Auditing and Attestation (AUD)
Use the AUD guide to move from ethics and engagement setup through risk assessment, evidence, reporting, and review.
The AUD section tests whether you can connect a fact pattern to the right engagement responsibility, risk response, evidence decision, documentation requirement, and reporting outcome. This guide is meant to be read as a process flow rather than as a random collection of audit topics.
Chapter Map
Part I: Introduction and Foundations for ethics, independence, engagement acceptance, and the professional framework that drives later audit judgments.
Part II: Assessing Risk and Developing a Plan for internal control concepts, entity understanding, risk assessment, materiality, and planned responses.
Part III: Performing Further Procedures and Obtaining Evidence for tests of controls, substantive work, sampling, estimates, and evidence evaluation.
Part IV: Reporting, Attestation, and Related Engagements for audit conclusions, modifications, special reporting situations, and non-audit engagements that still appear in AUD scope.
Part V: IT, Forensics, and ESG Assurance for IT, data, and newer cross-cutting issues that build on the core audit workflow.
Part VI: Appendices for quick-reference material after the main reading path is in place.
AUD questions should be answered by locating the engagement stage first. The same fact can mean different things during acceptance, planning, evidence collection, evaluation, or reporting. A strong answer explains the practitioner’s responsibility at that stage and then chooses the procedure, documentation, communication, or report consequence that follows.
AUD Workflow Lens
AUD stage
What to decide
Common trap
Ethics and acceptance
Whether the practitioner can accept or continue the engagement.
Starting audit work before independence, prerequisites, or engagement terms are resolved.
Risk assessment and planning
Which risks, assertions, controls, and materiality judgments drive the audit plan.
Choosing procedures without connecting them to assessed risk.
Evidence and further procedures
Whether the evidence is sufficient, appropriate, and responsive to the assertion.
Treating inquiry or generic analytics as enough for a material assertion.
Evaluation and reporting
Whether findings change the opinion, add language, or require communication.
Confusing a scope limitation with a GAAP departure.
Related and advanced engagements
Which standards, criteria, users, and report restrictions apply.
Applying financial statement audit reporting logic to a review, compilation, attestation, SOC, or forensic engagement.
AUD Problem-Solving Sequence
Step
What to identify
Why it matters
1. Engagement type
Audit, review, compilation, preparation, attestation, SOC, governmental, or specialized engagement.
Standards and assurance level differ by engagement type.
2. Engagement stage
Acceptance, planning, risk assessment, evidence gathering, evaluation, reporting, or communication.
The same fact can imply different responsibilities at different stages.
3. Relevant assertion or objective
Existence, completeness, valuation, rights, presentation, control objective, or criteria.
Procedures must respond to the objective being tested.
4. Evidence and documentation
Source, reliability, sufficiency, appropriateness, and working-paper support.
AUD answers depend on supportable conclusions.
5. Reporting or communication result
Opinion effect, paragraph, restriction, required communication, or no report change.
The final consequence follows from the facts and engagement type.
How to Use This Guide
Read Parts I through IV in order if audit workflow, evidence selection, or report consequences feel fragmented.
Use Part V after the core sequence is stable so advanced topics reinforce, rather than replace, the main audit process.
Return to Part VI only after the main chapters, when you want compressed review support before practice.
In this section
AUD Introduction, Ethics, and Engagement Foundations
AUD orientation to the profession, ethics, independence, engagement setup, and core audit foundations.
The Auditing Profession, Standard Setters, and AUD Exam Orientation
Introduction to the external auditor's role, standard setters, AUD structure, and early study strategy.
Ethics, Professional Responsibilities, and Auditor Independence
AUD ethics coverage for professional conduct, independence, skepticism, liability, and applied ethical judgment.
Applying the AICPA Code of Professional Conduct to Audit Decisions
How the AICPA Code frames ethical duties, enforceable rules, and auditor conduct.
Comparing Auditor Independence Requirements Across AICPA, PCAOB, SEC, GAO, and DOL
How major independence regimes align, differ, and affect AUD conclusions.
Using Professional Skepticism and Judgment Throughout the Audit
How auditors apply skepticism, avoid bias, and document judgment through the engagement.
Understanding Auditor Legal Liability and Malpractice Exposure
How common-law and statutory liability shape auditor risk and professional care.
Working Through Audit Ethics Dilemmas and Practice Cases
How ethics frameworks apply to real audit dilemmas, pressure, and professional consequences.
Engagement Acceptance, Terms, and Foundational Audit Requirements
AUD engagement-setup coverage for prerequisites, predecessor communication, letters, documentation, quality control, and planning logistics.
Evaluating Audit Engagement Prerequisites Before Acceptance
How auditors assess client integrity, competence, independence, and engagement risk before acceptance.
Communicating with Predecessor Auditors and Management Before Acceptance
How successor auditors use management and predecessor communication in acceptance decisions.
Defining Audit Scope, Objectives, and Responsibilities in the Engagement Letter
How engagement letters define scope, objectives, responsibilities, and audit terms.
Meeting Audit Documentation Requirements and Retention Rules
How audit workpapers should be documented, organized, retained, and protected.
Maintaining Quality Control at the Firm and Engagement Levels
How firm-level and engagement-level quality systems support compliant audit work.
Managing Engagement Staffing, Budgets, and Scheduling
How staffing, budgets, and scheduling affect audit quality, timing, and engagement execution.
AUD Risk Assessment, Internal Control, and Audit Planning
AUD risk-assessment coverage for entity understanding, internal control, risk identification, and audit planning.
Understanding the Entity, Industry Pressures, and Fraud-Risk Context
AUD entity-understanding coverage for industry factors, economic conditions, governance, and fraud-risk context.
Assessing Industry and Regulatory Influences on Audit Risk
How industry conditions, laws, and regulatory oversight shape inherent risk and audit planning.
Evaluating Economic and Market Conditions in Audit Planning
How macroeconomic and market conditions affect audit risk, assertions, estimates, and planning.
Understanding Corporate Governance and Sarbanes-Oxley Considerations
How governance structure, audit committees, and SOX requirements influence audit risk and oversight.
Recognizing Fraud Risk Factors in the Planning Stage
How incentives, opportunities, rationalization, and red flags shape fraud-risk assessment in audit planning.
Internal Control Frameworks, IT Controls, and Control Documentation
AUD control-framework coverage for COSO, entity-level controls, IT controls, walkthroughs, and control limitations.
Identifying Risks of Material Misstatement, Assertions, and Materiality
AUD risk-identification coverage for assertions, inherent versus control risk, fraud risk, and materiality.
Linking Significant Accounts, Transactions, and Assertions
How auditors connect significant balances, transaction classes, and disclosures to assertion-level risks.
Distinguishing Inherent Risk from Control Risk in Audit Planning
How auditors separate inherent risk from control risk and use both to assess risk of material misstatement.
Responding to Fraud Risks Through Detection, Response, and Documentation
How fraud-risk brainstorming, tailored responses, unpredictability, and documentation affect audit planning.
Setting Materiality and Performance Materiality in the Audit
How auditors set, revise, and apply overall materiality, performance materiality, and qualitative materiality.
Planning Audit Strategy, Procedures, and Use of Others
AUD planning coverage for strategy, procedure selection, group audits, use of others, and technology in planning.
Building the Overall Audit Strategy from Assessed Risk
How overall audit strategy reflects financial-statement and assertion-level risk.
Selecting Audit Procedures by Nature, Timing, and Extent
How risk drives the nature, timing, and extent of audit procedures.
Planning Group Audits, Component Auditors, and Consolidations
How the group engagement team plans component work, supervises component auditors, and evaluates consolidation evidence.
Deciding When to Rely on Internal Audit, Specialists, and Others
How external auditors evaluate internal audit work, specialists, and service organization evidence without giving up audit responsibility.
Using Data Analytics and Emerging Technologies in Audit Planning
How auditors use data analytics, automation, AI, and emerging technology to refine risk assessment and audit planning.
AUD Further Procedures, Testing, and Audit Evidence
AUD evidence-stage coverage for procedures, control testing, substantive work, estimates, and evaluation of results.
Gathering Sufficient Appropriate Audit Evidence
AUD evidence-framework coverage for procedure types, sampling, evidence sources, analytics, and documentation.
Choosing Between Tests of Controls and Substantive Procedures
How auditors decide whether evidence should come from control testing, substantive testing, or both.
Using Audit Sampling to Gather Evidence Efficiently
How auditors design samples, evaluate sampling risk, and project results to the population.
Collecting Evidence Through Observation, Inquiry, Inspection, and Confirmation
How common evidence procedures differ in reliability, assertion support, and documentation value.
Applying Analytical Procedures and Data Analytics in Audit Testing
How auditors build expectations, investigate anomalies, and use analytics as audit evidence.
Preparing Working Papers and Documenting Audit Results
How audit documentation records procedures, evidence, conclusions, review, assembly, and retention.
Testing Internal Controls and Evaluating Deviations
AUD control-testing coverage for walkthroughs, deviations, deficiency communication, and integrated audit work.
Substantive Testing of Accounts, Transactions, and Audit Cycles
AUD substantive-testing coverage for major transaction cycles, inventory, fixed assets, and investments.
Substantive Testing of Revenue and Cash Receipts
How auditors test revenue occurrence, cutoff, receivables, and cash receipts for material misstatement.
Substantive Testing of Purchases, Expenditures, and Payroll
How auditors test expenditures, payables, payroll, and related fraud risks through substantive procedures.
Auditing Inventory Observation, Existence, and Costing
How auditors test inventory existence, count procedures, cutoff, costing, and valuation.
Auditing Fixed Assets, Depreciation, and Impairment
How auditors test fixed asset additions, existence, depreciation, disposals, and impairment indicators.
Auditing Investments and Fair Value Measurements
How auditors test investment existence, ownership, valuation inputs, fair value hierarchy, and disclosures.
Auditing Estimates, Related Parties, and Other Special Matters
AUD special-matter coverage for estimates, related parties, litigation, going concern, and use of specialists.
Auditing Accounting Estimates, Provisions, and Contingencies
How auditors test accounting estimates, provisions, contingencies, estimation uncertainty, and management bias.
Auditing Related Parties, Related-Party Transactions, and Disclosure
How auditors identify related parties, test unusual related-party transactions, and evaluate required disclosures.
Auditing Legal Claims, Litigation, and Loss Contingencies
How auditors identify legal claims, evaluate loss likelihood, use attorney letters, and test litigation disclosures.
Evaluating Going Concern, Management Plans, and Substantial Doubt
How auditors evaluate going concern indicators, management's plans, substantial doubt, disclosure, and reporting effects.
Using and Evaluating the Work of an Auditor's Specialist
How auditors decide when to use a specialist and evaluate the specialist's competence, objectivity, work, and conclusions.
Evaluating Misstatements and Concluding on Audit Results
AUD conclusion coverage for misstatement aggregation, qualitative materiality, final review, and pre-report steps.
AUD Reporting, Attestation, and Related Engagements
AUD reporting coverage for audit opinions, ICFR, SSARS services, attestation work, and specialized engagements.
Audit Reporting, Opinion Types, and Explanatory Language
AUD reporting coverage for opinion types, explanatory paragraphs, comparative statements, supplementary information, and disclosure problems.
Selecting the Proper Audit Opinion for Misstatements and Scope Limitations
How auditors choose unmodified, qualified, adverse, or disclaimer opinions based on evidence, misstatement, and pervasiveness.
Using Emphasis-of-Matter, Other-Matter, and Explanatory Paragraphs
How auditors use emphasis-of-matter, other-matter, and explanatory paragraphs without necessarily modifying the audit opinion.
Reporting on Comparative Statements and Predecessor Auditor Involvement
How auditors report on comparative financial statements, prior periods, predecessor auditors, and consistency matters.
Reporting on Required Supplementary, Supplementary, and Other Information
How auditors distinguish RSI, supplementary information, and other information presented with audited financial statements.
Responding to Omitted, Incomplete, or Inconsistent Required Disclosures
How auditors evaluate omitted, incomplete, or inconsistent disclosures and decide whether the report must be modified.
Reporting on Internal Control Over Financial Reporting
AUD ICFR reporting coverage for issuer requirements, integrated audits, deficiency communication, and report structure.
Special Reporting Frameworks, Interim Work, and Summary Reporting
AUD special-reporting coverage for special-purpose frameworks, interim reviews, consistency issues, and summarized statements.
Reporting on Financial Statements Prepared Under Special-Purpose Frameworks
How auditors report on cash, tax, regulatory, contractual, and other special-purpose accounting frameworks.
Performing Public Company Interim Reviews and Reporting Negative Assurance
How auditors review issuer interim financial information using inquiry, analytical procedures, and negative assurance reporting.
Reporting on Consistency, Accounting Changes, and Error Corrections
How auditors evaluate accounting principle changes, estimate changes, reporting-entity changes, and error corrections when comparability is affected.
Reporting on Summary Financial Statements Derived From Audited Statements
How auditors report when summary financial statements are derived from a complete set of audited financial statements.
Review, Compilation, and Preparation Engagements Under SSARS
AUD SSARS coverage for reviews, compilations, preparation engagements, reports, and assurance limits.
Applying the SSARS Framework to Preparation, Compilation, and Review Engagements
How SSARS separates preparation, compilation, and review engagements by assurance level, independence requirements, procedures, and reporting.
Review Reports and Negative Assurance Under SSARS
How SSARS review reports communicate limited assurance, required procedures, report elements, and engagement limitations.
Compilation Reports and No-Assurance Disclaimer Language Under SSARS
How compilation engagements present management financial information, disclaim assurance, handle omitted disclosures, and respond to known departures.
Preparation Engagements and the No-Assurance Legend Under SSARS
How AR-C 70 preparation engagements work when the accountant prepares financial statements but provides no assurance and normally issues no report.
Attestation Services, Compliance Reporting, and SOC Reports
AUD attestation coverage for examinations, reviews, agreed-upon procedures, prospective information, compliance, and SOC reports.
Comparing SSAE Examinations, Reviews, and Agreed-Upon Procedures
How SSAE examinations, reviews, and agreed-upon procedures differ by subject matter, criteria, assurance level, procedures, and report wording.
Reporting on Forecasts, Projections, and Prospective Financial Information
How practitioners distinguish forecasts from projections and report on prospective financial information through examinations or agreed-upon procedures.
Reporting on Compliance Attestation Engagements and Special Reports
How practitioners evaluate compliance with laws, regulations, contracts, and grants through examination or agreed-upon procedures reports.
Distinguishing SOC 1, SOC 2, SOC 3, Type 1, and Type 2 Reports
How SOC reports differ by control objective, intended users, Trust Services Criteria, financial statement relevance, and Type 1 versus Type 2 coverage.
Governmental Audits, Single Audits, and Restricted-Use Reporting
AUD specialized-engagement coverage for Yellow Book work, single audits, governmental engagements, and restricted-use reports.
Applying Yellow Book Government Auditing Standards to Public-Sector Engagements
How Government Auditing Standards add public-interest, independence, quality-management, internal-control, compliance, and reporting requirements to governmental engagements.
Performing Single Audits of Federal Awards Under Uniform Guidance
How Single Audits combine financial statement audits, Yellow Book reporting, SEFA procedures, and major-program compliance testing for federal awards.
Applying Performance, Program-Specific, and Other Specialized Governmental Engagements
How AUD candidates should distinguish performance audits, program-specific audits, state and local reviews, and other governmental engagements from ordinary financial statement audits.
Applying Restricted-Use Alerts and Compliance Reporting in Specialized Engagements
How restricted-use alerts, specified-party reports, noncompliance findings, and compliance-reporting layers affect governmental and specialized engagements.
Auditing Employee Benefit Plans and ERISA Reporting
AUD specialized-audit coverage for employee benefit plans, ERISA requirements, plan procedures, and reporting.
Distinguishing Defined Contribution, Defined Benefit, and Other Employee Benefit Plan Types
How employee benefit plan type changes the audit focus for contributions, participant accounts, benefit obligations, investments, funding, and disclosures.
Applying DOL, ERISA, and Form 5500 Requirements in Employee Benefit Plan Audits
How DOL filing rules, ERISA fiduciary duties, Form 5500 reporting, and ERISA Section 103(a)(3)(C) elections shape employee benefit plan audits.
Performing Employee Benefit Plan Audit Procedures for Participant Data, Contributions, Investments, and Distributions
How auditors test employee benefit plan participant data, contributions, distributions, loans, investments, certifications, and ERISA compliance risks.
Reporting on Employee Benefit Plan Financial Statements and ERISA Supplemental Schedules
How employee benefit plan audit reports address plan financial statements, ERISA Section 103(a)(3)(C) elections, disclosures, and required supplemental schedules.
AUD IT Audit, Forensic, and ESG Assurance Topics
AUD advanced coverage for IT audit, cybersecurity, investigative work, and ESG-related assurance topics.
IT Auditing, Cybersecurity, and Technology-Enabled Audit Work
AUD advanced coverage for IT audit fundamentals, modern environments, ITGC testing, analytics, cybersecurity, and cyber SOC.
Applying IT Audit Fundamentals to Financial Statement Risk and Control Reliance
How auditors connect IT general controls, application controls, system-generated information, and cybersecurity risks to financial statement audit work.
Auditing Cloud, Mobile, and IoT Environments for Access, Data, and Control Risk
How cloud services, mobile access, and IoT devices affect audit risk, evidence reliability, access controls, vendor controls, and cybersecurity procedures.
Testing and Documenting IT General Controls for Access, Change, and Operations Reliance
How auditors test and document IT general controls over access, change management, operations, backups, and system-generated audit evidence.
Using Audit Data Analytics and Automated Tools Without Weakening Evidence Quality
How auditors use data analytics, full-population testing, dashboards, and automated tools while validating data reliability and documenting audit conclusions.
Applying Cybersecurity Concepts to Audit Risk, Evidence, and Financial Reporting
How auditors evaluate cybersecurity governance, access, monitoring, incident response, backup, and disclosure effects in financial statement audit work.
Reporting on SOC for Cybersecurity Engagements and Cyber Risk Management Programs
How SOC for Cybersecurity engagements evaluate management's cyber risk management description, assertion, controls, criteria, and practitioner opinion.
Forensic Accounting, Fraud Investigation, and Litigation Support
AUD advanced coverage for forensic work, fraud examination, data mining, litigation support, ethics, and investigative tools.
Understanding Forensic Accounting in Audit, Fraud, and Litigation Contexts
How forensic accounting differs from routine audit work, when it is used, and how evidence and reporting duties shape the engagement.
Using Fraud Examination Methods to Investigate Allegations and Corroborate Evidence
How forensic practitioners plan allegation-driven fraud examinations, preserve evidence, perform targeted testing, conduct interviews, and report supported findings.
Applying Forensic Data Mining to Detect Irregular Transactions and Corroborate Fraud Leads
How forensic practitioners use data validation, stratification, fuzzy matching, Benford analysis, and anomaly follow-up to investigate irregularities.
Providing Litigation Support and Expert Witness Services in Forensic Accounting Engagements
How forensic accountants support disputes through damages analysis, expert reports, testimony, evidence evaluation, and objective communication.
Maintaining Objectivity, Confidentiality, and Role Clarity in Forensic Engagements
How forensic accountants manage objectivity, advocacy threats, confidentiality, conflicts, fee risks, scope changes, and professional standards.
Using Digital Forensics, Blockchain Analysis, and Analytics in Forensic Audits
How forensic accountants use digital evidence tools, blockchain tracing, analytics, and AI while preserving defensible evidence.
Managing Cross-Border, Informant, and Reporting Issues in Forensic Audits
How forensic accountants manage jurisdictional limits, confidential sources, evidence handling, and reporting clarity.
ESG Reporting, Metrics, and Assurance Engagements
AUD advanced coverage for ESG frameworks, audit integration, reporting, metrics, standards, and future assurance demand.
Understanding ESG Reporting Frameworks and Assurance Criteria
How ESG frameworks organize sustainability disclosures and why assurance depends on suitable criteria, reliable data, and clear scope.
Integrating ESG Risks into Audit Planning and Risk Assessment
How ESG matters can affect inherent risk, control risk, materiality, audit planning, and financial statement disclosure.
Communicating ESG Assurance Results in External Reports
How ESG assurance reports communicate scope, criteria, responsibilities, procedures, conclusions, and limitations to external users.
Verifying ESG Metrics Through Evidence, Recalculation, and Site Procedures
How practitioners test ESG metrics using source records, recalculation, sampling, site visits, benchmarking, and data-control procedures.
Managing ESG Reporting Challenges, Greenwashing Risk, and Evolving Criteria
How practitioners respond to changing ESG criteria, data-quality problems, reporting-boundary risk, and greenwashing concerns.
Applying AICPA Attestation Concepts to ESG Assurance Engagements
How AICPA attestation concepts apply to ESG reviews and examinations, including criteria, evidence, responsibility, and report wording.
Assessing the Future Outlook for ESG Assurance
How investor demand, regulation, and market practice are shaping the future of ESG assurance.
AUD Appendices and Reference Materials for CPA Exam Review
Use these AUD appendices for standards lookup, pronouncement review, reporting patterns, audit letters, and glossary support.
AICPA and PCAOB Standards Reference for AUD Review
Use this AUD appendix to place AICPA, PCAOB, and related standards families in the right engagement context.
Audit Standards Framework for AUD: AICPA, PCAOB, and Engagement Type
Place AICPA AU-C standards, PCAOB auditing standards, and related engagement standards in the right AUD exam context.
AICPA vs. PCAOB Standards: Scope, Structure, and Exam Effects
Compare how AICPA and PCAOB standards differ in scope, independence, documentation, reporting, and integrated-audit requirements.
AUD Pronouncements and Standards Update Reference for Exam Review
Use this AUD appendix to classify standards labels, update types, effective dates, and their audit consequences.
Pronouncement Types in AUD: ASUs, SASs, SSAEs, and Related Guidance
Classify the main accounting, auditing, attestation, review, and regulatory pronouncement types that appear in AUD questions.
Pronouncements That Change AUD Audit Procedures and Reporting
Study how selected accounting, auditing, and attestation updates affect AUD evidence, documentation, reporting, and exam reasoning.
AUD Auditor Report Examples and Opinion Pattern Reference for Review
Use this AUD appendix to connect report structure, opinion type, explanatory paragraphs, and fact-pattern conclusions.
AUD Engagement and Representation Letter Reference for Audit Documentation
Use this AUD appendix to distinguish engagement terms, written representations, evidence limits, and letter timing.
AUD Engagement Letter Scope, Responsibilities, and Assurance Limits
Review how engagement letters define audit scope, party responsibilities, assurance level, timing, fees, and scope changes.
AUD Management Representation Letter Evidence and Scope Limits
Review written representations, required management assertions, report-date timing, evidence limits, and refusal consequences.
AUD Glossary and Abbreviation Reference for Standards and Audit Terms
Use this AUD glossary appendix to classify standards labels, control terms, evidence vocabulary, and reporting phrases.
Independent educational content. CPAExamsMastery.com provides study materials for U.S. CPA exam preparation.
Content is for educational and exam-preparation purposes only. It is not accounting, tax, audit, legal, licensing,
or professional advice, and it does not guarantee exam results.
We are not affiliated with, endorsed by, or sponsored by the AICPA , NASBA , any state board
of accountancy, Prometric, or any official exam body. Exam names and trademarks belong to their respective owners.
Verify current requirements with official sources. Full disclaimer .