PrepPass team · Verified against AICPA · How we review
Free · printable · no signup
CPA Exam — Auditing and Attestation (AUD) Exam Cheat Sheet (2026)
A free, printable CPA Exam — Auditing and Attestation (AUD) exam cheat sheet: the 70 highest-yield points to know, grouped into 4 sections that follow the exam's content areas, each section with its published weight.
- Free to read, print and keep — no signup, no email, no paywall.
- 70 of the 70 points carry a citation to the rule they come from.
- The real CPA Exam — Auditing and Attestation (AUD) exam: 240 minutes.
- Prints from your browser (Ctrl-P, or Cmd-P on a Mac) — the navigation, buttons and links drop out of the printed copy.
- 111 free CPA Exam — Auditing and Attestation (AUD) practice questions on the same material, every one explained.
- Last updated: September 2026.
Studying in order?
Practice stays free. The full CPA Exam — Auditing and Attestation (AUD) study guide is the material itself, taught start to finish — a downloadable PDF + EPUB you keep.
Area I: Ethics, Professional Responsibilities and General Principles
15–25% of the exam- Direct financial interests
- Any direct financial interest, or a material indirect one, held by a covered member during the period of the professional engagement impairs independence, and materiality does not matter for a direct interest. An inherited or gifted interest must be disposed of within 30 days after the member gains the right to dispose of it.· AICPA Code ET 1.240.010, 1.240.020
- Unpaid fees
- Unpaid fees that are significant to the member and relate to services provided more than one year before the current-year report is issued impair independence, and a note receivable for those fees counts as unpaid.· AICPA Code ET 1.230.010
- Nonattest services
- Management must assume all management responsibilities, designate a person with suitable skill, knowledge, or experience to oversee the service, and accept responsibility for the results. The understanding must be documented in writing before the work begins.· AICPA Code ET 1.295.040
- Contingent fees and commissions
- Contingent fees and commissions are prohibited for clients receiving an audit, review, examination of prospective information, or a compilation a third party will use when the report does not disclose a lack of independence. Contingent fees for preparing tax returns are prohibited for every client.· AICPA Code ET 1.510.001, 1.520.001
- Third-party service providers
- Before sharing confidential client information with an outside provider, including technology or AI tools run by a vendor, the member needs either the client's specific consent or a confidentiality contract with reasonable assurance about the provider's safeguards.· AICPA Code ET 1.700.040
- Prohibited non-audit services
- Bookkeeping, financial information systems design, appraisal and valuation, actuarial, internal audit outsourcing, management functions, human resources, broker-dealer, legal, and expert services unrelated to the audit impair an issuer auditor's independence, subject to the rule's stated conditions.· 17 CFR 210.2-01(c)(4)
- Partner rotation
- The lead partner and engagement quality reviewer may serve five consecutive years, followed by a five-year time-out. Other audit partners covered by the rule may serve seven years, followed by a two-year time-out.· 17 CFR 210.2-01(c)(6)
- Cooling-off and pre-approval
- A former audit team member may not take a financial reporting oversight role at the issuer within the one-year cooling-off period. All audit and non-audit services require audit committee pre-approval, with a narrow de minimis exception.· 17 CFR 210.2-01(c)(2)(iii)(B), (c)(7)
- Employee benefit plans
- The DOL does not recognize an accountant as independent if the accountant or the firm held a direct or material indirect interest in the plan or its sponsor, had certain roles such as officer or director, or maintains the plan's financial records.· 29 CFR 2509.2022-01
- Yellow Book competence
- GAGAS auditors need 80 hours of CPE every two years, with 24 hours related to government and at least 20 hours each year, and an audit organization needs an external peer review at least every three years.· GAO Government Auditing Standards, 2024 Revision, paras. 4.16-4.17, 5.179
- Skepticism and bias
- Skepticism combines a questioning mind, alertness to possible misstatement, and critical assessment of evidence. Recognized biases include automation, anchoring, confirmation, availability, overconfidence, and groupthink.· AU-C 200.14; AU-C 220.A37
- Preconditions for an audit
- Management must use an acceptable financial reporting framework and acknowledge its responsibility for the financial statements, for internal control, and for giving the auditor access. Without that agreement, the auditor should not accept the engagement unless law requires it.· AU-C 210.06-.08
- Changing the engagement
- A move to a lower level of service needs reasonable justification. A change of circumstances or a misunderstanding may qualify, but a request made to avoid a modified opinion does not.· AU-C 210.17-.20, .A40-.A42
- Predecessor auditor
- Before accepting an initial audit, the auditor asks management to authorize the predecessor to respond. If management refuses, the auditor considers the reasons before deciding whether to accept.· AU-C 210.11-.15
- Nonissuer documentation deadlines
- Assemble the final audit file within 60 days after the report release date and retain it for at least five years from that date.· AU-C 230.16-.17
- Deficiency communications
- For nonissuers, significant deficiencies and material weaknesses go in writing to those charged with governance within 60 days after the report release date, including ones already fixed. For issuers, they go in writing before the auditor's report is issued.· AU-C 265.11-.13; PCAOB AS 1305.04
- Scope and timing
- The auditor gives governance an overview of the planned scope and timing, including significant risks, without making detailed procedures predictable.· AU-C 260.11, .A24
- System of quality management
- SQMS No. 1 organizes a firm's system into eight components, and the system is evaluated at least annually. Firms had to design and implement their systems by December 15, 2025.· SQMS No. 1 (QM sec. 10) paras. .07, .10, .14
- Engagement quality review
- The engagement partner may not release the report until the reviewer confirms the review is complete. U.S. standards require policies on a former partner becoming the reviewer but set no fixed cooling-off period.· SQMS No. 2 (QM sec. 20) paras. .19, .24
Area II: Assessing Risk and Developing a Planned Response
25–35% of the exam- Strategy versus plan
- The strategy covers scope, reporting objectives, key factors that direct the team's efforts, and resources. The plan covers direction and supervision, risk assessment procedures, and further audit procedures at the assertion level.· AU-C 300.08-.09
- Audit committee authority
- An issuer's audit committee is directly responsible for appointing, compensating, and overseeing the auditor, and it must set up procedures to receive complaints about accounting matters.· Sarbanes-Oxley Act sec. 301
- Officer certifications
- The CEO and CFO certify each periodic report, including that they are responsible for internal controls and have evaluated them.· Sarbanes-Oxley Act sec. 302
- Internal control reporting
- Management reports on internal control over financial reporting as of fiscal year-end, and the issuer discloses whether it has a code of ethics for senior financial officers and a financial expert on the audit committee.· Sarbanes-Oxley Act secs. 404, 406, 407
- Five components
- The five components are the control environment, the risk assessment process, the process to monitor the system, the information system and communication, and control activities.· AU-C 315.12
- General IT controls
- General IT controls cover managing access, managing program and other changes, and managing IT operations.· AU-C 315.12; AU-C 315 appendix F
- Type 1 versus type 2
- A type 1 report covers the description and design of controls as of a date. A type 2 report adds operating effectiveness over a period and is the one that supports reliance on controls.· AU-C 402.08, .16-.17
- User auditor duties
- The user auditor evaluates complementary user entity controls and does not refer to the service auditor in an unmodified opinion.· AU-C 402.14, .21
- Benchmarks
- Common benchmarks are profit before tax, revenue, gross profit, expenses, equity, and net assets. A normalized or less volatile benchmark may be better when profit swings.· AU-C 320.A7-.A8
- Inherent risk factors
- The inherent risk factors are complexity, subjectivity, change, uncertainty, and susceptibility to management bias or fraud. They place a risk on the spectrum of inherent risk.· AU-C 315.12
- Control risk
- If the auditor will not test operating effectiveness, control risk is assessed at the maximum. Controls over significant risks must be tested in the current period if the auditor relies on them.· AU-C 315.38; AU-C 330.14-.15
- Fraud presumptions
- Revenue recognition is presumed to carry fraud risk, and the presumption is rebuttable only with documented reasons. Management override is present in every entity and always requires journal entry testing, a review of estimates for bias, and an evaluation of significant unusual transactions.· AU-C 240.26, .31-.32, .46
- Substantive floor
- Substantive procedures are required for each relevant assertion of each significant class, balance, and disclosure, however effective controls prove to be.· AU-C 330.18
- Internal audit
- Internal audit's work cannot be used if the function lacks objectivity, lacks competence, or lacks a systematic and disciplined approach. The auditor uses less of it as judgment and risk increase.· AU-C 610.14, .17
- Specialists
- The auditor evaluates the competence, capabilities, and objectivity of both its own specialists and management's specialists.· AU-C 620.09; AU-C 501.27
- Two groups of laws
- For laws with a direct effect on amounts, the auditor obtains sufficient appropriate evidence about those amounts. For other laws, the auditor inquires and inspects correspondence with regulators.· AU-C 250.06, .13-.14
- Single audit trigger
- An entity that spends $1,000,000 or more of federal awards in a year needs a single audit or, if it qualifies, a program-specific audit.· 2 CFR 200.501
- Major programs
- Type A thresholds scale with total expenditures, and major programs must cover at least 40 percent of federal expenditures, or 20 percent for a low-risk auditee.· 2 CFR 200.518, 200.520
Area III: Performing Further Procedures and Obtaining Evidence
30–40% of the exam- Reliability
- Evidence from knowledgeable external sources, evidence the auditor obtains directly, and documentary evidence are generally more reliable than internal, indirect, or oral evidence.· AU-C 500.A22-.A24; PCAOB AS 1105.08
- Direction of testing
- Sampling recorded items cannot find omitted items. To test completeness, select from a source outside the records, such as shipping documents for sales or later cash disbursements for payables.· PCAOB AS 2315.17
- Information produced by the entity
- Before relying on entity-produced information, the auditor obtains evidence about its accuracy and completeness and evaluates whether it is precise and detailed enough for the purpose.· AU-C 500.09
- Limits of procedures
- Inquiry alone never tests operating effectiveness. Observation covers only the moment observed, and reperformance means independently executing the entity's control.· AU-C 330.A28; AU-C 500.A54, .A58
- Sampling risk
- The risk of concluding that controls are more effective, or misstatement lower, than they really are threatens audit effectiveness and matters most to the auditor.· AU-C 530.05
- Evaluating control samples
- The sample deviation rate is the best estimate of the population rate. Items that cannot be tested are ordinarily treated as deviations.· PCAOB AS 2315.40-.41
- Projecting misstatement
- Project the sample misstatement to the sampled population, add misstatements from items examined 100 percent, and compare the total with tolerable misstatement, allowing for sampling risk.· PCAOB AS 2315.26
- Analytical procedures
- Substantive analytics require evaluating the reliability of the data, a sufficiently precise expectation, and investigation of significant differences. Final-stage analytics are required in every audit.· AU-C 520.05-.07
- Confirmation control
- The auditor sends requests and receives responses directly. Negative requests alone are not sufficient evidence, and each nonresponse calls for alternative procedures such as examining subsequent cash receipts.· PCAOB AS 2310.12-.23 and Appendix C; AU-C 505.07, .12
- Inventory and litigation
- The auditor attends material counts, tests roll-forwards when the count is not at year-end, and confirms or inspects goods held by third parties. For litigation, the auditor sends a letter of inquiry, prepared by management, to external counsel.· AU-C 501.12-.19
- Going concern
- Where the framework sets no period, the evaluation covers one year after the financial statements are issued. Loan defaults, recurring losses, and loss of trade credit are typical warning signs.· AU-C 570 (definition of reasonable period of time, conditions and events)
- Federal award compliance
- For major programs, the auditor tests internal control over compliance to support a low assessed level of control risk and reports questioned costs above $25,000.· 2 CFR 200.514(c), 200.516(a)
- Accumulating misstatements
- Accumulate everything except clearly trivial amounts, which are not the same as immaterial amounts, and evaluate uncorrected misstatements individually and in aggregate.· AU-C 450.05, .11
- Deficiency severity
- A material weakness involves a reasonable possibility of a material misstatement not being prevented or detected in time. A significant deficiency is less severe but merits governance's attention.· AU-C 265.07
- Written representations
- Representations are dated as of the auditor's report date. If management refuses to acknowledge its responsibilities, the auditor disclaims an opinion or withdraws.· AU-C 580.20, .25
- Subsequent events
- Events that give evidence about conditions at the balance sheet date are recognized. Events arising after that date are disclosed if material, and procedures run up to the report date.· FASB ASC 855-10-25; AU-C 560.09-.11
- Revisions after the report date
- When statements are revised after the report date, the auditor either redates the report and extends procedures, or dual-dates the report for the revision only.· AU-C 560.13
Area IV: Forming Conclusions and Reporting
10–20% of the exam- Choosing the opinion
- A material but not pervasive misstatement leads to a qualified opinion, and a material and pervasive one to an adverse opinion. When evidence cannot be obtained, the result is a qualified opinion or a disclaimer, depending on pervasiveness.· AU-C 705.07-.10
- Emphasis versus other matter
- An emphasis-of-matter paragraph points to something already presented or disclosed in the statements. An other-matter paragraph covers something outside them that is relevant to the audit or the report.· AU-C 706 definitions
- Going concern section
- When substantial doubt remains and is adequately disclosed, the report adds a separate going concern section and the opinion stays unmodified. An inappropriate going concern basis leads to an adverse opinion.· AU-C 570.23-.24
- Consistency
- A justified change in accounting principle with a material effect, or the correction of a material misstatement, requires an emphasis-of-matter paragraph. If the change is applied retrospectively, the paragraph is needed only in the period of change.· AU-C 708.08-.09, .13
- Material weakness
- One or more material weaknesses lead to an adverse opinion on internal control over financial reporting, unless the scope was restricted.· PCAOB AS 2201.90-.92
- Critical audit matters
- A CAM is a matter communicated to the audit committee that relates to material accounts or disclosures and involved especially challenging, subjective, or complex judgment. Certain filers, including emerging growth companies, are exempt.· PCAOB AS 3101.11; PCAOB CAM fact sheet
- Tenure and independence
- The issuer report states the year the auditor began serving consecutively and that the auditor must be independent.· PCAOB AS 3101.09-.10
- Key audit matters
- For nonissuers, KAMs appear only when the auditor is engaged to report them and never alongside an adverse opinion or disclaimer unless law requires it.· AU-C 701.04
- Agreed-upon procedures
- The engaging party agrees to the procedures and acknowledges they are appropriate. The report lists procedures and findings, gives no opinion or conclusion, and may restrict its use.· AT-C 215.03, .34-.36
- Preparation
- Each page must state that no assurance is provided. Otherwise the accountant issues a disclaimer, performs a compilation, or withdraws.· AR-C 70.14
- Compilation independence
- An accountant who is not independent may still compile but must say so in the last paragraph of the report. Giving reasons is optional, but if any are given, all must be.· AR-C 80.22-.23
- Review independence
- A review requires independence, and the accountant withdraws if independence becomes impaired during the engagement.· AR-C 90.10
- Other information
- The auditor reads other information in the annual report for material inconsistencies and reports on it in an Other Information section, with no opinion or assurance.· AU-C 720.16
- Supplementary information
- When the auditor is engaged to report on supplementary information, the opinion is whether it is fairly stated in relation to the financial statements as a whole.· AU-C 725
- Special purpose frameworks
- An emphasis-of-matter paragraph identifies the framework. A contractual or regulatory basis also requires an other-matter paragraph restricting use.· AU-C 800.20-.21
- Government and single audit reports
- GAGAS requires reports on internal control and compliance even when there are no findings. A single audit adds an opinion on compliance for each major program and a schedule of findings and questioned costs.· GAO Government Auditing Standards 2024, para. 6.40; 2 CFR 200.515
Now prove you know them
Reading an outline is not the same as recalling it under exam pressure. Drill the free CPA Exam — Auditing and Attestation (AUD) questions to find the areas you keep missing, then sit a full timed mock.
Study aid, not a substitute for the official material — always confirm the current rule with AICPA.