Auditing and Attestation (AUD) CPA Exam Study Guide

Audit Reports & Standards

Professional Standards and Guidelines

Standard / Guideline	Abbreviation	Standard-Setting Body	Application	Description
Statements on Auditing Standards	SAS	AICPA	Private (nonissuer) Audits	Provide GAAS for nonissuers, and guidance for other services.
PCAOB Auditing Standards	PCAOB AS	PCAOB	Public (issuer) Audits	Provide GAAS for issuers and guidance for other services.
Generally Accepted Government Auditing Standards	GAGAS	Government Accountability Office (GAO)	Government Audits	Provide guidance for audits of government organizations.
Statements on Standards for Attestation Engagements	SSAE	AICPA	Attestation Engagements	Provide guidance for attestation engagements (Examination, review, agreed-upon procedures).
Statements on Standards for Accounting and Review Services	SSARS	AICPA	Private (nonissuer) Unaudited	Provide guidance for unaudited financial statements or unaudited financial info.

Types of Audit Opinions

The type of opinion issued depends on the materiality and pervasiveness of any misstatements (GAAP issues) or scope limitations (GAAS issues).

Issue Type	Material but NOT Pervasive	Material AND Pervasive
GAAP Issue (Financial Statement Problem)	Qualified Opinion	Adverse Opinion
GAAS Issue (Scope Limitation)	Qualified Opinion	Disclaimer of Opinion
No Issues	Unmodified (Unqualified) Opinion

Specific Exam Scenarios

Issue Category	Scenario Description	Resulting Opinion Modification
GAAP Departure (Accounting Issue)	Omission of Statement of Cash Flows: Omission of a required basic financial statement. Inappropriate Accounting Principle: Immediate expensing of major capital assets; failure to capitalize finance leases under ASC 842. Unreasonable Estimate: Materially understated Allowance for Credit Losses (CECL) or unsupported valuation models. Inadequate Footnote Disclosure: Omission of going concern footnote or omitted related-party disclosures.	Qualified Opinion ("Except for") if material but NOT pervasive. Adverse Opinion ("Do not present fairly") if material AND pervasive.
GAAS Scope Limitation (Audit Evidence Issue)	Management Representation Refusal: Management refuses to sign or provide the written Management Representation Letter (always leads to Disclaimer or Withdrawal). Legal Inquiry Refusal: Management refuses to allow the auditor to communicate with client's legal counsel. Circumstance Limitation: Destruction of accounting records by fire/flood; unable to observe physical inventory count with no alternative procedures possible. Client Restriction: Management refuses to permit external confirmation of accounts receivable or bank balances.	Qualified Opinion ("Except for possible effects") if material but NOT pervasive. Disclaimer of Opinion ("Do not express an opinion") if material AND pervasive or client-imposed.

Going Concern Assessment

Auditors and management evaluate whether conditions or events raise substantial doubt about the entity's ability to continue as a going concern for a reasonable period of time:

FASB ASC 205-40 (U.S. GAAP - Issuers & Nonissuers): One year after the date the financial statements are issued (or available to be issued).
AICPA AU-C 570 (GAAS - Nonissuers): Adopts the timeframe of the applicable reporting framework (one year after issuance date under FASB).
PCAOB AS 2415 (Auditing - Issuers): Evaluates a period not to exceed one year beyond the balance sheet date, while also assessing management's GAAP evaluation (one year from issuance).
GASB Statement 56 (Governmental): One year beyond the date of the financial statements, plus consideration of events occurring shortly thereafter.

Conditions and Events Indicating Substantial Doubt

Authoritative Category	Examples of Adverse Conditions (AU-C 570 / AS 2415 / ASC 205-40)
Negative Trends	Recurring operating losses, working capital deficiencies, negative cash flows from operations, adverse financial ratios.
Other Indications of Financial Difficulties	Default on loan agreements, arrearages in dividends, denial of standard trade credit, debt restructuring.
Internal Matters	Work stoppages/labor difficulties, substantial dependence on a single project, uneconomic long-term commitments.
External Matters	Legal proceedings, loss of a key franchise/license/patent, loss of a principal customer, new legislation, uninsured catastrophes.

graph TD A["Identify Conditions & Events"] --> B{"Substantial Doubt Exists?"} B -->|No| C["Standard Unmodified Report
No going concern modification"] B -->|Yes| D["Evaluate Management's Mitigation Plans"] D --> E{"Do plans alleviate doubt?"} E -->|Yes| F["Management discloses in F/S notes
Auditor issues Unmodified Opinion"] E -->|No| G["Unmodified Opinion with:
• AICPA: 'Substantial Doubt...' section
• PCAOB: Explanatory paragraph"] classDef clean fill:#e8f5e9,stroke:#2e7d32,color:#1b5e20; classDef notice fill:#fffde7,stroke:#fbc02d,color:#f57f17; classDef warning fill:#ffebee,stroke:#c62828,color:#b71c1c; class C clean; class F notice; class G warning;

Predecessor & Successor Auditor Responsibilities

Pre-Acceptance Inquiries vs. Post-Acceptance Workpaper Review

Communication between the successor and predecessor auditor is mandatory for all financial statement audits. The successor must obtain the prospective client's permission before initiating contact.

Mandatory Inquiries BEFORE Acceptance (Client Consent Required)	Procedures AFTER Acceptance (Engagement Formally Accepted)
1. Management Integrity: Information regarding the integrity of management and governance.	Workpaper Inspection: Review predecessor's audit working papers (audit planning, risk assessment, internal control testing, audit results, and contingencies).
2. Disagreements: Disagreements with management regarding accounting principles, auditing procedures, or other significant matters.	Opening Balances: Obtain sufficient appropriate audit evidence regarding whether opening balances contain material misstatements.
3. Governance Communications: Communications to governance regarding fraud, noncompliance (illegal acts), and internal control deficiencies.	Consistency of Accounting: Verify that accounting policies reflected in opening balances have been consistently applied in the current period.
4. Reasons for Change: The predecessor's understanding of the specific reasons for the change in auditors.	Note: Predecessor's workpapers alone do NOT relieve the successor of performing necessary opening balance audit procedures.
5. Related Parties & Unusual Transactions: Predecessor's understanding of significant unusual transactions and related-party relationships.

Client Refusal Rule: If the client refuses to authorize communication with the predecessor auditor, the successor auditor must inquire as to the reasons for refusal and carefully consider whether to accept or reject the engagement.

Prior-Period Reporting Procedures (Non-presented vs. Reissued)

Successor Auditor Requirements (When Predecessor's Report is NOT Presented)	Predecessor Auditor Procedures (Before Reissuing Prior-Period Report)
State prior-period F/S was audited by a predecessor auditor (unnamed)	Read the current year financial statements
Indicate the type of opinion expressed & reason for modification	Compare the prior-period vs. current year financial statements
Specify the nature of any Emphasis-of-Matter or Other-Matter paragraphs	Obtain a representation letter from the successor auditor
State the date of the predecessor audit report	Obtain a representation letter from management

Subsequent Discovery of Facts: Client Refusal Protocol

If facts become known to the auditor after the report release date that would have affected the audit report had they been known, and management refuses to revise the financial statements:

Action Required	Professional Implementation
1. Disassociate Audit Report	Notify client management and those charged with governance that the audit report must no longer be associated with the financial statements.
2. Alert Regulatory Agencies	Notify regulatory agencies having jurisdiction over the entity (e.g., SEC, state insurance/banking regulators) that the report should not be relied upon.
3. Alert Relying Parties	Notify persons known to be relying, or likely to rely, on the financial statements that the auditor's report is no longer valid.

Five Mandatory Elements for Reporting a Changed Prior-Period Opinion

Required Disclosure Element	Mandatory Paragraph Disclosure Requirements
1. Prior Report Date	The specific date of the auditor's previous audit report.
2. Prior Opinion Type	The type of opinion previously expressed on the prior-period financial statements.
3. Reason for Prior Opinion	The specific substantive reasons why the previous opinion was issued (e.g., GAAP departure).
4. Subsequent Changes Occurred	The specific events, restatements, or changes that have occurred since the previous report.
5. Statement of Different Opinion	An explicit affirmative statement that the auditor's "opinion on the prior-period financial statements is different from the previous opinion".

Subsequent Events: Auditor Responsibilities & Reporting

The auditor has an active responsibility to inquire about events occurring between the balance sheet date and the date of the auditor's report.

Auditor Procedures

Examine the most recent interim F/S and compare them with the audited F/S.
Inquire of legal counsel, management, and those charged with governance.
Review minutes of shareholders, directors, and other meetings.
Review post-balance sheet transactions.
Obtain a representation letter from management.

Types of Subsequent Events

graph TD A["Subsequent Event Identified (Between B/S Date & Report Date)"] --> B{"Did the condition exist at the Balance Sheet date?"} B -->|Yes| C["Type 1 Event"] B -->|No| D["Type 2 Event"] C --> E["Recognize Journal Entry & Disclose"] D --> F["Disclosure Only (No Adjustment)"]

Example: Type 1 Event Adjustment

If a lawsuit originating before the balance sheet date is settled for a different amount before the report release date, the F/S must be adjusted:

Settlement of Litigation (Type 1 Event)

Loss on Litigation$X,XXX

Estimated Liability for Litigation$X,XXX

To adjust liability for post-balance sheet settlement originating from a pre-balance sheet condition.

Reissuance vs. Revised Financial Statements

Item	SEC Filers	Non-SEC Filers
Cutoff Date	Issue Date	Available-for-issue Date
Disclose Cutoff Date?	No	Yes
Reissuance of F/S	Do not recognize events that occurred between the original issue date and the reissue date

Report Modifications by Section

Structural modifications to the auditor's report when expressing a Qualified, Adverse, or Disclaimer of Opinion.

Report Section	Standard Baseline (Unmodified)	Qualified	Adverse	Disclaimer
Title & Addressee	"Independent Auditor's Report" addressed to those charged with governance	—	—	—
Introductory Sentence	Identifies entity, F/S audited, and period covered	—	—	"We were engaged to audit" (replaces "we have audited")
Opinion	"F/S present fairly, in all material respects"	"Except for" the matter described in the Basis paragraph	F/S do not present fairly	"We do not express an opinion"
Basis for Opinion	States compliance with GAAS/PCAOB; confirms independence and sufficient evidence	Basis for Qualified: describes the departure or scope limitation	Basis for Adverse: describes the GAAP departure	Basis for Disclaimer: describes scope limitation; PCAOB: may omit this section entirely
KAM / CAM	Mandatory for issuers (CAM); optional for nonissuers (KAM)	—	Excluded	Excluded
Management's Responsibilities	F/S preparation, ICFR, going concern assessment	—	—	— (Never modified)
Auditor's Responsibilities	Obtain reasonable assurance; describes audit scope and procedures	—	—	Reduced scope language: omits "reasonable assurance" and "sufficient appropriate evidence"
Signature, Date & Address	Firm signature, date of sufficient appropriate evidence, city/state	—	—	—

Note: Substantive justifications for modification belong in the Basis for Opinion section, never in EOM/OM paragraphs.

Abbreviations: EOM = Emphasis of Matter • OM = Other Matter • KAM = Key Audit Matters (Nonissuer) • CAM = Critical Audit Matters (Issuer)

Standard Unmodified Audit Report Sequencing (Nonissuer vs. Issuer)

The structural layout and required language of an unmodified audit report follow strict standard-setting requirements:

Nonissuer Report (AICPA)	Issuer Report (PCAOB)
1. Title: "Independent Auditor's Report"	1. Title: "Report of Independent Registered Public Accounting Firm"
2. Addressee: Board of Directors & Shareholders (Never Management)	2. Addressee: Shareholders and the Board of Directors
3. Opinion Section: Identifies entity, statements audited, dates, and expresses opinion ("present fairly, in all material respects...").	3. Opinion on the Financial Statements Section: Identifies entity, statements audited, dates, and expresses opinion.
4. Basis for Opinion Section: Conducted in accordance with GAAS; independence & ethical compliance; evidence is sufficient and appropriate.	4. Basis for Opinion Section: Responsibilities of management and auditor; registered with PCAOB; reasonable assurance; test-basis evidence; estimate evaluation.
5. Key Audit Matters (KAM): Optional (included only if engaged by client).	5. Critical Audit Matters (CAM): Mandatory for all issuers (except EGCs).
6. Responsibilities of Management: GAAP preparation; design, implementation, maintenance of IC; going concern evaluation.	(Integrated within the Basis for Opinion section of the PCAOB report)
7. Auditor's Responsibilities: Reasonable assurance; professional skepticism; risk assessment; internal control evaluation without expressing an opinion; evaluating estimates.
8. Signature, Office Location, & Report Date: Firm signature, City/State of issuing office, Date of audit report.	6. Signature, Office Location, Report Date, & Auditor Tenure: Firm signature, City/State, Report Date, and Mandatory Statement of Auditor Tenure ("We have served as the Company's auditor since [Year]").

Additional Audit Report Communications

Critical Audit Matters (CAM) vs. Key Audit Matters (KAM)

Dimension	Key Audit Matters (KAM — Nonissuers)	Critical Audit Matters (CAM — Issuers)
Applicability	Nonissuers (Private Companies). Optional unless explicitly engaged by client.	Issuers (Public Companies). Mandatory for all issuers (except Emerging Growth Companies and investment companies).
Definition	Matters communicated with those charged with governance that were of most significance in the audit of the current period.	Matters communicated to the audit committee that relate to material accounts/disclosures AND involved especially challenging, subjective, or complex auditor judgment.
Required Disclosures for Each Matter	Description of why the matter was significant. How the matter was addressed in the audit. Reference to the relevant financial statement accounts or disclosures.	Identification of the CAM. Principal considerations leading to determination as a CAM. How the CAM was addressed in the audit. Reference to the relevant financial statement accounts/disclosures.
Prohibitions	Prohibited when issuing an ADVERSE or DISCLAIMER of Opinion.	Not applicable when issuing an ADVERSE or DISCLAIMER of Opinion.

Emphasis-of-Matter (EOM) vs. Other-Matter (OM) Paragraphs

Additional explanatory paragraphs are added to the audit report without modifying the underlying audit opinion:

Paragraph Type	Core Rule & Definition	Mandatory Use Circumstances
Emphasis-of-Matter (EOM)	Refers to a matter that is appropriately presented and disclosed in the financial statements that, in the auditor's judgment, is of fundamental importance to users' understanding.	Substantial Doubt About Going Concern: Titled paragraph explicitly using "substantial doubt" and "going concern". Justified Change in Accounting Principle: Material impact on comparability. Special Purpose Framework: Financial statements prepared on Cash, Tax, Regulatory, or Contractual basis. Subsequent Discovery of Facts: Leading to a change in prior-period opinion.
Other-Matter (OM)	Refers to a matter OTHER than those presented or disclosed in the financial statements that is relevant to users' understanding of the audit, auditor responsibilities, or the audit report.	Restricting Report Distribution: Required for contractual or regulatory basis statements. Prior Period Audited by Predecessor: Predecessor report not reissued. Comparative Statements with Unaudited Periods: Prior period compiled/reviewed. Supplementary Information Reporting: In relation to financial statements as a whole.

Special Purpose Framework Reporting

When auditing financial statements prepared in accordance with a Special Purpose Framework (Cash Basis, Tax Basis, Regulatory Basis, or Contractual Basis):

Emphasis-of-Matter Paragraph: Explicitly identify the special purpose framework, refer to the note in the financial statements describing the basis, and state that the basis of accounting differs from GAAP.
Other-Matter Paragraph (Restricting Distribution): Required for Contractual Basis or Regulatory Basis (intended for limited filing) to restrict report distribution strictly to specified intended users.

PCAOB Form AP (Issuer Audits)

For audits of public companies (issuers), the auditor is required to file Form AP (Auditor Reporting of Certain Audit Participants) to increase transparency regarding who performed the audit.

Filing Requirement	PCAOB Regulatory Timeline / Rule
Standard Filing Deadline	Within 35 days after the audit report is filed in a document with the SEC.
Registration Statement Deadline	Within 10 days if the audit report is included in a registration statement.
Required Disclosures	Name of the engagement partner, and the names, locations, and extent of participation of other accounting firms that participated in the audit.

Professional Skepticism & Unconscious Biases

Professional skepticism requires a questioning mind and a critical assessment of audit evidence. Auditors must actively mitigate unconscious biases that can impair professional judgment.

Bias Type	Description & Audit Implication
Anchoring Bias	Relying too heavily on an initial piece of information (the "anchor"). Example: An auditor anchoring on management's initial estimate without developing their own independent expectation.
Confirmation Bias	Seeking or interpreting evidence in a way that confirms preexisting beliefs or expectations, while unconsciously ignoring contradictory evidence.
Overconfidence Bias	Overestimating one's own ability to make accurate assessments of risk or complex accounting judgments.
Availability Bias	Giving undue weight to information that is readily available or easily recalled from memory rather than gathering comprehensive data.

Independence & Ethics

AICPA Independence Impairments

Direct financial interest in client (always impairs independence).
Material indirect financial interest in client.
Close relative with a key position at the client.
Serving as trustee/executor with a financial interest in the client.
Bookkeeping or management roles performed for the client.

Regulatory Independence Rules

Regulatory Body	Key Independence Rules & Prohibitions
PCAOB & SEC	Prohibited services include bookkeeping, IT design, valuation, and legal/expert services. Tax services require Audit Committee pre-approval. Lead/Concurring partners rotate every 5 years (5-year cool-off); other partners every 7 years (2-year cool-off).
GAO (Yellow Book)	Threats to independence evaluated using a conceptual framework. Structural threats arise if the audit organization is located within the audited entity. Non-audit services must not involve performing management responsibilities.
DOL (ERISA)	Independence is impaired if the auditor has any direct financial interest or material indirect financial interest in the plan or the plan sponsor, or if the auditor maintains financial records for the employee benefit plan.

Documentation Requirements

Audit documentation should be sufficient to enable an experienced auditor with no previous connection to the engagement to understand the nature, timing, extent, and results of the procedures performed.

Audit Documentation Dimension	Nonissuer Audits (AICPA)	Issuer Audits (PCAOB)
Documentation Assembly / Completion Window	60 Calendar Days from Report Release Date	45 Calendar Days from Report Release Date
Minimum Retention Period	5 Years from Report Release Date	7 Years from Report Release Date
Modifications After Assembly Window	Documentation must not be deleted or discarded. Additions must record: date added, name of person adding, and reason for addition.	Documentation must not be deleted or discarded. Any changes must be documented in an Engagement Completion Document showing date, person, reason, and effect on conclusions.

SEC / Sarbanes-Oxley Partner Rotation & Employment Cooling-Off Rules

Partner / Employee Category	Maximum Service Period	Mandatory Cooling-Off Period
Lead Audit Partner	5 Consecutive Years	5 Consecutive Years
Concurring (EQR) Review Partner	5 Consecutive Years	5 Consecutive Years
Other Audit Partners	7 Consecutive Years	2 Consecutive Years
One-Year Cooling-Off Period (Employment Rule - SOX 206)	A CPA firm cannot perform an audit of an issuer if a former audit team member is hired by the client as CEO, CFO, Controller, CAO (or equivalent financial reporting oversight role) within the one-year period preceding the start of the audit.

The Basis for Opinion

To issue an unmodified opinion, the auditor must execute a well-planned audit to obtain a reasonable level of assurance, and clearly communicate their methodology in the report.

Key Declarations in the Basis for Opinion (Issuer/PCAOB)

Basis Component	Required Declaration Language
Responsibility	The financial statements are the responsibility of management; the auditor's responsibility is to express an opinion.
Standards	The audit was conducted in accordance with PCAOB standards.
Objective	The auditor must plan and perform the audit to ensure the statements are free of material misstatement.

Communication with Those Charged with Governance

Communication Matter	Form & Timing Requirement
Planned scope and timing of audit	Oral or Written (During the planning phase)
Significant audit findings (estimates, policies, difficulties)	Oral or Written (Typically before report issuance)
Disagreements with management & uncorrected misstatements	Oral or Written (Before report issuance)
Material weaknesses and significant deficiencies in ICFR	In Writing (Within 60 days of the report release date)

Using the Work of Others

The auditor must determine the extent to which they can rely on the work of others to obtain sufficient appropriate audit evidence.

Component / Referred-to Auditors

graph TD A["Group Engagement Partner Evaluates Component Auditor"] --> B{"Assume responsibility for Component Auditor's work?"} B -->|Yes| C["Do NOT make reference in the report"] B -->|No| D["Make reference to Referred-to Auditor"] C --> E["Standard Unmodified Opinion"] D --> F["Modify OPINION and BASIS FOR OPINION sections"] class E unmodified; class F qualified;

Component Auditor Report Modifications

Magnitude Disclosure: State the portion audited by the component auditor (dollar amounts or percentages of total assets and total revenues).
Immaterial Component Modification Rule: If the component auditor's report contains a modified opinion that is immaterial to the group financial statements as a whole, the group auditor issues an unmodified opinion without mentioning the component's modification.

Internal Auditors & Specialists

Role	Evaluation Requirements	Allowed Reliance
Internal Audit Function	Assess Competence, Objectivity, and application of a Systematic and Disciplined Approach.	Can be used for direct assistance or to rely on their work. Cannot be used for areas requiring high professional judgment.
Auditor's Specialist	Assess Competence, Capabilities, and Objectivity.	Used to obtain evidence in complex areas (e.g., valuation). Do NOT refer to the specialist in an unmodified opinion.
Management's Specialist	Assess Competence, Capabilities, and Objectivity, obtain an understanding of their field of expertise, and evaluate the appropriateness of their work as audit evidence.	Treat their work as audit evidence, not as an extension of the audit team.

Quality & Internal Control

System of Quality Management (SQMS)

A CPA firm must have a system of quality management to provide reasonable assurance that the firm and its personnel comply with professional standards and issue appropriate reports.

SQMS Component	Description
Risk Assessment Process	Identify and assess quality risks within the firm.
Governance and Leadership	Establish the "tone at the top" and organizational accountability.
Relevant Ethical Requirements	Ensure independence, integrity, and objectivity across engagements.
Acceptance and Continuance	Evaluate the integrity of client relationships and engagement risks.
Engagement Performance	Maintain standards for supervision, review, and professional consultation.
Resources	Provide necessary human, technological, and intellectual resources.
Information and Communication	Facilitate reliable internal and external communication pipelines.
Monitoring and Remediation	Perform ongoing evaluations and fix identified deficiencies.

The 4 Resource Categories (SQMS 1) & Engagement Quality Reviews (SQMS 2)

Human Resources: Hiring, training, continuing professional education (CPE), competence assessment, and assignment of qualified engagement teams.
Technological Resources: Automated audit tools, Audit Data Analytics (ADA) software, digital workpaper repositories, and IT infrastructure security.
Intellectual Resources: Standardized firm audit methodologies, industry accounting guides, procedural checklists, and technical accounting libraries.
Service Providers: External specialized IT platforms, cloud-based confirmation portals, and third-party valuation/actuarial experts.

SQMS 2 Element	Mandatory Engagement Quality Review (EQR) Requirement
Reviewer Eligibility & Appointment	Must be an objective, technically competent professional who is independent of the engagement team and possesses the requisite authority.
Completion Timing Requirement	The Engagement Quality Review must be completed, and all significant matters resolved, PRIOR to the release of the audit or attestation report.

Engagement Letter Contents

The engagement letter formalizes the arrangement between the auditor and the client. It must include:

Category	Required Elements
Core Objectives	Objective of the audit, Financial Accounting Framework.
Responsibilities	Responsibilities of the Auditor, Responsibilities of Management.
Limitations & Output	Statement that some material misstatements may not be detected, Expected form/content of any reports.
Logistics & Support	Timing of the audit, Arrangements with prior auditor, Use of specialists or internal auditors, Management written representation letter.

Internal Control Framework & Control Activities

Five Components of Internal Control

Component	Description	Key Points
Control Environment	Sets the tone of the organization and encompasses entity-level controls.	Integrity, competence, governance participation, assignment of responsibility, organizational structure, management philosophy, and HR policies.
Risk Assessment	Management's identification of risks relevant to F/S preparation.	Risks generally related to changes, lying, cheating, stealing.
Information & Communication	Methods used to classify and report transactions.	Initiating, authorizing, recording, processing, and reporting transactions. Communicating roles and responsibilities.
Monitoring Activities	Procedures to assess the quality of internal control over time.	Internal audit function, management and supervisory activities, ensuring controls are present and functioning, and other procedures such as mailing customer statements.
Control Activities	Policies and procedures to ensure management objectives are met.	Authorization, segregation of duties, physical security, asset accountability. Designed to prevent/detect errors.

Detailed Control Activities

Control Activity	Description & Application
Segregation of Duties	Ensure no single individual controls all phases of a transaction. Specifically, separate: Authorization, Record Keeping, and Custody of Assets.
IT General Controls (ITGCs)	Policies and procedures that relate to many applications and support the effective functioning of application controls. Includes controls over Program Change Management, Logical/Physical Access, and IT Operations.
Authorization & Approvals	Ensures transactions are valid and executed by appropriate personnel.
Independent Checks & Physical Security	Safeguarding of physical assets, prenumbering of documents, and routine performance reviews to maintain accountability.

IT Department Segregation of Duties & System Roles

IT Functional Role	Assigned Responsibilities	Strict Incompatible Separation Rule
Systems Analysts	Design overall IT system specifications and software architecture.	Programmers and Systems Analysts must NEVER have access to live production databases or execute live computer processing operations.
Application Programmers	Write, debug, and maintain application software code.
Computer Operators	Execute scheduled production runs and manage physical hardware operations.	Must NOT have access to source code or programming tools.
Librarians	Maintain physical and logical custody of program files, libraries, and data tapes.	Must release files only upon authorized change tickets.
Control Group	Log and monitor input/output batches, balance totals, and track data processing errors.	Must operate independently of computer operators and programmers.

Automated Application Controls Hierarchy

1. Input Validation Controls

Check Digits: Mathematical algorithm verifying ID numbers.
Field Format Checks: Enforces numeric/alphabetic restrictions.
Limit / Range Checks: Rejects entries outside predefined limits.
Duplicate Checks: Prevents duplicate invoice numbers.

2. Processing Controls

Automated 3-Way Match: Matches PO, Receiving Report, and Vendor Invoice.
Zero-Balance Tests: Verifies debits equal credits.
Run-to-Run Totals: Verifies complete transaction processing across system stages.

3. Output Controls

Batch Balancing: Reconciles output batch totals to input logs.
Exception Reports: Generates and tracks unresolved errors.
Authorized Distribution: Restricts report distribution to authorized personnel.

Compliance with Laws and Regulations (NOCLAR)

The auditor's responsibility for detecting noncompliance depends on whether the law or regulation has a direct or indirect effect on the financial statements.

Type of Effect	Auditor's Responsibility	Examples
Direct Effect	Must obtain sufficient appropriate evidence regarding material amounts and disclosures. (Same responsibility as for errors/fraud).	Tax laws, pension laws.
Indirect Effect	Must perform specified procedures (inquiry of management and inspection of correspondence) to identify noncompliance that may have a material effect.	Environmental regulations, FDA compliance, antitrust laws, OSHA.

Action Required: If noncompliance is suspected, the auditor must discuss the matter with management at least one level above those involved, and if necessary, those charged with governance.

Communication of Internal Control Deficiencies

1. Financial Statement Audit ONLY

Deficiency Type	Communicate to Management	Communicate to Governance (TCWG)	Timing
Control Deficiency	Yes (orally or in writing)	No	Within 60 days of the report release date
Significant Deficiency	Yes (in writing)	Yes (in writing)
Material Weakness	Yes (in writing)	Yes (in writing)

2. Integrated Audits

Entity / Deficiency	Communicate to Management	Communicate to Audit Committee / TCWG	Timing
Nonissuers
Control Deficiency	Yes (in writing)	No	Within 60 days of report release date
SD / MW	Yes (in writing)	Yes (in writing)	By the report release date
Issuers
Control Deficiency	Yes, in writing (inform audit committee this was done)	No	Prior to the issuance of the auditor's report on internal control
SD / MW	Yes, in writing (inform audit committee this was done)	Yes (in writing)

ICFR Auditor Attestation Exemption (Non-Accelerated Filers)

Non-accelerated public filers (issuers with public equity float held by non-affiliates below $75 Million) are exempt under Dodd-Frank / SOX 404(b) from the requirement to obtain an independent auditor attestation report on Internal Control Over Financial Reporting (ICFR).

Material Weakness Impact on ICFR Opinion

In an integrated audit of ICFR, the presence of even one single Material Weakness at period-end requires the auditor to express an ADVERSE OPINION on Internal Control Over Financial Reporting.

The Top-Down Approach (ICFR Audits)

When performing an integrated audit of internal control over financial reporting (ICFR), the auditor must use a top-down approach to select which controls to test.

Top-Down Level	Auditor Focus & Scope of Testing
1. Financial Statement Level	Begin by evaluating overall risks that are pervasive to the financial statements as a whole.
2. Entity-Level Controls	Evaluate controls that affect the overall environment (e.g., control environment, management override, centralized processing, risk assessment process).
3. Significant Accounts & Assertions	Direct testing to significant accounts, disclosures, and their relevant assertions where a material weakness is reasonably possible.

Evidence & Sampling

Financial Statement Assertions & Testing

Management makes assertions about financial statement elements. The auditor's job is to use specific procedures to test these assertions.

Assertion	Common Audit Procedure	Procedure Example
Existence / Occurrence	Vouching / Physical Inspection	Vouching from the accounting journal back to the original source document, or inspecting physical assets.
Completeness	Tracing	Tracing from the original source document forward to the accounting journal.
Valuation, Allocation & Accuracy	Recalculation / Analytical	Testing mathematical accuracy, evaluating management's estimates, or running depreciation recalculations.
Rights and Obligations	Confirmation / Inspection	Confirming with third parties (e.g., banks) or inspecting deeds/contracts to verify ownership.
Cutoff	Cutoff Procedures	Testing transactions occurring immediately before and after year-end to ensure proper period recognition.
Classification & Understandability	Review / Inquiry	Reviewing F/S drafts to ensure debt is properly split between short and long-term.

Directional Testing: Tracing vs. Vouching

A critical concept for gathering audit evidence. The direction of the test determines which financial statement assertion is being validated.

flowchart LR A["Source Documents"] -->|"Tracing"| B["Accounting Records"] B -->|"Vouching"| A

Testing Direction	Assertion Tested & Risk Addressed
Tracing (Source → Record)	Completeness: Ensures that all transactions that should have been recorded actually were recorded. Primarily guards against understatement of liabilities and expenses.
Vouching (Record → Source)	Existence/ Occurrence: Ensures that all recorded transactions actually occurred and are valid. Primarily guards against overstatement of assets and revenues.

The Audit Risk Model & Fraud Triangle

Audit Risk Model

The risk that the auditor will issue an unmodified opinion on materially misstated financial statements.

$$\mathbf{\text{AR}} = \text{IR} \times \text{CR} \times \text{DR} = \mathbf{\text{RMM}} \times \text{DR}$$

Component	Definition	Determined By
Inherent Risk (IR)	Susceptibility of an assertion to material misstatement assuming no related controls.	Client / Environment
Control Risk (CR)	Risk that a material misstatement could occur and not be prevented/detected by internal controls.	Client's Internal Controls
Detection Risk (DR)	Risk that the auditor's procedures will fail to detect a material misstatement.	Auditor (Nature, Timing, Extent of procedures)

Formula Rearrangement & Substantive Testing Response Matrix

$$\text{Planned Detection Risk (DR)} = \frac{\text{Acceptable Audit Risk (AR)}}{\text{Inherent Risk (IR)} \times \text{Control Risk (CR)}} = \frac{\text{Acceptable Audit Risk (AR)}}{\text{Assessed RMM}}$$

Assessed Risk (IR & CR / RMM)	Planned Detection Risk (DR)	Nature of Substantive Procedures	Timing of Procedures	Extent of Procedures
HIGH Assessed RMM (Controls weak / not relying)	LOW Planned DR (Less risk tolerable)	More effective procedures; more detailed substantive tests; physical inspection & direct external confirmation.	Testing performed primarily at period-end / year-end (eliminating roll-forward risk).	Larger sample sizes; broader scope of testing.
LOW Assessed RMM (Controls tested & effective)	HIGH Planned DR (More risk tolerable)	Less effective / less costly procedures; substantive analytical procedures & internal inquiries.	Testing performed at interim dates with subsequent roll-forward procedures to year-end.	Smaller sample sizes; reduced scope of testing.

The Fraud Triangle

graph TD A["The Fraud Triangle"] A --- B["Incentive / Pressure (Reason to commit fraud)"] A --- C["Opportunity (Lack of effective controls)"] A --- D["Rationalization (Justification of the act)"]

Mandatory Auditor Responses to Fraud & Management Override

Management is uniquely positioned to perpetrate fraud by overriding internal controls. Under professional auditing standards, the auditor must implement overall responses and execute three mandatory management override procedures on 100% of audits:

Mandatory Override Procedure	Specific Audit Execution Requirements
1. Test Journal Entries & Adjustments	Test the appropriateness of journal entries recorded in the general ledger and other adjustments made in the preparation of the financial statements. Specifically focus on: (a) non-standard and manual entries, (b) period-end closing entries, (c) entries made by unexpected personnel, and (d) round-dollar or end-of-period entries.
2. Retrospective Review of Estimates	Perform a retrospective review of significant accounting estimates reflected in prior-year financial statements to identify potential management bias, patterns of optimistic assumptions, and cumulative estimation tendencies.
3. Evaluate Business Rationale	Evaluate the business rationale for significant, unusual, or highly complex transactions outside the normal course of business (e.g., complex non-arm's length related-party contracts, special-purpose vehicles).

Incorporation of Unpredictability into Audit Procedures

In response to fraud risks, the auditor must incorporate elements of unpredictability into the Nature, Timing, and Extent of audit procedures (e.g., performing substantive procedures on unannounced dates or at unexpected locations, selecting balances below the normal testing threshold, testing immaterial accounts, altering sampling techniques).

Materiality in an Audit

Materiality is the magnitude of an omission or misstatement that could reasonably influence the economic decisions of users. The concept is applied throughout the audit phases.

Materiality Level	Definition & Benchmark Application
1. Overall (Planning) Materiality	The maximum amount by which the F/S as a whole could be misstated without affecting user decisions. Typically a percentage of a benchmark (e.g., 5-10% of Pre-tax Income, or 0.5-2% of Total Assets/Revenues).
2. Performance Materiality	Set at less than overall materiality for specific transactions, balances, or disclosures. Acts as a safety buffer to reduce the probability of aggregate undetected misstatements. A lower performance materiality requires more testing.
3. Trivial Misstatements	A threshold far below performance materiality. Misstatements below this amount are considered inconsequential and do not need to be accumulated by the auditor. The designated trivial amount must be documented.

Evaluation of Identified Misstatements

During the audit, misstatements are accumulated and categorized to determine their impact on the financial statements and the required audit opinion.

Type	Definition & Characteristics
Factual Misstatements	Misstatements about which there is no doubt. The exact amount is known (e.g., a mathematical error or a misapplied pricing formula).
Judgmental Misstatements	Differences arising from management's judgments concerning accounting estimates that the auditor considers unreasonable, or the selection of accounting policies that the auditor considers inappropriate.
Projected Misstatements	The auditor's best estimate of misstatements in populations, derived from projecting the misstatements identified in an audit sample to the entire population.

Auditing Accounting Estimates

Accounting estimates (e.g., Allowance for Credit Losses under CECL, Fair Value measurements, Asset Impairments, Warranty Reserves) carry high inherent risk due to subjectivity and measurement uncertainty. The auditor must evaluate three core inputs using three substantive approaches.

The Three Core Inputs of an Accounting Estimate

Core Estimate Input	Auditor Evaluation & Verification Procedures
1. Methods	Evaluate the mathematical validity, GAAP conformity, and theoretical appropriateness of the valuation model or estimation technique. Ensure consistent application with prior periods.
2. Data	Test the accuracy, completeness, and relevance of underlying internal and external data. Reconcile source data to the general ledger and verify external benchmark authenticity.
3. Assumptions	Evaluate the reasonableness of significant management assumptions. Perform sensitivity analyses, test for management bias, and compare against observable economic and industry trends.

Auditor's Three Substantive Approaches for Testing Estimates

Substantive Testing Approach	Audit Procedures & Application
Approach 1: Test Management's Process	Test the controls over estimation, evaluate the methods applied, verify the underlying data integrity, and evaluate the reasonableness of management's significant assumptions and management bias.
Approach 2: Develop Independent Point Estimate or Range	Independently construct an auditor model or range using independent data and assumptions to compare directly against management's recorded point estimate.
Approach 3: Review Subsequent Events & Transactions	Inspect events and transactions occurring after the balance sheet date but prior to the audit report date that confirm or refute the recorded estimate (e.g., subsequent cash collection of a doubtful account).

Audit Evidence

Hierarchy of Evidence (Reliability)

Auditor's Direct Knowledge: Observation, physical inspection, and independent recalculation.
External Evidence: Confirmations and bank statements received directly from third parties.
Internal Evidence: Client-prepared invoices, ledgers, and reports (reliability depends entirely on internal controls).
Oral Evidence: Inquiries and management representations (least reliable, requires corroboration).

Audit Evidence Procedures & Tested Assertions

Audit Procedure	Primary Assertions Tested	Operational Description & Application	Evidence Reliability Tier
Inspection of Tangible Assets	Existence, Valuation & Allocation	Examining physical assets (e.g., inventory, equipment, facilities, title deeds).	Direct Personal (Highest)
Inspection of Records (Vouching)	Existence & Occurrence (Overstatement)	Testing backward from accounting records to source documents (shipping docs, POs).	Internal / External
Inspection of Records (Tracing)	Completeness (Understatement)	Testing forward from source documents (receiving reports) to accounting journals.	Internal / External
Observation	Existence, Completeness	Watching a client process or procedure in real-time (e.g., physical inventory count observation).	Direct Personal (Highest)
External Confirmation	Existence, Rights & Obligations, Cutoff	Direct written response from independent third parties (banks, customers, lenders).	External (High)
Recalculation (Footing)	Valuation & Allocation, Accuracy	Mathematical verification of schedules, trial balances, and depreciation schedules.	Direct Personal (Highest)
Reperformance	All Assertions	Independently executing controls or procedures originally performed by the client.	Direct Personal (Highest)
Analytical Procedures	Completeness, Valuation & Allocation, Existence	Evaluating plausible relationships among financial and non-financial data (ratios, trends, regression).	Internal / External
Inquiry	All Assertions (Requires Corroboration)	Interviews with management, internal auditors, legal counsel, and operating staff.	Oral (Lowest)
Walk-through	Understanding Internal Control	Tracing a single transaction step-by-step from initiation to financial statements.	Direct Personal (Highest)
Cutoff Testing	Cutoff, Completeness, Existence	Reviewing transactions immediately before and after year-end (shipping/receiving).	Internal / External
Reconciliation	Completeness, Valuation & Allocation, Existence	Comparing two independent records (bank reconciliation, subledger to general ledger).	Internal / External
Subsequent Events Review	Valuation & Allocation, Cutoff, Completeness	Reviewing transactions and events through report date to detect material impacts.	Internal / External
Management Representation Letter	All Assertions	Mandatory written statements from management signed as of audit report date.	Internal (Corroborative)

External Confirmations

External confirmation is audit evidence obtained as a direct written response to the auditor from an independent third party (e.g., bank, customer, vendor, lender). The auditor must maintain direct control over the confirmation process at all times.

Confirmation Type	Operational Mechanism	Auditor Assurance & Mandatory Conditions
Positive Confirmation	Recipient is requested to reply directly to the auditor in all cases, either agreeing/disagreeing with the stated balance or filling in a blank form.	High Assurance. Required when individual account balances are large, complex, or assessed RMM is high. Nonresponses require second requests and mandatory alternative substantive procedures.
Negative Confirmation	Recipient is requested to respond only if they disagree with the stated balance. Unreturned requests provide implicit evidence of agreement.	Lower Assurance. Permissible ONLY when ALL 4 conditions are met: 1. Assessed RMM is low and relevant internal controls have been tested as operating effectively. 2. Population comprises a large number of small, homogeneous balances. 3. A very low exception rate is expected. 4. The auditor has no reason to believe recipients will disregard the requests.

Electronic Confirmations & Intermediary Verification

Intermediary Platforms: When using third-party electronic confirmation intermediaries, the auditor must evaluate the security, access controls, and authentication processes of the platform (e.g., reviewing the intermediary's SOC report).
Direct Electronic Responses: For responses received via email or portal, the auditor must verify the authenticity and identity of the sender (e.g., domain verification, telephone callback confirmation with independent directory listings).
Oral Responses & Nonresponses: An oral response does NOT qualify as an external confirmation. For positive nonresponses, the auditor must perform alternative substantive procedures (vouching subsequent cash receipts, examining shipping documents and customer purchase orders).

Audit Sampling & Risk

Sampling Risk Matrix

Test Type	Risk of Incorrect Acceptance (Beta) Impacts Effectiveness	Risk of Incorrect Rejection (Alpha) Impacts Efficiency
Tests of Controls (Attribute)	Assessing Control Risk too LOW	Assessing Control Risk too HIGH
Substantive Testing (Variable)	Incorrect Acceptance of Material Misstatement	Incorrect Rejection of Fairly Stated Balance

Attribute Sampling Decision Rule (Tests of Controls)

In attribute sampling, the auditor evaluates the operating effectiveness of internal controls by computing the Upper Deviation Rate (UDR):

$$\text{Upper Deviation Rate (UDR)} = \text{Sample Deviation Rate} + \text{Allowance for Sampling Risk (ASR)}$$

Statistical Condition	Auditor Conclusion on Control	Impact on Audit Strategy & Detection Risk
UDR ≤ Tolerable Deviation Rate	Rely on Internal Control as Planned	Maintain planned low Control Risk; planned Detection Risk remains high; perform planned substantive testing.
UDR > Tolerable Deviation Rate	Do NOT Rely on Internal Control	Increase assessed Control Risk; decrease planned Detection Risk; expand Nature, Timing, and Extent of substantive testing.

Foundational Statistical Sampling Principles

Normal Distribution Assumption: Populations are assumed to follow a normal bell-shaped distribution governed by the Central Limit Theorem.
Unrestricted Random Selection: Every item in the population must have an equal, known, non-zero probability of selection.
Population Variability: Population standard deviation (σ) measures dispersion. Higher variability directly increases the required sample size in classical variables sampling.

Factors Affecting Sample Size

Factor Increasing	Effect on Sample Size
Desired level of Assurance / Confidence Level	Increase
Expected Misstatement / Expected Deviation Rate	Increase
Tolerable Misstatement / Tolerable Deviation Rate	Decrease
Acceptable Risk of Incorrect Acceptance	Decrease

PPS (Probability-Proportional-to-Size) Calculations

Sampling Interval

$$\frac{\text{Tolerable Misstatement}}{\text{Reliability Factor}}$$

Sample Size

$$\frac{\text{Population Book Value}}{\text{Sampling Interval}}$$

Tainting Percentage

$$\frac{\text{Book Value} - \text{Audited Value}}{\text{Book Value}}$$

Projected Error

$$\text{Sampling Interval} \times \text{Tainting } \%$$

Classical Variables Sampling Formulas

Used in substantive audit testing to estimate population values or total misstatements using three primary statistical methods:

Method	Step 1: Calculate Sample Metric	Step 2: Estimate Total Population (Point Estimate)
Mean-Per-Unit (MPU) Based solely on audited values	$$\text{Audited Mean} = \frac{\sum \text{Audited Values}}{n}$$	$$\text{Point Estimate} = \text{Audited Mean} \times N$$
Ratio Estimation Efficient if errors scale with book value	$$\text{Audited Ratio} = \frac{\sum \text{Audited Values}}{\sum \text{Book Values}}$$	$$\text{Point Estimate} = \text{Audited Ratio} \times \text{Total Book Value}$$
Difference Estimation Used if errors are flat/constant	$$\bar{d} = \frac{\sum (\text{Book} - \text{Audited})}{n}$$	$$\text{Point Estimate} = \text{Total Book Value} - (\bar{d} \times N)$$

Where: n = sample size | N = population item count.

Projected Misstatement Rules

For Mean-Per-Unit & Ratio Estimation

$$\text{Projected Misstatement} = |\text{Total Book Value} - \text{Point Estimate}|$$

For Difference Estimation method

$$\text{Projected Misstatement} = \bar{d} \times N$$

Data Structures & Measurement Scales

A foundational understanding of how data is structured and measured is required before extracting data or performing audit data analytics (ADAs).

Relational Database Components

Component	Definition & Application
Tables (Entities)	Collections of related data organized in rows and columns.
Records & Fields	Records (Rows): Individual data entries. Fields (Columns/Attributes): Specific data categories within a record.
Primary Key	A unique identifier for each record in a table (e.g., Invoice Number or Employee ID).
Foreign Key	A field in one table that links to the primary key of another table, establishing a relational connection.

Data Measurement Scales

Scale Type	Characteristics & Examples
Nominal	Categorical data with no inherent order (e.g., zip codes, gender, department names). Cannot perform mathematical operations.
Ordinal	Categorical data with a meaningful order or ranking, but intervals between ranks are not equal (e.g., risk ratings: High, Medium, Low).
Interval	Numerical data with equal intervals but no true zero point (e.g., temperature, calendar dates).
Ratio	Numerical data with equal intervals and a true zero point, allowing for all mathematical operations (e.g., account balances, physical inventory counts, salaries).
Continuous	Data that can take any value within a range, including decimals or fractions (e.g., exact transaction timestamps, exact weight of a commodity).
Discrete	Data that can only take distinct, whole-number values (e.g., number of outstanding checks, number of employees).

Data, Technology & Audit Data Analytics (ADAs)

ADAs are the science and art of discovering and analyzing patterns, identifying anomalies, and extracting useful information in data underlying the subject matter of an audit.

Data Extraction & Transformation

Before performing analytics, the auditor must ensure data reliability:

Extraction: Requesting specific attribute structures, formats, and sources.
Transformation: Cleaning and scrubbing unstructured data to make it useful.
Reliability Verification: Assessing completeness, accuracy, and authenticity of data obtained from internal/external sources (including third-party artificial intelligence tools).

Common ADA Techniques

Technique	Application
Anomaly Detection	Identifying items that do not conform to an expected pattern (e.g., duplicate payments, weekend journal entries, amounts just below an authorization threshold).
Sequence Check	Verifying the numerical continuity of a series of documents (e.g., checks, invoices) to identify gaps or duplicates.
Regression Analysis	Evaluating the relationship between variables to develop a data-driven expectation for a balance or transaction amount.

Purpose in the Audit Phases

Risk Assessment: Analyze entire populations to find unusual trends, replacing sample-based assumptions.
Test of Controls: Test the effectiveness of controls over massive transaction volumes (e.g., testing 100% of user access logs).
Substantive Procedures: Provide more persuasive evidence by testing entire populations instead of representative samples.

Written Representations (Management Rep Letter)

Obtained at the conclusion of the audit and dated the same date as the auditor's report. It is a mandatory piece of audit evidence. Refusal by management to provide this letter results in a disclaimer of opinion or withdrawal from the engagement.

Category	Key Representations Required
Financial Statements	Management acknowledges their responsibility for the fair presentation of the F/S and the design, implementation, and maintenance of internal controls.
Completeness of Information	All financial records, data, and minutes of meetings have been made available to the auditor. All transactions have been recorded.
Fraud & Noncompliance	Disclosure of known or suspected fraud involving management or employees with significant internal control roles. Disclosure of all known instances of NOCLAR.
Specific Assertions	Confirmation of uncorrected misstatements (a summary must be attached), related party transactions, the reasonableness of accounting estimates, and subsequent events.

Cycles & Key Topics

Transaction Cycles: Risks & Procedures

Cycle	Primary Risk	Key Assertions	Primary Procedure	Notes
Revenue	Overstatement	Existence / Occurrence, Cutoff	Vouching	Fictitious sales, hold sales journal open, ship goods not ordered
Expenditure	Understatement	Completeness, Valuation & Allocation, Accuracy	Tracing	Match: Receiving Report, Vendor Invoice, Purchase Order
Cash	Overstatement	Existence, Cutoff	Bank Reconciliation	Kiting: Cash in two places at once Lapping: Today's CR covers yesterday's theft
Inventory	Various	Completeness, Existence, Valuation & Allocation, Rights & Obligations	Observation	Physical count observation
Investment	Valuation	Completeness, Existence, Valuation & Allocation, Rights & Obligations	Various	Complex because measured at Fair Value

Transaction Cycle Fraud Schemes & Substantive Detection Procedures

Fraud Scheme	Cycle & Mechanism	Primary Audit Detection Procedure	Working Paper Analysis / Key Indicator
Kiting	Cash Cycle: Double-counting cash across two bank accounts by transferring funds right before year-end without recording the disbursement.	Prepare and inspect an Intercompany Bank Transfer Schedule; examine year-end cutoff bank statements.	Fraud Indicator: Disbursing bank book date is recorded after year-end, while receiving bank book date is recorded before year-end.
Lapping	Revenue / AR Cycle: Stealing cash received from Customer A, and concealing it by applying subsequent cash receipts from Customer B to Customer A's account.	Confirm accounts receivable directly with customers; inspect lockbox remittance advices; compare deposit slips with daily remittance records.	Control Response: Strict segregation of cash handling (custody) from accounts receivable subledger posting (recording).
Unrecorded Liabilities	Expenditure / AP Cycle: Holding vendor invoices received before year-end without recording liabilities, understating expenses and payables.	Search for Unrecorded Liabilities: Vouch post-year-end cash disbursements and inspect unmatched receiving reports through the audit date.	Assertion Tested: Completeness of Accounts Payable (tracing source documents forward to ledgers).
Consigned Goods Misstatement	Inventory Cycle: Improperly including consigned goods held for others in inventory, or failing to record consigned goods held at third-party locations.	Inspect consignment contracts; confirm inventory balances directly with consignees; examine warehouse receipts and purchase terms.	Assertion Tested: Rights and Obligations & Completeness.

Economics & Business Cycles

Understanding internal and external economic factors is critical for assessing the inherent risk of material misstatement.

Supply, Demand, & Elasticity

Economic Concept	Definition & Audit Implications
Price Elasticity of Demand	Measures how quantity demanded responds to price changes. Elastic: Demand highly responsive to price (luxury goods). Inelastic: Demand unresponsive (essential goods). Implication: Affects revenue projections and inventory obsolescence risks.
Profit Maximization	Occurs where Marginal Cost (MC) equals Marginal Revenue (MR). Implication: Understanding cost structures helps auditors evaluate management's strategy and the reasonableness of accounting estimates.

Business Cycles & Indicators

Cycle Phase	Characteristics	Audit Implications (Risks)
Expansion / Peak	Increasing economic activity, rising demand, higher inflation.	Potential overstatement of assets; capacity constraints; aggressive revenue recognition.
Recession / Trough	Decreasing economic activity, falling demand, higher unemployment.	Going concern risks; inventory obsolescence; asset valuation impairments; increased pressure to commit fraud.

Economic Indicator Classifications

Leading: Predict future economic activity (e.g., bond yields, building permits, stock market indices).
Coincident: Move concurrently with the economy (e.g., GDP, industrial production, retail sales).
Lagging: Confirm past economic trends (e.g., unemployment rate, consumer price index).

Other Engagements (SSARS, SSAE, GAGAS)

SSARS vs. SAS Comparison

A definitive comparison of non-audit services for nonissuers (SSARS) versus standard audits (SAS). SSARS does not apply to audits, SSAE engagements, tax preparation, personal financial planning, litigation, valuations, or basic bookkeeping (journal entries/trial balances).

Dimension / Requirement	1. Preparation (SSARS)	2. Compilation (SSARS)	3. Nonissuer Review (SSARS)	4. Nonissuer Interim Review (AICPA SAS)	5. Issuer Interim Review (PCAOB)	6. Financial Statement Audit (SAS / PCAOB)
Governing Standard	AICPA SSARS (Preparation)	AICPA SSARS (Compilation)	AICPA SSARS (Review)	AICPA SAS	PCAOB	AICPA SAS / PCAOB AS
Level of Assurance	None	None	Limited (Negative)	Limited (Negative)	Limited (Negative)	Reasonable (Positive)
Applicable Entities	Nonissuers only	Nonissuers only	Nonissuers only	Nonissuers with audited annual FS	Issuers (SEC Registrants)	Nonissuers & Issuers
Independence Required?	No (Non-attest)	No (Disclose lack of indep)	YES (Mandatory)	YES (Mandatory)	YES (Mandatory)	YES (Mandatory)
Engagement Letter	Mandatory	Mandatory	Mandatory	Mandatory	Mandatory	Mandatory
Management Rep Letter	Not Required	Not Required	MANDATORY	MANDATORY	MANDATORY	MANDATORY
Internal Control Evaluation	Not Required	Not Required	Not Required (No understanding required)	MANDATORY Understanding	MANDATORY Understanding	MANDATORY Understanding & Testing (if relying)
Primary Substantive Procedures	Prepare FS from records	Read FS for obvious errors	Inquiry & Analytical Procedures	Inquiry & Analytical Procedures	Inquiry & Analytical Procedures	Full substantive tests of details, confirms, physical counts
Omission of GAAP Notes	Allowed (disclose on FS)	Allowed (disclose in report)	PROHIBITED (Modify Report)	PROHIBITED (Modify Report)	PROHIBITED (Modify Report)	PROHIBITED (Qualified/Adverse)
Departures from GAAP	Disclose on FS or notes	Modify compilation report	Modify review report	Modify review report	Modify review report	Qualified or Adverse Opinion
Report Output	NO Report ("No assurance" on pages)	Compilation Report	Independent Accountant's Review Report	Independent Auditor's Review Report	Independent Auditor's Review Report	Independent Auditor's Report
Predecessor Communication	Not Required	Not Required	Not Required	Inquiries as appropriate	Required	MANDATORY Prior Inquiries
Subsequent Event Inquiries	Not Required	Not Required	REQUIRED (Through report date)	REQUIRED	REQUIRED	REQUIRED (Full procedures)
Key Report Phrasing	N/A	"Did not audit or review... do not express an opinion"	"No material modifications should be made"	"We are not aware of any material modifications"	"We are not aware of any material modifications"	"In our opinion... presents fairly in all material respects"

Review Engagement Nuances

Going Concern (Interim): The CPA only inquires of management; they do not actively seek corroborating evidence or mitigating factors.
Going Concern (SSARS): If substantial doubt is alleviated, adding an EOM paragraph is optional. If doubt remains and management refuses to adjust/disclose, the CPA should consider withdrawing.
Interim SEC Note: For PCAOB issuer interim reviews, if the review is cited in an SEC registration statement, the auditor must add a note stating that the review is "not a part of the registration statement."

SSARS General Principles & Reporting

SSARS rules are established by the AICPA Accounting and Review Services Committee (ARSC). Like GAGAS, SSARS utilizes Must (unconditional) and Should (presumptively mandatory) directives.

Fraud and Subsequent Events

Fraud Discovery: The CPA is not responsible for proactively uncovering fraud unless specifically requested. If discovered, notify management, evaluate the impact, and ensure it is corrected or reported. If management commits fraud, notify governance. Inconsequential fraud does not need to be reported to governance, but all reports must be documented. Maintain confidentiality unless required by law, subpoena, or successor CPA.
Subsequent Events: If discovered, discuss with management. If amended, update the date and add an Emphasis-of-Matter paragraph. If management refuses to amend, the CPA should refuse to issue the report, withdraw, and notify users and regulatory agencies.

Roles and Responsibilities

Management: Exclusively responsible for the financial statements, internal controls, accounting policies, compliance with laws, providing complete information, and authorization.
CPA: Responsible for understanding the industry and accounting policies, upholding ethics and quality control, and applying professional judgment.
Users: The CPA has no obligation to identify the specific users of the financial statements.

Comparative Financial Statements (SSARS)

Specific reporting rules apply when a practitioner handles financial statements from multiple periods with varying levels of service.

Service Change Scenario	Reporting Action Required
Review (Prior) → Review (Current)	Issue a combined report covering both periods, update the prior period, and explain the dates.
Compile (Prior) → Review (Current) Step Up	In the current review report, add an Other-Matter (OM) paragraph explaining the prior period was compiled.
Review (Prior) → Compile (Current) Step Down	Reissue the prior report (can be combined or separate) and explicitly state "no review was performed after [date]."
Compile/Review (Prior) → Prepare (Current) Step Down	Because a Preparation engagement issues no report, do not mention the prior period.
Audit (Prior) → Review (Current) Step Down	Explain that the current period is unaudited and provide the reasons for the prior period's audit opinion.
Review (Prior) → Audit (Current) Step Up	In the current audit report's Other-Matter (OM) paragraph, state the prior period's review conclusion and point out that a review's scope is substantially less than an audit.

Handling Prior Reports

Update: The same CPA updates their prior report for the current comparative presentation.
Reissue: The prior CPA reissues their original report. They must read the current FS and report, ask the current CPA if any new information affects the prior conclusion, and obtain a representation letter. If new information arises, they must execute procedures to understand it.
Not Reissued: If the prior report is not reissued, the current CPA can choose to refer to it in their report.
Restated: If prior financial statements are corrected and restated, the CPA must reissue the report.

Attestation Engagements (SSAE)

Engagements where a practitioner is engaged to issue a report on subject matter, or an assertion about subject matter, that is the responsibility of another party. All SSAE engagements require the practitioner to maintain independence and obtain a management representation letter.

Engagement Type	Assurance Level	Output/Result	Key Report Phrasing	Restriction
Examination	Reasonable (Positive)	Opinion	"In our opinion... is fairly stated"	General use (usually)
Review	Limited (Negative)	Conclusion	"We are not aware of any material modifications"	General use (usually)
Agreed-Upon Procedures (AUP)	None	List of Findings	"The procedures and findings are described below..."	General Use Permitted

SSAE Subject Matter Service Eligibility Matrix

Attestation Subject Matter	Examination (Reasonable Assurance)	Review (Limited Assurance)	Agreed-Upon Procedures (No Assurance)
Agreed-Upon Procedures (AUP)	N/A	N/A	PERMITTED
Prospective Financial Statements	PERMITTED	PROHIBITED	PERMITTED
Pro Forma Financial Information	PERMITTED	PERMITTED	PERMITTED
Compliance Attestation	PERMITTED	PROHIBITED	PERMITTED
Management's Discussion & Analysis (MD&A)	PERMITTED	PERMITTED	PERMITTED
Service Org Controls (SOC 1 & SOC 2)	PERMITTED (Type 1 & 2)	PROHIBITED	PROHIBITED

Detailed Engagement Nuances

Examination Types: Can be Assertion-based (management provides a written assertion) or Direct Examination (management does not provide a written assertion). The subject matter must be evaluated against suitable criteria.
Review Limitations: The scope of a review is smaller than an examination. A review cannot be performed on prospective financial statements (projections). It issues a conclusion, not an opinion.

Agreed-Upon Procedures (SSAE 19) Mandatory Conditions

Mandatory AUP Condition	Standard Operational Rule (SSAE 19)
1. Independence	The practitioner must be independent of the responsible party.
2. Agreement on Procedures	The engaging party must agree to the procedures and take responsibility for the sufficiency of the procedures for their purposes.
3. Subject Matter Consistency	The subject matter must be capable of reasonably consistent measurement or evaluation against suitable criteria.
4. Materiality Disregard	Materiality limits do NOT apply to AUP findings unless explicitly defined and agreed upon by specified parties.
5. General Use Output	Under SSAE 19, AUP reports are no longer restricted to specified users by default; general use is permitted unless a restriction is specifically required.

Prospective Financial Statements: Forecasts vs. Projections

Prospective Type	Underlying Assumptions	Allowed Distribution	Permissible Services
Financial Forecast	Based on management's expected conditions and expected courses of action (best-estimate).	General Use & Restricted Use	Examination, Compilation, Agreed-Upon Procedures (Reviews PROHIBITED)
Financial Projection	Based on hypothetical assumptions ("what-if" scenarios) not necessarily expected to occur.	RESTRICTED USE ONLY (Negotiating parties only)	Examination, Compilation, Agreed-Upon Procedures (Reviews PROHIBITED)

Master Comparison Matrix: Prospective Financial Statement Services

Service Dimension	1. Examination (SSAE)	2. Compilation (SSARS)	3. Agreed-Upon Procedures (SSAE)	4. Preparation (SSARS)
Level of Assurance	Reasonable (Positive Opinion)	None (No Assurance)	None (List of Findings)	None (No Assurance)
Independence Required?	YES (Mandatory)	No (Disclose lack of indep)	YES (Mandatory)	No
Evaluate Assumptions?	YES (Evaluate reasonableness)	No (Read for obvious errors)	No (Specified parties take responsibility)	No
Management Rep Letter	MANDATORY	Not Required	MANDATORY	Not Required
AICPA Presentation Guidelines	Must verify conformity with AICPA presentation guidelines	Must verify conformity with AICPA presentation guidelines	Procedures agreed with engaging party	Assist in preparing
Omission of Significant Assumptions	ADVERSE OPINION	PROHIBITED (Withdraw)	PROHIBITED	PROHIBITED
Omission of Accounting Policies	QUALIFIED / ADVERSE	Modify Report / Disclose	Report as finding	Disclose on FS
Scope Limitation Impact	DISCLAIMER OF OPINION	N/A (Withdraw if incomplete)	Report inability to perform	N/A
Report Output	Independent Examination Report	Compilation Report	Agreed-Upon Procedures Report	NO Report ("No assurance")
Caveat on Realization	Mandatory statement: "Actual results will likely differ"	Mandatory statement: "Actual results will likely differ"	Mandatory statement: "Actual results will likely differ"	N/A
Distribution Restriction (Projection)	MANDATORY RESTRICTION	MANDATORY RESTRICTION	MANDATORY RESTRICTION	MANDATORY RESTRICTION
Review Engagement Allowed?	STRICTLY PROHIBITED (Prospective statements can NEVER be reviewed under SSAE)

Service Organization Control (SOC) Reports

Reports issued by a service auditor regarding the controls at a service organization (e.g., outsourced payroll, information systems) that impact a user entity's financial statements.

Report	Focus Area	Primary Audience
SOC 1	Internal Controls over Financial Reporting (ICFR).	User entity auditors evaluating financial statement risks.
SOC 2	Trust Services Criteria (Security, Availability, Processing Integrity, Confidentiality, Privacy).	Stakeholders needing assurance over IT/data controls.
SOC 3	Trust Services Criteria (General overview).	General public use.

Report Types & Auditor Reliance

Type 1 Report: Reports on the design and implementation of controls at a specific point in time (as of date). Does not allow the user auditor to reduce assessed control risk. Includes an Other-Matter paragraph stating no opinion is expressed on operating effectiveness.
Type 2 Report: Reports on the design, implementation, and operating effectiveness of controls over a specified period. Contains control tests and allows the user auditor to reduce assessed control risk. (Most useful for an audit).

Report Contents & Auditor Roles

Report Structure: Includes a System Description, Management's Assertion Letter, and the Service CPA's Opinion (Examination standards). Contains an Inherent Limitations paragraph and a Restricted Use paragraph (limited to Service Management, User Entities, and User Auditors).
User Auditor Responsibility: Must confirm the service auditor's competence and independence, read the SOC report, understand the system, assess subsequent events, and obtain a management representation letter.

User Auditor Reference Prohibition

Audit Opinion on User Entity F/S	Permissibility of Referencing the Service Auditor
Unmodified Opinion	STRICTLY PROHIBITED: The user auditor must NOT refer to the work of the service auditor in an unmodified audit report.
Modified Opinion (Qualified or Adverse)	Permitted ONLY IF necessary to explain the reason for the modification. The report must explicitly state that the reference does not diminish the user auditor's sole responsibility for the audit opinion.

Compliance Audits (SAS & SSAE)

Reporting on an entity's compliance with specific laws, regulations, or contractual agreements.

Compliance with Financial Statement Audit (SAS)

If a financial statement audit includes contractual compliance requirements, the auditor issues negative assurance ("Nothing came to our attention").
Combined Report: Add an Other-Matter paragraph to the audit report, but the entire report becomes restricted use.
Separate Report: The compliance report is restricted use, but must refer to the financial statement audit.
If the financial statement opinion is Adverse or a Disclaimer, a compliance report cannot be issued unless noncompliance is explicitly found.

Attestation Compliance Standards (SSAE)

Applies when examining adherence to specific laws, contracts, or Internal Control over Compliance (ICC).
Can only be performed as an Examination or an Agreed-Upon Procedures (AUP) engagement. Reviews are strictly prohibited.

Governmental and Single Audits (GAGAS)

Governmental Auditing Standards (Yellow Book) introduces strict adherence terminology: Must (Unconditional requirement) and Should (Presumptively mandatory, requires justification if deviated from).

Audit Type	Requirements & Outputs
1. Financial Statement Audit	Issues an opinion on whether the FS is fairly presented. Does not issue an opinion on internal controls or compliance, but must report findings of material noncompliance and internal control deficiencies. Requires restricted use. If management refuses to report fraud/illegal acts, the auditor must inform regulatory counterparties.
2. Internal Control Audit (ICFR)	Must be reported in every audit (can be combined with FS or separate). Only reports on procedures and findings. Explicitly states: "We do not express an opinion on the effectiveness of internal control."
3. Compliance Audit	Ensures audit scope covers all relevant regulations. Issues an opinion that "the government complied in all material respects" (an opinion on compliance, not ICC). Must disclose material fraud and noncompliance. Management must provide a written assertion acknowledging responsibility for compliance and corrective action.
4. Performance Audit	Requires explicit audit objectives and scope. Reports findings and management's view on those findings. Uncovers illegal acts, but issues no opinion on the financial statements as a whole.

Single Audit Act: The 5 Mandatory Reporting Deliverables (Uniform Guidance)

Entities that expend $750,000 or more in federal awards ($1,000,000 under revised Uniform Guidance thresholds) within a fiscal year are subject to the Single Audit Act. The auditor must prepare and issue five distinct reporting deliverables:

Single Audit Deliverable	Auditor Responsibility & Work Performed	Assurance Level / Stated Output
1. Financial Statement Opinion	Audit the basic financial statements of the governmental entity in accordance with GAAS and GAGAS.	Reasonable Assurance (Opinion on Fair Presentation)
2. GAGAS Yellow Book Report on ICFR & Compliance	Test internal control over financial reporting and test compliance with laws, regulations, and grant provisions.	No Opinion on ICFR; reports identified significant deficiencies, material weaknesses, and noncompliance findings.
3. Major Program Compliance Opinion	Audit compliance for each major federal program using the Single Audit Risk-Based Approach (Type A / Type B programs).	Reasonable Assurance (Opinion on Major Program Compliance)
4. Report on Internal Control Over Compliance (ICC)	Test internal controls over compliance for each major federal program to support a low assessed level of control risk.	No Opinion on ICC; reports identified significant deficiencies and material weaknesses in internal control over compliance.
5. Schedule of Findings & Questioned Costs	Prepare the statutory schedule including: Summary of auditor results, GAGAS findings, and Single Audit major program findings (reporting any known questioned costs > $25,000).	Required Statutory Schedule

ERISA Employee Benefit Plan Audits

Audits of employee benefit plans subject to the Employee Retirement Income Security Act of 1974 (ERISA) have specialized reporting and risk assessment requirements.

Key Area	Audit Considerations & Procedures
Risk Assessment	Evaluate risks related to plan investments, participant data, and employer/employee contributions. Assess controls at third-party administrators (relying heavily on SOC 1 reports).
Key Procedures	Test participant eligibility, benefit payments, allocation of investment income, and strict compliance with the plan document.

ERISA Certified Investment Audits: Two-Pronged Opinion Structure

When plan management elects an ERISA certified-investment audit (formerly referred to as a "limited-scope audit", authorized under ERISA Section 103(a)(3)(C)), the auditor is instructed not to perform audit procedures on certified investment information prepared and certified by a qualified institution (e.g., bank or insurance carrier). This statutory limitation is NOT a scope limitation and does NOT result in a disclaimer of opinion. Instead, the auditor issues a special report with an unmodified two-pronged opinion:

Prong 1: An opinion on whether the portions of the financial statements and disclosures not covered by the certification are presented fairly, in all material respects, in accordance with GAAP.
Prong 2: An opinion on whether the certified investment information in the financial statements agrees with or is derived from the certification provided by the qualified institution.