CPA Advanced Auditing common mistakes
CPA Advanced Auditing · Understand the traps and how to avoid them.
Treating 'reasonable assurance' and 'limited assurance' as interchangeable when writing conclusions, issuing an unmodified conclusion for a review engagement that says the subject matter 'presents fairly, in all material respects'.
Candidates memorise conclusion wording for audits and then reuse it in review and other assurance engagements without checking the level of assurance and the applicable standard's prescribed phrasing.
What to do instead
Before writing any conclusion, state the engagement type, the assurance level, and the standard applied in a one-line header, then draft the conclusion from that header. Practise writing side-by-side conclusions for an audit (reasonable assurance, 'gives a true and fair view / presents fairly'), a review (limited assurance, 'nothing has come to our attention'), and a compilation (no assurance). Check that the negative-form conclusion is used only where limited assurance applies.
Assessing risk at the financial statement level only, then jumping straight to substantive testing without linking identified risks to specific assertions and designing responsive procedures for each.
Risk assessment is studied as a separate chapter, so candidates produce a generic risk list (pressure, weak controls, complexity) and never convert those risks into assertion-level responses, which is what the marking rubric rewards.
What to do instead
Build a three-column table in every answer: risk identified, assertions affected (occurrence, completeness, valuation, cut-off, rights, presentation), and the specific responsive procedure with the assertion it addresses. For each significant risk, explicitly state why it is significant and whether it is a risk of material misstatement due to fraud or error. If a risk maps to no procedure, the answer is incomplete.
Using the audit risk model mechanically (setting detection risk low and concluding 'do more testing') without recognising that inherent risk and control risk are assessed, not chosen, and that the model is inverted (audit risk = inherent × control × detection).
The formula is easy to memorise and easy to misapply; candidates invert it, plug in arbitrary numbers, or treat detection risk as an input rather than the residual the auditor controls.
What to do instead
Write the model out and label each term's status: inherent and control risk are assessments of the entity; detection risk is the auditor's lever, and it moves inversely to the acceptable level of audit risk and to the assessed risks. Practise a worked example where assessed risks increase, detection risk falls, and the nature, timing, and extent of procedures change accordingly. Never present a numerical audit risk calculation as if the model were arithmetically precise.
Concluding that a deficiency in internal control is a significant deficiency or material weakness without applying the likelihood-and-magnitude judgement, or conversely dismissing a deficiency because no misstatement has yet occurred.
Candidates conflate 'deficiency', 'significant deficiency', and 'material weakness', and forget that a material weakness can exist even when no misstatement has been detected, because the possibility of misstatement is what matters.
What to do instead
For every deficiency, state the criterion (design or operating), the assertion and account affected, the likelihood of a misstatement, the potential magnitude, and whether compensating controls exist. Then classify. Remember that a reasonable possibility of a material misstatement not being prevented or detected on a timely basis defines a material weakness, regardless of whether it has yet caused an error. Also distinguish the audit of internal control conclusions from management's assessment.
Designing samples by picking items judgementally (largest balances, round numbers, last month's transactions) and then projecting the result to the population, or applying attribute sampling logic to a test of monetary balances.
Candidates learn sampling as formulae and lose track of the sampling objective: which population, which sampling unit, and which conclusion the method supports. They also ignore stratification and the effect of expected misstatement.
What to do instead
For any sampling question, first state the objective (test of controls = deviation rate; substantive = monetary misstatement), then the population and sampling unit, then the method (attribute, MUS/PPS, classical variables), then how the result is evaluated and projected. Only statistical or properly designed sampling supports projection. Note that MUS is suited to populations with low exception rates and overstatement risk, and that stratification reduces variability.
Accepting management's written representations and verbal explanations as sufficient appropriate audit evidence for a matter that requires corroboration, especially for related-party transactions, litigation, and management intent.
Representations are convenient and candidates treat them as a substitute for evidence rather than as a supplement. They also forget that representations are required but cannot replace other procedures.
What to do instead
Apply the rule: representations corroborate, they do not substitute. For each contentious area, name the corroborating procedure (external confirmation, lawyer's letter, contract inspection, board minutes, subsequent events review). Where evidence is unavailable, evaluate a scope limitation and consider a qualified opinion or disclaimer rather than relying on the representation. Also check the representation letter's date and that it covers all periods and matters.
Drafting the audit report by assembling the required sections in the wrong order or omitting a section that becomes mandatory when an emphasis of matter, key audit matters, or a going concern material uncertainty is present.
Candidates memorise the sections as a list and do not rehearse how the report changes with the opinion type and with additional communication requirements.
What to do instead
Learn the report as a decision tree: opinion first, then basis for opinion, then going concern where relevant, then key audit matters (for listed entities), then responsibilities, then other reporting responsibilities. For each modification (qualified, adverse, disclaimer), state whether the basis paragraph is placed before or after the opinion and how the opinion paragraph is headed. Practise converting one set of facts into four different reports.
Concluding on going concern by relying only on the cash flow forecast management provided, without testing the reasonableness of the assumptions, the adequacy of disclosure, and the need for a material uncertainty paragraph.
The going concern standard is studied as a checklist of indicators, so candidates list indicators and then accept management's mitigation plan without evaluating whether it is feasible.
What to do instead
Structure the answer in three steps: evaluate the appropriateness of management's assessment (period covered, assumptions, sensitivity, feasibility of mitigation), evaluate the adequacy of disclosure, and then determine the reporting consequence (unmodified with material uncertainty paragraph, or modified opinion if disclosure is inadequate or the entity is not a going concern). State the period the auditor must consider and how subsequent events bear on it.
Treating independence threats as a list to name rather than a judgement to complete: identifying a self-interest or familiarity threat but not evaluating its significance or the safeguards available, and not distinguishing prohibited non-assurance services from permitted ones.
Candidates memorise the five threat categories and stop there, forgetting that the requirement is to evaluate significance and address the threat, and that some services are prohibited outright for audit clients.
What to do instead
For every independence scenario, write: the threat category, the facts creating it, whether it is at an acceptable level, the safeguard or action (decline, rotate, remove the individual, independent review), and the conclusion. Learn the categories of prohibited services for audit clients (for example, assuming management responsibility, certain tax and valuation services with material effects) and the differences for public interest entities.
Producing answers that describe what the auditor should do in general terms without naming the specific standard, the assertion, or the documentation requirement, so the answer cannot be distinguished from a candidate who has not studied.
Time pressure encourages essay-style prose; candidates write plausible process descriptions instead of the standard-anchored, decision-linked answers the exam rewards.
What to do instead
Adopt a fixed answer skeleton: issue, applicable standard, requirement, application to the facts, conclusion. Name the standard by its topic (quality management, risk assessment, audit evidence, reporting) rather than vaguely, cite the specific assertion and the specific procedure, and state the documentation that would evidence the work. Rehearse this skeleton under timed conditions on past-style scenarios until it is automatic.