Chapter 3 of 430–40% of exam

Area III: Performing Further Procedures and Obtaining Evidence

This is the largest area. It covers gathering and judging evidence: testing whether data and reports are reliable, choosing and evaluating samples, performing tests of controls, tests of details, analytics, and confirmations, and handling areas that need special attention. It ends with summarizing misstatements, obtaining written representations, and dealing with subsequent events.

Audit evidence and data reliability

Evidence must be both relevant and reliable. Relevance depends on the assertion being tested and the direction of the test, and reliability depends on the source and nature of the evidence. Information produced by the entity, including reports from ERP systems and analytics tools, must be tested for accuracy and completeness before the auditor relies on it. The procedure types (inspection, observation, inquiry, confirmation, recalculation, reperformance, and analytics) each carry their own limitations.

Reliability
Evidence from knowledgeable external sources, evidence the auditor obtains directly, and documentary evidence are generally more reliable than internal, indirect, or oral evidence.
AU-C 500.A22-.A24; PCAOB AS 1105.08
Direction of testing
Sampling recorded items cannot find omitted items. To test completeness, select from a source outside the records, such as shipping documents for sales or later cash disbursements for payables.
PCAOB AS 2315.17
Information produced by the entity
Before relying on entity-produced information, the auditor obtains evidence about its accuracy and completeness and evaluates whether it is precise and detailed enough for the purpose.
AU-C 500.09
Limits of procedures
Inquiry alone never tests operating effectiveness. Observation covers only the moment observed, and reperformance means independently executing the entity's control.
AU-C 330.A28; AU-C 500.A54, .A58

Sampling, tests of controls and analytics

Sampling risk leads to two kinds of error: concluding that controls are more effective, or balances more accurate, than they really are, which affects effectiveness; and the reverse, which affects efficiency. Sample size depends on the tolerable rate or amount, the expected error, and the acceptable risk. Results are projected to the population. Substantive analytical procedures need a plausible, predictable relationship and a precise expectation, and analytics are also required near the end of every audit.

Sampling risk
The risk of concluding that controls are more effective, or misstatement lower, than they really are threatens audit effectiveness and matters most to the auditor.
AU-C 530.05
Evaluating control samples
The sample deviation rate is the best estimate of the population rate. Items that cannot be tested are ordinarily treated as deviations.
PCAOB AS 2315.40-.41
Projecting misstatement
Project the sample misstatement to the sampled population, add misstatements from items examined 100 percent, and compare the total with tolerable misstatement, allowing for sampling risk.
PCAOB AS 2315.26
Analytical procedures
Substantive analytics require evaluating the reliability of the data, a sufficiently precise expectation, and investigation of significant differences. Final-stage analytics are required in every audit.
AU-C 520.05-.07

Confirmations and matters needing special consideration

Confirmation gives strong evidence only when the auditor controls the process from sending the request to receiving the response. Specific procedures apply to inventory counts, inventory held by others, litigation, investments valued from an investee's results, and accounting estimates. Going concern evaluation looks at conditions within a defined period, and a single audit adds compliance testing for major federal programs.

Confirmation control
The auditor sends requests and receives responses directly. Negative requests alone are not sufficient evidence, and each nonresponse calls for alternative procedures such as examining subsequent cash receipts.
PCAOB AS 2310.12-.23 and Appendix C; AU-C 505.07, .12
Inventory and litigation
The auditor attends material counts, tests roll-forwards when the count is not at year-end, and confirms or inspects goods held by third parties. For litigation, the auditor sends a letter of inquiry, prepared by management, to external counsel.
AU-C 501.12-.19
Going concern
Where the framework sets no period, the evaluation covers one year after the financial statements are issued. Loan defaults, recurring losses, and loss of trade credit are typical warning signs.
AU-C 570 (definition of reasonable period of time, conditions and events)
Federal award compliance
For major programs, the auditor tests internal control over compliance to support a low assessed level of control risk and reports questioned costs above $25,000.
2 CFR 200.514(c), 200.516(a)

Misstatements, representations and subsequent events

Every misstatement above the clearly trivial threshold is accumulated, whether it is factual, judgmental, or projected, and uncorrected amounts are evaluated individually and in total. Deficiencies found during testing are classified by how severe they are. Written representations complete the evidence, and subsequent events are split into those that adjust the statements and those that are only disclosed. Facts discovered after the report date follow their own procedure.

Accumulating misstatements
Accumulate everything except clearly trivial amounts, which are not the same as immaterial amounts, and evaluate uncorrected misstatements individually and in aggregate.
AU-C 450.05, .11
Deficiency severity
A material weakness involves a reasonable possibility of a material misstatement not being prevented or detected in time. A significant deficiency is less severe but merits governance's attention.
AU-C 265.07
Written representations
Representations are dated as of the auditor's report date. If management refuses to acknowledge its responsibilities, the auditor disclaims an opinion or withdraws.
AU-C 580.20, .25
Subsequent events
Events that give evidence about conditions at the balance sheet date are recognized. Events arising after that date are disclosed if material, and procedures run up to the report date.
FASB ASC 855-10-25; AU-C 560.09-.11
Revisions after the report date
When statements are revised after the report date, the auditor either redates the report and extends procedures, or dual-dates the report for the revision only.
AU-C 560.13

Keep going: the full CPA Exam — Auditing and Attestation (AUD) guide covers every section of the exam. CPA AUD Study Guide — 2026 Edition — PDF + EPUB, $24.99 · 14-day refund →

Practice this topic →← All chapters
Studying in order?

Practice stays free. The full CPA Exam — Auditing and Attestation (AUD) study guide is the material itself, taught start to finish — a downloadable PDF + EPUB you keep.

Get the book — $24.99
Report