AU-M common mistakes
AU-M · Understand the traps and how to avoid them.
Describing audit procedures as 'obtain understanding' or 'review documents' without specifying what evidence is sought, from which population, and what would confirm or contradict the assertion.
Candidates memorise procedure labels from study guides and reproduce them verbatim, treating the label as the answer rather than translating it into a testable action tied to an assertion.
What to do instead
For every procedure written, force yourself to state three things: the assertion addressed, the source and population of evidence, and the condition that would indicate a problem. Practise rewriting vague procedures into that three-part form until it becomes automatic.
Treating inherent risk, control risk, and detection risk as independent labels to be assigned, rather than as a linked model where a high assessed risk of material misstatement must drive a lower acceptable detection risk and therefore more persuasive evidence.
The risk model is often learned as three definitions and a formula, so candidates can recite it but do not apply the directional logic when asked how evidence changes in response to risk.
What to do instead
Work backwards from every scenario: identify the assertion at risk, state the assessed risk level, then derive the required nature, timing, and extent of procedures. Rehearse the sentence 'because risk is high, detection risk must be low, therefore I need external, corroborating, period-end evidence.'
Concluding that a control is effective because no exceptions were found in the sample, without considering whether the sample was large enough, whether the control operated throughout the period, or whether it was tested by inquiry alone.
Candidates conflate 'no error observed' with 'control operating effectively' and forget that inquiry alone never provides sufficient evidence of operating effectiveness, and that a small sample cannot support a period-wide conclusion.
What to do instead
Before concluding, check three gates: was the control tested by inspection, observation, or reperformance rather than inquiry alone; does the sample size reflect the frequency of operation; and does the evidence cover the whole reliance period, including any roll-forward. If any gate fails, extend testing or withdraw reliance.
Answering independence questions by focusing only on the immediate engagement team and ignoring the firm-wide network, immediate family, and financial-interest thresholds.
Independence is studied as a list of prohibited relationships, so candidates apply the rule to the named individual in the scenario and overlook that the restriction extends to the firm, network firms, and close family members.
What to do instead
For any independence scenario, run a fixed checklist: who is the covered person, who are their immediate family, does the interest sit with the firm or a network firm, is the interest direct or indirect, and is it material. Answer each element explicitly before concluding.
Selecting a sample and then, when an error is found, replacing the item or expanding the sample informally without projecting the deviation, so the conclusion is based only on the clean items.
Candidates want the sample to 'pass' and treat an exception as an inconvenience rather than as information about the population, forgetting that deviations must be projected and investigated for their nature and cause.
What to do instead
Commit in advance to a rule: every deviation is investigated, its nature and cause documented, and the rate projected to the population. If the projected rate exceeds tolerable, extend testing or conclude the control is ineffective. Never substitute items after selection.
Writing an audit conclusion or opinion that states 'the financial statements are accurate' or 'the company is financially sound' instead of addressing whether they are presented fairly in accordance with the applicable framework.
Everyday language about accuracy and health is more natural than the technical concept of fair presentation, and candidates default to it without noticing the change in meaning and the implied absolute assurance.
What to do instead
Draft conclusions using a fixed template: 'In our opinion, the financial statements present fairly, in all material respects, in accordance with [framework].' Practise identifying and deleting any absolute-assurance or viability language in your own answers.
Treating a subsequently discovered fact, a change in estimate, and a prior period error as interchangeable when deciding the accounting treatment and the auditor's response.
All three involve numbers from an earlier period, so candidates classify by timing rather than by whether new information existed at the time, which determines the correct treatment.
What to do instead
Ask one diagnostic question: did information exist or an obligation arise at the reporting date? If yes and it was misused, it is an error; if the information is genuinely new, it is a change in estimate or a subsequent event. Apply that test before choosing the journal entry or audit response.
Accepting a system-generated report or data extract as audit evidence without testing the completeness and accuracy of the information produced by the entity.
Candidates focus on the audit procedure itself and overlook that the reliability of any test depends on the reliability of the underlying data, so a clean recalculation on bad data is treated as good evidence.
What to do instead
Whenever evidence comes from an entity system, add an explicit step: test the report logic or query, reconcile the record count and control totals to source, and confirm the parameters were not altered. State this step in your answer before relying on the output.
Assessing risk at the financial statement level only, then designing substantive procedures that are identical across all significant account balances regardless of the specific assertions at risk.
Candidates learn the risk assessment phase as a preliminary step to be documented, then jump to a standard programme without linking identified risks to tailored procedures.
What to do instead
Build a bridging table for each significant risk: risk description, affected account and assertion, planned response, and the evidence that would show the response worked. If a planned procedure cannot be traced to a specific risk in the table, delete it or justify it as a general procedure.
Answering ethical dilemma questions by naming the threat category and stopping there, without applying safeguards or escalating through the firm's channels.
Threat categories are the most memorable part of the ethics syllabus, so candidates produce the label and assume the analysis is complete, missing that the question asks what the auditor should do.
What to do instead
Structure every ethics answer as: identify the threat and its significance, evaluate whether it can be reduced to an acceptable level, apply specific safeguards or decline the engagement, and document and escalate. Always end with the action, not the classification.