CPA AUD Study Guide — 2026 Edition

The risk assessment from Chapter 2 dictates the nature, timing and extent of the further procedures in this chapter. Higher assessed risk means more persuasive evidence, more experienced staff, less predictability and procedures closer to year-end. The exam tests the area as matching: given a risk, choose the procedure; given a procedure, say what it evidences and how strong the evidence is.

III-A Use of data and information

Auditors now run procedures over whole populations of client data, so the blueprint expects working knowledge of how data is structured and made fit for use. A relational database stores data in tables of records (rows) and fields (attributes); a primary key identifies each record uniquely, and a foreign key links a record to another table — an invoice's customer ID linking to the customer master file. Normalisation removes redundancy by splitting data into related tables. Measurement scales matter for choosing an analysis: nominal (categories without order), ordinal (ordered categories), interval (equal steps, no true zero), ratio (equal steps and a true zero, such as dollars), and data may be discrete (counts) or continuous.

Before relying on a report or data set produced by the client, the auditor must make it trustworthy. Under PCAOB AS 1105, when using information produced by the company as evidence, the auditor evaluates whether it is sufficient and appropriate by testing its accuracy and completeness — or testing the controls over them, including IT general controls and automated application controls — and by evaluating whether it is sufficiently precise and detailed. Practical steps: agree totals to the general ledger, validate the query or report parameters used to extract the data, and reconcile record counts. Outputs of audit data analytics — outlier reports, visualisations, three-way matches across a whole population — are evidence only to the extent the underlying data is reliable, and each outlier they surface needs an audit response.

III-B Sufficient appropriate evidence

Sufficiency is the quantity of evidence; appropriateness is its quality — relevance and reliability. PCAOB AS 1105 states the reliability presumptions the exam loves: evidence from a knowledgeable source independent of the company is more reliable than evidence from internal sources alone; evidence obtained directly by the auditor is more reliable than evidence obtained indirectly; and original documents are more reliable than photocopies, facsimiles or documents converted to electronic form, whose reliability depends on the controls over conversion. Inquiry alone is never enough: for a control, inquiry alone does not provide sufficient evidence of effectiveness. When evidence conflicts, the auditor does more work — never averages the two stories, and never keeps only the convenient one.

III-C Sampling techniques

Audit sampling applies a procedure to less than 100% of a population to evaluate a characteristic of the whole. Sampling risk is the risk that the sample conclusion differs from the conclusion a 100% examination would reach; nonsampling risk covers everything else — the wrong procedure, a misread document. The two aspects of sampling risk the exam asks for:

Test	Risk that hurts effectiveness	Risk that hurts efficiency
Substantive test of details	Incorrect acceptance	Incorrect rejection
Test of controls	Assessing control risk too low	Assessing control risk too high

Tests of controls (attribute sampling). The tolerable rate is the maximum deviation rate the auditor will accept without changing the planned assessed level of control risk. The sample deviation rate is the best estimate of the population rate. If it exceeds the tolerable rate, the control cannot support the planned reliance. Even when it is below, the auditor considers the risk that the true rate exceeds the tolerable rate — which is small when a large sample shows no deviations.

Substantive tests (variables or monetary-unit sampling). Misstatements found must be projected to the population. AS 2315's own example: select every twentieth item (50 of 1,000), find $3,000 of overstatement, and divide by the fraction sampled (1/20) to project $60,000. Add the misstatements in items examined 100%, and compare the total projected misstatement with tolerable misstatement, allowing for sampling risk.

III-D Procedures to obtain sufficient appropriate evidence

Tests of controls. In order of the evidence they ordinarily provide, from least to most: inquiry, observation, inspection of documentation, and reperformance — the auditor's independent execution of the control. Observation evidences a control only at the moment it is observed.

Tests of details include inspection, observation, recalculation (checking mathematical accuracy), reperformance, external confirmation and inquiry — with follow-up questions that probe motives as well as facts. Direction matters: vouching from recorded entries back to support tests existence/occurrence; tracing from source documents forward to the records tests completeness.

Substantive analytical procedures. Their effectiveness depends on the nature of the assertion, the plausibility and predictability of the relationship, the availability and reliability of the data, and the precision of the expectation. The auditor develops an independent expectation, sets a threshold for investigating differences, and investigates differences above it with corroborated explanations. Analytical procedures are also required near the end of the audit, as an overall review of whether the statements are consistent with the auditor's understanding.

External confirmations (PCAOB AS 2310, effective for fiscal years ending on or after 15 June 2025). The objective is relevant and reliable evidence from a knowledgeable external source. The auditor must maintain control over requests and responses to minimise interception or alteration. Negative confirmation requests alone never provide sufficient appropriate evidence, because silence is not a response. Exceptions are evaluated to decide whether they indicate a misstatement, a control deficiency, or both. Nonresponses to positive requests are followed up; if no response comes, the auditor performs alternative procedures (for receivables, typically examining subsequent cash receipts and shipping documents). A response returned to anyone other than the auditor is re-requested directly — or treated as a nonresponse.

III-E Specific matters that require special consideration

Accounting estimates (PCAOB AS 2501). Three approaches, alone or combined: test management's process (evaluate its methods, data and significant assumptions), develop an independent expectation, or evaluate evidence from events after the measurement date. Methods must conform to the financial reporting framework. Look for bias: a pattern of estimates at the optimistic end of reasonable ranges is an indicator even when each estimate is individually reasonable.

Investments in securities. Existence (custodian confirmations), valuation (the fair value hierarchy — observable market prices versus models with unobservable inputs), and classification and disclosure.

Inventory. Observation of inventories is a generally accepted auditing procedure; an auditor who issues an opinion without it bears the burden of justifying that opinion. At the count the auditor observes procedures, makes test counts in both directions (floor to sheet for completeness, sheet to floor for existence), notes obsolete or damaged goods, and captures cut-off information. Inventory held by others is confirmed with the custodian.

Litigation, claims and assessments. Management is the primary source; the auditor reads minutes and contracts and sends a letter of audit inquiry to the client's lawyers. A lawyer's refusal to furnish the information requested is a limitation on the scope of the audit sufficient to preclude an unqualified opinion.

Going concern. Management (under US GAAP, ASU 2014-15) evaluates whether conditions and events, in the aggregate, make it probable that the entity will be unable to meet its obligations within one year after the date the financial statements are issued (or available to be issued). The issuer auditor (PCAOB AS 2415) evaluates substantial doubt for a reasonable period not to exceed one year beyond the date of the financial statements being audited — so the auditor's window can be shorter than management's. For nonissuers, AU-C 570 aligns the auditor's period with the framework's. Useful procedures: analytical procedures, review of subsequent events, debt covenant compliance, minutes, legal letters, and confirmation of financial support arrangements.

Single audits. The auditor tests compliance for each major program and the internal control over compliance, and reports findings (Chapter 4).

III-F Misstatements and internal control deficiencies

The auditor accumulates misstatements identified during the audit, other than those that are clearly trivial, evaluates uncorrected ones individually and in aggregate, and considers both quantitative and qualitative factors. Control deficiencies are classified by severity: a material weakness creates a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis; a significant deficiency is less severe but merits the attention of those responsible for oversight.

III-G Written representations

The auditor obtains written representations from management to complement other procedures — never to replace them. If a representation is contradicted by other evidence, the auditor investigates and reconsiders the reliability of management's other representations. Management's refusal to furnish written representations is a limitation on the scope of the audit sufficient to preclude an unqualified opinion, and is ordinarily sufficient to cause the auditor to disclaim or withdraw.

III-H Subsequent events and subsequently discovered facts

Subsequent events (PCAOB AS 2801) come in two types. The first type provides additional evidence about conditions that existed at the balance sheet date — the statements are adjusted (a customer's bankruptcy after year-end that reveals a receivable was already uncollectible; a lawsuit settled for an amount different from the accrual, where the underlying event happened before year-end). The second type concerns conditions that did not exist at the balance sheet date but arose afterwards — no adjustment, but disclosure if needed to keep the statements from being misleading (a fire after year-end; a bond issue after year-end).

Subsequently discovered facts (AS 2905): if after the report date the auditor becomes aware of information that existed at the report date and would have been investigated had it been known, the auditor determines as soon as practicable whether it is reliable and whether the facts existed at that date — and, if the report would have been affected and people are relying on it, acts to prevent further reliance.

Key numbers

Figure	Value	Source
PCAOB confirmation standard	AS 2310; negative requests alone are never sufficient	[1]
Sample projection (AS 2315 example)	$3,000 in a 1-in-20 sample projects to $60,000	[1]
Management's going-concern horizon (US GAAP)	One year after the statements are issued	[2]
Issuer auditor's going-concern horizon	Not beyond one year after the balance sheet date	[2]

Key takeaways

• Test the accuracy and completeness of client data before using it as evidence.
• Direct, external and original beat indirect, internal and copied; inquiry alone never suffices.
• Project sample misstatements and compare with tolerable misstatement; a sample deviation rate above the tolerable rate defeats planned reliance.
• Control the confirmation process; evaluate exceptions; follow up and apply alternative procedures to nonresponses.
• Estimates: methods, data, significant assumptions, and a watch for bias.
• Lawyer refusal and management refusal of representations are both scope limitations.
• First-type subsequent events adjust; second-type events disclose.

Chapter 3 quiz — 25 questions

1. Before using an aged receivables report generated by an issuer's ERP system to select confirmation items, what does PCAOB AS 1105 require the auditor to do with the report?

• A. Recompute the aging of the ten largest customers only.
• B. Test its accuracy and completeness, or test the related controls.
• C. Accept it, because it was produced by an automated system.
• D. Obtain a written representation that the report is correct.

2. In an issuer audit, which item of evidence is generally the most reliable under PCAOB AS 1105?

• A. A photocopy of the bank statement supplied by the controller.
• B. A bank statement the auditor got from the bank.
• C. The client's own bank reconciliation, prepared by the treasurer.
• D. The controller's explanation of the reconciling items.

3. The auditor of an issuer wants the strongest evidence that a three-way-match control over purchases operated effectively. Which procedure provides it?

• A. Asking the accounts payable supervisor how the match is performed.
• B. Reading the procedures manual that describes the match.
• C. Independently re-performing the match for a sample of transactions.
• D. Watching the clerk perform the match on one afternoon.

4. An issuer auditor selects every twentieth invoice (100 of 2,000) and finds overstatements totalling $4,500. Items examined 100% contain a further $6,000 of overstatement. Tolerable misstatement is $80,000. Using the ratio projection AS 2315 illustrates, what should the auditor conclude?

• A. Total projected misstatement is $51,000, below tolerable misstatement.
• B. Total projected misstatement is $90,000, above tolerable misstatement.
• C. Total projected misstatement is $10,500, well below tolerable misstatement.
• D. Total projected misstatement is $96,000, which is above tolerable misstatement.

5. In a substantive test of details for an issuer, the sample leads the auditor to conclude that receivables are not materially misstated when in fact they are. Which risk has materialised?

• A. The risk of incorrect acceptance.
• B. The risk of incorrect rejection.
• C. Nonsampling risk.
• D. The risk of assessing control risk too low.

6. Testing an issuer's approval control, the auditor sets a tolerable rate of 5%, examines 80 items and finds 6 deviations. What does the result mean?

• A. The 7.5% sample rate exceeds 5%, but the control is effective overall.
• B. The 6% sample rate exceeds 5%, so the auditor should expand the sample to 100.
• C. The 4.8% sample rate is below 5%, so planned reliance is supported.
• D. The 7.5% sample rate exceeds 5%, so the planned reliance is not supported.

7. An issuer's auditor concludes, from a sample, that a control is operating effectively when its true deviation rate is above the tolerable rate. Which aspect of sampling risk is this?

• A. Incorrect rejection.
• B. Assessing control risk too high.
• C. Nonsampling risk.
• D. Assessing control risk too low.

8. To save time, the auditor of an issuer proposes to send negative confirmation requests as the only evidence for a significant receivables balance with a high assessed risk. Under PCAOB AS 2310, is that sufficient?

• A. Yes, if the requests are sent by the auditor rather than the client.
• B. No, unless the client signs each request in advance.
• C. No. Negative requests alone never provide sufficient appropriate evidence here.
• D. Yes, if the auditor receives no replies disagreeing with the balances.

9. A customer of an issuer mails its confirmation reply to the client's controller, who hands it to the auditor. What does PCAOB AS 2310 require?

• A. Ignore the reply and select a different customer.
• B. Accept the reply, since it came from the customer.
• C. Treat the balance as confirmed if the controller vouches for it.
• D. Ask the customer to re-send the reply directly to the auditor.

10. A confirmation reply shows a customer's balance as $38,000 lower than the issuer's records. What should the auditor do?

• A. Accept the client's explanation without further evidence.
• B. Evaluate whether it indicates a misstatement or deficiency.
• C. Discard the reply and confirm a different customer instead.
• D. Record the $38,000 as a timing difference and move on.

11. Two positive confirmation requests to an issuer's customers get no reply after follow-up. What does PCAOB AS 2310 require?

• A. Perform alternative procedures for those items.
• B. Replace them with two other customers.
• C. Treat the balances as confirmed.
• D. Treat the balances as misstatements and adjust them.

12. For an issuer, the auditor plans a substantive analytical procedure on payroll expense. Which factor most determines whether it can provide the evidence needed?

• A. Whether last year's payroll was audited without exceptions.
• B. Whether management agrees with the expectation.
• C. Whether the payroll balance exceeds materiality.
• D. The precision of the auditor's own expectation.

13. An issuer holds its inventory in its own warehouses. Which procedure best tests the existence of recorded inventory?

• A. Reviewing the client's written counting instructions.
• B. Selecting items on the warehouse floor and tracing them to the count sheets.
• C. Selecting items from the count sheets and locating them in the warehouse.
• D. Asking the warehouse manager whether the counts were accurate.

14. An issuer's outside counsel declines to comment on pending litigation in response to the auditor's letter of audit inquiry, either in writing or orally. What does PCAOB AS 2505 say about this?

• A. It is a scope limitation that precludes an unqualified opinion.
• B. It requires an adverse opinion on the financial statements.
• C. The auditor may rely on management's description instead.
• D. It is acceptable, because counsel owes duties to the client.

15. An issuer's financial statements for the year ended 31 December 2025 are issued on 15 March 2026. Which statement about the going-concern horizons is correct?

• A. Both management and the auditor look to 31 December 2026.
• B. Management looks to 31 December 2026; the auditor to 15 March 2027.
• C. Management to 15 March 2027; the auditor to 31 December 2026.
• D. Both management and the auditor look to 15 March 2027.

16. After considering management's plans, the auditor of an issuer concludes that substantial doubt about its ability to continue as a going concern remains, and the disclosures are adequate. What does PCAOB AS 2415 require in the report?

• A. No change, because the disclosures are adequate.
• B. A titled explanatory paragraph immediately after the opinion.
• C. A disclaimer of opinion, because the future cannot be audited.
• D. A qualified opinion, because the going-concern basis may be wrong.

17. An issuer's year ends 31 December. On 20 January, before the report is issued, a major customer files for bankruptcy because of losses it had suffered over the previous year. How should the receivable be treated?

• A. Ignore it, because events after year-end never affect the statements.
• B. Disclose the bankruptcy only, because it occurred after year-end.
• C. Defer the matter to next year's financial statements.
• D. Adjust the allowance, because the condition existed at year-end.

18. On 15 February, before the report date, fire destroys an issuer's main warehouse. Its year ended 31 December. How should the loss be reflected?

• A. Adjusted in the statements, because it occurred before the report date.
• B. Disclosed if material, but not adjusted in the year-end statements.
• C. Adjusted, and the prior year restated.
• D. Ignored, because it occurred after the balance sheet date.

19. The CEO and CFO of an issuer refuse to sign the management representation letter. What does PCAOB AS 2805 say about this?

Sources cited in this excerpt

1. Auditing Standards of the Public Company Accounting Oversight Board.
2. Going Concern: Management and Auditor Responsibilities (April 2020). Center for Audit Quality.