, E
The audit risk model (AR = IR × CR × DR) shows that if inherent risk rises, detection risk must be lowered to keep overall audit risk at an acceptably low level (A and E are correct). Detection risk is the only component the auditor directly controls through the nature, timing, and extent of audit procedures (C is correct). Control risk is assessed based on the client's internal controls and the results of tests of controls—not substantive testing—so B is incorrect. Audit risk can never be eliminated entirely; auditors provide reasonable, not absolute, assurance, making D incorrect.
Question 2medium
During the audit of accounts receivable, the auditor sends positive confirmations to a sample of customers. Several customers do not respond after two follow-up requests. Select all that apply regarding the appropriate actions the auditor should take.
- A.The auditor may perform alternative procedures such as examining subsequent cash receipts to obtain sufficient evidence for non-responding accounts.✓
- B.The auditor should automatically switch to negative confirmations for all non-responding accounts.
- C.The auditor should consider whether non-responses indicate a systematic bias that could affect the audit conclusion.✓
- D.Examining shipping documents and sales invoices may serve as alternative procedures for non-responses.✓
Correct answer: A, C, D
When customers do not respond to positive confirmation requests, GAAS requires the auditor to perform alternative procedures to obtain sufficient appropriate evidence (A is correct). Acceptable alternative procedures include examining subsequent cash receipts, shipping documents, and sales invoices to corroborate the existence and valuation of those receivables (D is correct). The auditor must also assess whether the pattern of non-responses represents a bias—for example, if disputed or fictitious balances are systematically not confirmed—that could affect the overall audit conclusion (C is correct). Switching to negative confirmations for non-responding accounts is not an appropriate response and does not provide evidence, making B incorrect.
Question 3medium
An auditor is planning to use attribute sampling to test a client's internal control over cash disbursements—specifically, whether all disbursements over $5,000 are properly approved. Select all that apply regarding attribute sampling in this context.
- A.The auditor must establish a tolerable deviation rate before selecting the sample.✓
- B.If the sample deviation rate exceeds the tolerable deviation rate, the auditor should increase the assessed level of control risk.✓
- C.Attribute sampling in this context is used to estimate the dollar amount of misstatement in the cash disbursements population.
- D.A lower tolerable deviation rate will generally require a larger sample size to achieve the desired level of assurance.✓
- E.The expected deviation rate used in planning affects the required sample size.✓
Correct answer: A, B, D, E
Before performing attribute sampling, the auditor must define the tolerable deviation rate—the maximum deviation rate from the control procedure that the auditor is willing to accept (A is correct). If the observed sample deviation rate exceeds the tolerable rate, the control cannot be relied upon, and the auditor must increase assessed control risk and likely expand substantive procedures (B is correct). A lower tolerable deviation rate means the auditor requires greater precision, which demands a larger sample size (D is correct). The expected population deviation rate also directly influences sample size—a higher expected rate requires a larger sample to achieve the same confidence level (E is correct). Attribute sampling measures the rate of control deviations, not dollar amounts of misstatement; monetary measurement is the purpose of classical variables or MUS sampling, making C incorrect.
Question 4medium
A CPA firm is engaged to perform a review engagement of the financial statements of a non-public company under SSARS. Select all that apply regarding the nature and scope of a review engagement compared to an audit.
- A.A review provides limited assurance that no material modifications are needed for the financial statements to conform with the applicable financial reporting framework.✓
- B.The primary procedures in a review consist of analytical procedures and inquiries of management.✓
- C.A review requires the auditor to obtain an understanding of internal controls and test those controls.
- D.A review engagement results in a higher level of assurance than an audit engagement.
- E.The CPA must maintain independence when performing a review engagement under SSARS.✓
Correct answer: A, B, E
A review engagement under SSARS provides limited (negative) assurance, expressed as nothing coming to the accountant's attention indicating material modification is needed—as opposed to the reasonable (positive) assurance provided by an audit (A is correct). The primary procedures in a review are analytical procedures and inquiries of management and others, without the extensive evidence-gathering required in an audit (B is correct). Independence is required for review engagements under SSARS; it is not required only for compilation engagements where the accountant discloses the lack of independence (E is correct). A review does not require obtaining an understanding of internal controls or testing controls—those are audit-specific requirements—making C incorrect. A review provides less assurance than an audit, not more, making D incorrect.
Question 5medium
During the planning phase of an audit, an auditor calculates an overall materiality of $500,000 for a manufacturing client. The auditor sets performance materiality at $375,000 and a clearly trivial threshold of $25,000. A misstatement of $30,000 is discovered in the repairs and maintenance expense account. How should the auditor treat this misstatement?
- A.Ignore it because it is below performance materiality and therefore not significant.
- B.Immediately require a financial statement adjustment because it exceeds the clearly trivial threshold.
- C.Accumulate it with other identified misstatements and evaluate the aggregate effect on the financial statements.✓
- D.Disregard it because it is below overall materiality and has no impact on the audit opinion.
Correct answer: C
A misstatement that exceeds the clearly trivial threshold ($25,000) must be accumulated with all other identified misstatements throughout the audit, even if it falls below performance materiality ($375,000). The auditor evaluates whether the aggregate of uncorrected misstatements is material to the financial statements as a whole. Option A is incorrect because exceeding the clearly trivial threshold means it cannot be ignored. Option B is incorrect because exceeding the clearly trivial threshold alone does not require an automatic adjustment — it requires accumulation and evaluation. Option D is incorrect because misstatements above the clearly trivial threshold must be tracked regardless of their relationship to overall materiality.
Question 6medium
An auditor is evaluating evidence gathered during the audit of a publicly traded company. Which of the following sources of audit evidence would be considered MOST reliable under PCAOB standards?
- A.A written representation letter from the client's CFO confirming that all liabilities have been recorded.
- B.An oral confirmation from the client's accounts payable manager regarding the existence of a major vendor balance.
- C.A schedule prepared by the client's controller reconciling the general ledger cash balance to the bank statement.
- D.A bank confirmation received directly from the client's bank confirming the year-end cash balance.✓
Correct answer: D
Evidence obtained directly from an independent external source — such as a bank confirmation received directly by the auditor from the bank — is considered highly reliable because it is both from a knowledgeable independent party and obtained directly by the auditor rather than through the client. Option A (management representation letter) is from an internal source and is among the least persuasive forms of evidence. Option B is unreliable because it is oral and from an internal client employee, lacking the independence of an external source. Option C is a client-prepared document and therefore less reliable since it originates internally and could be manipulated. The combination of external source and direct receipt makes the bank confirmation the most reliable.
Question 7medium
During an audit of a manufacturing company, the auditor identifies that the client has significant transactions with a subsidiary in which the CEO holds a 40% personal ownership stake. The transactions are recorded at amounts that appear favorable to the subsidiary. Which of the following best describes the auditor's responsibility regarding these transactions?
- A.The auditor should obtain sufficient appropriate evidence that the transactions are disclosed in accordance with GAAP and evaluate whether they are conducted at arm's length or if the financial statements require additional disclosure.✓
- B.The auditor should immediately withdraw from the engagement because the related party transactions represent an impairment of independence.
- C.The auditor has no special responsibility for related party transactions beyond normal audit procedures, since GAAP requires management to identify and disclose them.
- D.The auditor should issue a qualified opinion solely because related party transactions exist and involve the CEO's personal financial interests.
Correct answer: A
Related party transactions require special scrutiny because they may not be conducted on terms equivalent to arm's-length transactions. The auditor must obtain sufficient appropriate evidence that these transactions are properly identified, accounted for, and disclosed in accordance with GAAP (ASC 850). The auditor should evaluate whether the terms are reasonable and whether financial statement disclosures are adequate. Option B is incorrect because the client's related party transactions do not impair the auditor's independence — it is the auditor's own relationships that affect independence. Option C is incorrect because auditing standards impose heightened procedures for related party transactions beyond normal procedures. Option D is incorrect because the mere existence of related party transactions does not require a qualified opinion — only inadequate disclosure or misstatement would trigger a report modification.
Question 8medium
During the planning phase of an audit, an auditor calculates that the prior year's gross profit margin was 42% while the current year's is 31%. Management attributes this to increased raw material costs. Which auditor action best reflects the appropriate use of analytical procedures at this stage?
- A.Issue a qualified opinion because the fluctuation exceeds tolerable misstatement.
- B.Identify this as a risk area requiring corroborating evidence and adjust the audit plan to include expanded substantive testing of cost of goods sold.✓
- C.Accept management's explanation and document it without further procedures, since analytical procedures are only required in the final review stage.
- D.Replace tests of controls with additional analytical procedures because the fluctuation is already identified.
Correct answer: B
Analytical procedures during planning are used to identify unusual fluctuations that may represent risks of material misstatement, prompting the auditor to modify the nature, timing, and extent of further audit procedures. A significant gross profit decline warrants investigation and expanded substantive testing of cost of goods sold. Option A is incorrect because analytical procedures alone do not support an audit opinion modification. Option C is wrong because accepting an explanation without corroboration violates professional skepticism, and analytical procedures are required in both planning and the final review stage. Option D is incorrect because identifying a risk area increases—not replaces—the need for controls testing and substantive procedures.
Question 9medium
A company's controller, who is also responsible for approving vendor invoices, initiates and approves a series of payments to a fictitious vendor she created. Which element of the fraud triangle best explains why the internal control environment allowed this scheme to persist?
- A.Rationalization, because the controller convinced herself the payments were legitimate business expenses.
- B.Motive, because the controller had personal financial pressures driving the need for additional income.
- C.Opportunity, because the lack of segregation of duties allowed her to both initiate and approve payments without independent review.✓
- D.Rationalization, because management had not implemented a formal code of conduct.
Correct answer: C
The fraud triangle consists of opportunity, motive (pressure), and rationalization. In this scenario, the control weakness that enabled the fraud—the controller's ability to both initiate and approve payments without independent oversight—represents opportunity. Segregation of duties is a key preventive control that would have reduced this opportunity. Option A and D describe rationalization, which relates to the perpetrator's justification for committing fraud, not the control failure. Option B describes motive/pressure, which may explain why the controller wanted to commit fraud but does not explain why the internal control environment allowed it to persist.
Question 10medium
A CPA firm performs the external audit for a publicly traded company. The audit engagement partner's spouse holds 500 shares of the client's stock, valued at $3,000. Under SEC independence rules, how does this situation affect the firm's independence?
- A.Independence is not impaired because the spouse's investment is immaterial relative to the client's total shares outstanding.
- B.Independence is not impaired as long as the partner recuses herself from all significant audit decisions involving valuation of equity.
- C.Independence is impaired only if the value of the shares exceeds $10,000, which is the SEC's threshold for immediate family financial interests.
- D.Independence is impaired because the spouse is a covered person's immediate family member with a direct financial interest in the audit client.✓
Correct answer: D
Under SEC independence rules, a 'covered person' includes the engagement partner, and the immediate family members (including a spouse) of covered persons are also subject to independence restrictions.Adirect financial interest—such as owning shares of the audit client—held by the spouse of an engagement partner impairs independence regardless of the dollar amount, because materiality is not a threshold for direct financial interests. Option A is incorrect because the size of the investment relative to the client does not cure an impairment of a direct financial interest. Option B is incorrect because recusal does not resolve a financial interest impairment under SEC rules. Option C is incorrect; there is no $10,000 threshold for direct financial interests of covered persons' immediate family members.