Auditing and Attestation (AUD): Risk, Evidence, and Reporting
Auditing and Attestation (AUD) tests whether a candidate can plan and perform an audit under GAAS or PCAOB standards, assess risk, gather and evaluate evidence, and issue an appropriate report. The exam rewards precise use of the audit risk model, assertions, materiality, and reporting logic rather than memorized lists.
Risk and materiality
The audit risk model is AR = IR × CR × DR. The auditor sets a low acceptable audit risk, assesses inherent risk and control risk, and solves for detection risk. Lower detection risk means the auditor must perform more persuasive substantive procedures. Set overall materiality for the financial statements as a whole, then performance materiality below it to cover aggregation risk.
Evidence and assertions
Evidence must be sufficient and appropriate. Confirmations, inspection, and reperformance are generally stronger than inquiry. Test relevant assertions: existence, completeness, valuation, cutoff, rights and obligations, and presentation.
Worked example
Acceptable audit risk is 5%, inherent risk 80%, control risk 50%. Detection risk = 0.05 / (0.80 × 0.50) = 0.125, or 12.5%. Because this is low, the auditor should increase sample sizes, use more reliable procedures, and test closer to year-end. If controls are tested and control risk is reduced to 25%, detection risk becomes 25%, allowing less substantive testing-but only if control testing supports the lower assessment.
Traps
Do not say that increasing detection risk reduces audit work; the relationship is inverse. Inquiry alone is rarely sufficient. A GAAP departure produces a qualified or adverse opinion; a scope limitation produces a qualified opinion or disclaimer. Do not confuse performance materiality with tolerable misstatement, and do not rely on controls without testing them.