CPA Australia Advanced Audit and Assurance common mistakes
CPA Australia Advanced Audit and Assurance · Understand the traps and how to avoid them.
Writing generic 'obtain sufficient appropriate audit evidence' or 'assess the risk' statements as the answer to a scenario-based requirement, instead of naming the specific procedure, assertion, account balance and evidence source the scenario calls for.
Candidates memorise standard ISA phrasing during study and reproduce it under time pressure, without connecting it to the facts in the scenario (industry, entity size, control environment, identified risk). Markers award marks for applied, scenario-specific content, so generic boilerplate earns little even when technically true.
What to do instead
Before writing, extract the scenario facts into a short table: entity, industry, key transactions, identified risks, assertions at risk. Then force every answer sentence to name a specific account, assertion and procedure (for example 'vouch a sample of capitalised development costs to timesheets and technical feasibility sign-off to address the occurrence and valuation of intangible assets'). Practise by rewriting model generic sentences into scenario-specific ones and checking each against the facts given.
Answering the question that was asked in a prior topic (for example writing about audit risk when the requirement asks for fraud risk factors, or about going concern when the requirement asks about subsequent events), because the scenario triggers a familiar theme.
Under exam time pressure, candidates pattern-match the scenario to a memorised topic and start writing before reading the verb and the object of the requirement. The result is a technically correct answer to a different question, which scores zero for the requirement even if the content is sound.
What to do instead
Underline the requirement verb (identify, explain, evaluate, recommend, justify) and the object (risk, procedure, assertion, threat, safeguard). Restate the requirement in one sentence in your own words before planning. Allocate marks per requirement and check each paragraph answers that exact verb-object pair; delete or repurpose anything that answers a different requirement.
Treating ethical threats as a list to be named rather than a judgement to be applied: stating 'there is a self-interest threat' without identifying the specific threat, the party affected, the significance, and whether safeguards reduce it to an acceptable level or whether the engagement must be declined.
Candidates learn the five threat categories as definitions but not the APES 110 conceptual framework's evaluation step. They stop at labelling, missing the marks for assessing significance and recommending a specific safeguard or course of action.
What to do instead
Use a fixed four-step structure for every ethics scenario: (1) identify the threat type and the specific facts creating it; (2) identify who is affected (auditor, client, public interest); (3) evaluate significance, considering the nature of the relationship, the fee, the tenure and whether the client is a public interest entity; (4) conclude with a specific safeguard (for example rotating the engagement partner, independent review, removing the financial interest) or state that no safeguard is sufficient and the engagement must be declined. Write out all four steps even when the conclusion seems obvious.
Confusing the auditor's responsibilities with management's responsibilities in fraud, going concern and internal control answers, for example recommending that the auditor 'establish a whistleblower hotline' or 'prepare the cash flow forecast' to support the going concern conclusion.
Candidates blur the roles because the scenario describes weaknesses in management's processes and the natural response is to propose a fix, without checking whose responsibility the fix belongs to under ASA 240, ASA 570 and ASA 315. This is a common source of lost marks in scenario questions.
What to do instead
For every recommendation, ask 'who owns this under the standards?'. Management prepares the forecast, designs and operates controls and prevents and detects fraud; the auditor evaluates, challenges, tests and communicates. Frame auditor actions as procedures (evaluate management's assessment, challenge assumptions, obtain written representations, consider the need to modify the opinion) and management actions as recommendations to those charged with governance. Build a one-page responsibility map for fraud, going concern, laws and regulations, and internal control and refer to it during practice.
Choosing the audit opinion without applying the materiality and pervasiveness tests: recommending a qualified opinion for a pervasive going concern uncertainty, or an adverse opinion for a disagreement that is material but not pervasive, or omitting the separate 'Material Uncertainty Related to Going Concern' section where ASA 570 requires it.
Candidates remember the opinion types but not the two-dimensional decision (material vs pervasive; disagreement vs limitation of scope) or the going concern overlay. They also forget that a material uncertainty with adequate disclosure gets an unmodified opinion with a separate section, not a qualification.
What to do instead
Draw the decision matrix before answering: is the matter a disagreement or a limitation of scope; is it material only or material and pervasive. Then apply the going concern overlay: adequate disclosure with a material uncertainty gives an unmodified opinion with a separate 'Material Uncertainty Related to Going Concern' section; inadequate disclosure is a qualified or adverse opinion; and if the entity is not a going concern, the basis of preparation changes. Practise mapping at least six short scenarios to opinion type and section, and state the reason for the choice in one sentence each.
Describing a substantive procedure at too high a level (for example 'test a sample of receivables') without specifying population, sampling approach, assertion addressed, evidence examined and what would constitute an exception.
Candidates know the procedure categories but not how to operationalise them, and exam time rewards writing something quickly over writing something precise. Markers cannot award procedure marks to an answer that does not show what evidence is obtained and how it addresses the assertion.
What to do instead
Write every procedure in a fixed template: population and period; selection method (for example monetary unit sampling, haphazard, all items above a threshold); the document or external evidence inspected; the assertion addressed; and the exception condition. For example: 'Select a sample of year-end trade receivables using monetary unit sampling, agree each to the customer's purchase order, signed delivery docket and subsequent cash receipt, to address existence and valuation; investigate any balance not supported by a delivery docket or post-year-end receipt.' Apply the template in practice until it is automatic.
Ignoring the group audit dimension: answering a group scenario with a single-entity audit approach, failing to distinguish significant components from non-significant ones, and not addressing component materiality, component auditor instructions, access to component working papers, or the group engagement partner's responsibility for the group opinion.
Group audit under ASA 600 is heavily tested but conceptually dense, and candidates who have practised mostly single-entity scenarios default to that mental model. They also miss that the group engagement team must be involved in the work of component auditors and cannot simply rely on their report.
What to do instead
For any group scenario, work through the sequence: identify components and classify them as significant (individually financially significant or significant due to specific risks) or non-significant; determine the work required for each (audit of component financial information, audit of one or more account balances, or specified procedures); set component materiality below group materiality; issue component auditor instructions; plan involvement including review of component working papers and attendance at meetings; and evaluate whether sufficient appropriate evidence has been obtained for the group opinion. Practise with a multi-component scenario and document each step.
Producing a bare list of points with no explanation or linkage, so that 'identify and explain' or 'evaluate' requirements are answered as one-word bullets that cannot earn the explanation marks.
Candidates manage time by writing short bullets, but many requirements carry marks for the reasoning (why it is a risk, how the procedure addresses it, what the impact on the opinion is). Lists also make it hard for markers to see whether the candidate understands the point.
What to do instead
Adopt a point-plus-because structure: each bullet states the point, then one sentence of reasoning tied to the scenario, then the consequence. For 'explain' verbs, ensure every point has an explicit causal link ('because', 'which means', 'resulting in'). Rehearse with past-style requirements and count the marks available against the number of explained points produced.
Misallocating time: spending disproportionate time on the first requirement or on a long scenario reading, then leaving a later requirement unanswered or answered in note form, even though later requirements carry equal or greater marks.
Candidates read the whole scenario in detail before checking the marks per requirement, and perfectionism on the first requirement consumes the budget. Unanswered requirements are the single largest source of avoidable lost marks because even a brief, structured attempt earns some marks.
What to do instead
Before reading the scenario in depth, scan the requirements and note the marks for each. Allocate minutes roughly proportional to marks, allowing reading time. Answer in requirement order but enforce the time cap per requirement and move on, returning only if time remains. Practise full papers under timed conditions and record time per requirement to calibrate. Always leave a short structured attempt for every requirement rather than a blank.
Answering professional judgement and communication requirements without a clear conclusion: describing options for an audit committee or engagement partner but never stating a recommendation, or stating a conclusion without justifying it against the standards.
Candidates are comfortable describing technical content but hesitant to commit to a judgement, fearing it may be wrong. However, requirements using 'recommend', 'advise' or 'conclude' carry marks for a clear, justified position, and a hedged description forfeits them.
What to do instead
End every judgement requirement with an explicit conclusion sentence ('In my view the engagement should be accepted subject to X safeguard because Y'). Structure the answer as options, criteria (standards, ethical requirements, materiality), evaluation, then recommendation. Where the scenario is genuinely balanced, state the condition that would change the conclusion. Practise writing conclusions for ethics, opinion and reporting scenarios until committing to a position becomes habitual.