CPA AUD cheat sheet

AICPA Code threats include adverse interest, advocacy, familiarity, self-interest, self-review, undue influence, and management participation; evaluate whether safeguards reduce each threat to an acceptable level.

Independence is impaired when a covered member has a direct financial interest in the client, even if immaterial; indirect material interests in the client also impair independence.

The AICPA conceptual framework requires identifying threats, evaluating their significance, and applying safeguards; if safeguards cannot reduce threats, the relationship must be declined or terminated.

Under SEC/PCAOB rules, audit partner rotation ordinarily requires the lead engagement partner to rotate off after five consecutive years (seven for certain smaller firms).

Confidentiality prohibits disclosing client information without consent except for subpoenas or court orders, peer review, and ethical/quality reviews permitted by the Code.

Contingent fees are prohibited for attestation engagements and for tax services where the fee depends on the outcome of an audit-related matter.

Under SOX Section 201, nine non-audit services (e.g., bookkeeping, internal audit outsourcing, actuarial, investment advice) are prohibited for audit clients.

Rule 301 (confidential client information) and Rule 501 (acts discreditable) are the primary AICPA Code rules tested; both apply regardless of whether the member is independent.

GAAS general standards require adequate technical training and proficiency, independence in mental attitude, and due professional care.

Audit risk model: AR = IR × CR × DR; detection risk is inversely related to the assessed risks of material misstatement (RMM = IR × CR).

Inherent risk is assessed before considering controls; control risk addresses whether controls prevent or detect misstatements; detection risk is the auditor's residual risk from substantive procedures.

Materiality is set at the financial statement level and, when applicable, at performance materiality (typically 50–75% of overall materiality) for lower-level accounts.

The auditor must obtain an understanding of the entity and its environment, including its internal control, sufficient to identify and assess risks of material misstatement.

Significant risks are those close to the upper end of the inherent risk spectrum, including non-routine transactions, accounting estimates, and fraud risks; they require substantive procedures.

Analytical procedures are required in the risk assessment phase and in the final review phase; they are optional (but encouraged) during substantive testing.

The auditor's response to assessed risk includes overall responses (professional skepticism, staffing, supervision) and specific responses tied to assertion-level risks.

Under the fraud risk standard, the auditor presumes a risk of fraud in revenue recognition and must evaluate management override of controls.

Audit evidence is sufficient (quantity) and appropriate (relevance and reliability); external evidence is generally more reliable than internal evidence.

Inspection, observation, inquiry, confirmation, recalculation, reperformance, and analytical procedures are the seven audit procedures; inquiry alone is never sufficient.

External confirmations are required for accounts receivable unless the auditor determines they are not effective; positive confirmations request a response in all cases.

Audit sampling: sampling risk is the risk that the auditor's conclusion differs from conclusions based on testing the entire population; non-sampling risk arises from human error.

In a test of controls sample, tolerable deviation rate is the maximum rate of deviation the auditor is willing to accept; the upper deviation rate is compared to it.

For substantive tests of details, the projected misstatement plus sampling risk allowance is compared to tolerable misstatement to conclude whether the account is fairly stated.

Subsequent events procedures cover the period from the balance sheet date through the date of the auditor's report; the auditor has no obligation to perform procedures after that date.

Related party transactions require the auditor to obtain an understanding of the relationships and transactions and to evaluate whether they were properly identified, accounted for, and disclosed.

Going concern: the auditor evaluates management's plans when substantial doubt exists; if the doubt is not alleviated, an emphasis-of-matter paragraph is added to the report.

An unmodified (unqualified) opinion states the financial statements present fairly, in all material respects, the financial position, results of operations, and cash flows in accordance with the applicable framework.

A qualified opinion is issued when a misstatement or scope limitation is material but not pervasive; the opinion paragraph says 'except for' the matter.

An adverse opinion is issued when a misstatement is both material and pervasive; a disclaimer is issued when a scope limitation is both material and pervasive.

The auditor's report includes the opinion, basis for opinion, going concern (if applicable), key audit matters (if applicable), and responsibilities of management and the auditor.

For public companies under PCAOB standards, the auditor must opine on both the financial statements and internal control over financial reporting (integrated audit).

A change in accounting principle with proper disclosure and justification results in an unmodified opinion with an emphasis-of-matter paragraph (or, under some frameworks, an other-matter paragraph).

Report modifications for departures from GAAP are evaluated by materiality and pervasiveness; the auditor does not modify the opinion merely for a change in estimate.

The auditor's report date should not be earlier than the date on which the auditor has obtained sufficient appropriate evidence to support the opinion.

The auditor must communicate with those charged with governance significant findings, including the auditor's views on qualitative aspects of accounting practices and significant difficulties encountered.

Management representation letters are required for all audits; they are dated as of the date of the auditor's report and cover all financial statements and periods.

The auditor's report is addressed to the shareholders and board of directors (or equivalent) of the entity, not to management.

Documentation must be sufficient to enable an experienced auditor with no prior connection to the engagement to understand the work performed, evidence obtained, and conclusions reached.

The auditor should document the engagement acceptance/continuance decision, the risk assessment, and the basis for the opinion.

For a predecessor auditor, the successor auditor should communicate with the predecessor before accepting the engagement and obtain permission from the client.

Review of interim financial information (SSARS/attest) provides limited assurance; the accountant's report states that nothing came to the accountant's attention causing belief the statements are not in accordance with GAAP.

When the auditor's report is included in a document containing other information, the auditor must read the other information and consider whether it is materially inconsistent with the financial statements.

An attestation engagement under SSAE provides an opinion or conclusion on subject matter or an assertion; the level of assurance depends on the engagement type (examination, review, or agreed-upon procedures).

An examination provides reasonable assurance; a review provides limited assurance; an agreed-upon procedures engagement provides no assurance and reports findings only to specified parties.

A compilation (SSARS) provides no assurance; the accountant's report states that the accountant did not audit or review the financial statements and expresses no opinion or assurance.

A review engagement (SSARS) provides limited assurance; the accountant performs inquiry and analytical procedures and issues a report stating that nothing came to the accountant's attention indicating the statements are not in accordance with the framework.

For special purpose frameworks (cash basis, tax basis, regulatory basis), the auditor's report includes an emphasis-of-matter paragraph describing the basis of accounting.

When the auditor is engaged to report on supplementary information (e.g., schedules), the report should describe the auditor's responsibility and the procedures performed.

For an audit of internal control over financial reporting, the auditor expresses an opinion on the effectiveness of ICFR in addition to the financial statement opinion.

A firm's system of quality control includes leadership responsibilities, relevant ethical requirements, acceptance and continuance, human resources, engagement performance, and monitoring.

Engagement quality control review (EQCR) is required for audits of public companies and for engagements where the firm determines it is appropriate; the reviewer must be objective.

The monitoring component of quality control includes ongoing consideration and evaluation of the firm's system, including inspection of completed engagements.

Peer review is a periodic external review of a firm's quality control system; the report may be unmodified, modified, or adverse depending on findings.

The firm should establish policies for resolving differences of opinion within the engagement team before the report is issued.

Documentation retention: audit documentation should be retained for at least five years from the report date (or the date the report would have been issued).

The engagement partner is responsible for the overall quality of the engagement and for the direction, supervision, and review of the work performed.

Consultation with specialists or other professionals should be documented, including the nature of the consultation and the conclusions reached.