Home / CPA Course

CPA AUD notes · Auditing and Attestation

How auditors plan, gather evidence and report. Judgment heavy, very little math. The exam is 4 hours with 78 multiple choice questions and 7 task-based simulations.

Blueprint areas

• Area I. Ethics, Professional Responsibilities and General Principles
• Area II. Assessing Risk and Developing a Planned Response
• Area III. Performing Further Procedures and Obtaining Evidence
• Area IV. Forming Conclusions and Reporting

Chapters

1. Ethics and independence under the AICPA Code. Principles and rules of the Code; integrity and objectivity; confidentiality, including when using third party tools and AI; the conceptual framework; threats and safeguards; independence
2. Independence rules of the SEC, PCAOB, GAO and DOL. Extra rules for issuer audits; prohibited nonaudit services; partner rotation; Yellow Book independence; DOL rules for employee benefit plan audits
3. Professional skepticism and professional judgment. A questioning mind; auditor biases such as anchoring and confirmation; threats, incentives and judgment shortcuts
4. Types of engagements: nature, scope and objectives. Audits of issuers and nonissuers; integrated audits; Yellow Book and single audits; attestation, review, compilation and preparation engagements
5. Accepting the engagement and the engagement letter. Preconditions for an audit; acceptance and continuance; talking to the predecessor auditor; changing the type of engagement; the engagement letter
6. Engagement documentation. What sufficient documentation contains; the experienced auditor test; assembly and retention periods for AICPA and PCAOB audits
7. Communicating with management and those charged with governance. Planned scope and timing; significant findings; deficiencies, significant deficiencies and material weaknesses; timing and form of the communication
8. Audit and assurance quality. A firm's system of quality management; engagement partner duties; engagement quality review. PCAOB QC 1000 becomes testable January 1, 2027
9. Planning: overall strategy and the engagement plan. Overall engagement strategy; the detailed plan; time budgets and client request lists; changes from the prior year
10. Understanding the entity and its environment. Supply and demand, elasticity, marginal cost and revenue; business cycles and economic indicators; industry and regulatory factors; SOX governance duties; the nature of the entity, including its use of AI
11. Internal control: COSO, the control environment and IT general controls. COSO purpose, objectives, limits, five components and 17 principles; entity-level controls; IT general controls over access, change and operations
12. Business processes, walkthroughs and the IT environment. Significant processes and data flows; walkthroughs and flowcharts; ERP and cloud; IT applications; automated and manual controls; design and implementation
13. Service organizations, control limits and management override. SOC 1 versus SOC 2; using a SOC 1 Type 2 report; inherent limits of internal control; the risk of management override
14. Materiality and performance materiality. Materiality for the statements as a whole; qualitative factors; benchmarks; lower levels for particular items; performance materiality and tolerable misstatement
15. Assessing and responding to the risk of material misstatement. Fraud pressures, incentives and opportunities; inherent and control risk at the assertion level; overall responses; tests of controls; substantive procedures; team discussion; using data analytic outputs
16. Using the work of others. Internal audit; IT auditors; the auditor's specialist and management's specialist; component auditors and referred-to auditors
17. Special risk areas at the planning stage. Laws and regulations with direct and indirect effects; accounting estimates and management bias; related parties and significant unusual transactions; when a single audit is required
18. Working with data. Relational databases, keys and normalization; measurement scales; data extraction requests; cleaning and transforming data; testing reliability of data, including AI prepared schedules; data analytics
19. Sufficient appropriate evidence. Sources of evidence; relevance and reliability; corroborating and contradictory information; concluding on sufficiency
20. Audit sampling. Purpose of sampling; choosing the population; attribute, variables and monetary unit sampling; projecting results to the population
21. Audit procedures: tests of controls, tests of details and analytics. Observation, inspection, recalculation, reperformance and inquiry; interview follow-up; analysing exceptions; substantive and final analytical procedures
22. External confirmations. Positive and negative confirmations; electronic confirmations and intermediaries; exceptions, nonresponses and alternative procedures
23. Matters that need special consideration. Accounting estimates and fair value; investments in securities; inventory observation and inventory held by others; litigation and lawyer letters; going concern; testing federal awards in a single audit
24. Misstatements and internal control deficiencies. Summary of corrected and uncorrected misstatements; effect on the statements; effect on ICFR; classifying deficiencies
25. Written representations and subsequent events. The representation letter; procedures to find subsequent events; adjust or disclose; subsequently discovered facts and the auditor's report
26. Audit reports and opinions. Forming an opinion; unmodified, qualified, adverse and disclaimer; emphasis of matter and other matter paragraphs; key and critical audit matters; form and content of the report
27. Reporting on internal control over financial reporting. The integrated audit; material weakness and the adverse opinion; separate or combined reports; report modifications
28. Attestation reports. Assertion-based and direct examinations; reviews; agreed-upon procedures; form and content of each report
29. Preparation, compilation and review engagements. SSARS preparation without a report; the compilation report; the review report and limited assurance
30. Reporting on compliance. Compliance with contracts or regulations in connection with an audit; compliance attestation; internal control over compliance
31. Other reporting considerations. Comparatives and consistency; other information; interim reviews; supplementary information; Yellow Book and single audit reports; special purpose frameworks
32. Report library: complete reports for every case. Unmodified, qualified, adverse and disclaimer reports in full; going concern; emphasis-of-matter and other-matter; comparatives and updated opinions; reference to other auditors; dual dating; issuer report with critical audit matters; internal control report; special purpose framework; review, compilation, examination and agreed-upon procedures reports