You feel confident about audit opinions, then bam—an exam question hits you with a client-imposed scope limitation that's material but not pervasive. The #1 reason candidates stumble here isn’t forgetting the four opinion types; it’s fumbling the decision tree under pressure and mixing up the trigger for a qualified opinion versus a disclaimer.
This cheat sheet is your playbook. We're not just listing rules; we're giving you the step-by-step judgment frameworks to think like an examiner and navigate the AUD section's toughest questions.
The CPA AUD exam tests professional judgment on risk, controls, evidence, and reporting. Key areas include the audit risk model (AR = RMM x DR), materiality calculations, management assertions (e.g., existence, completeness), and the four audit opinion types. Success hinges on applying frameworks, not just memorizing rules.
Key facts
- Exam Section: Auditing and Attestation (AUD)
- Official Bodies: Developed by the AICPA, administered by NASBA.
- Passing Score: 75 on a 0-99 scale.
- Average Study Time: 100-120 hours for the AUD section.
- 2026 Content Areas: Ethics & General Principles (15-25%), Risk Assessment & Planned Response (25-35%), Performing Procedures & Forming Conclusions (35-45%), Reporting (10-20%).
- Core Skill Tested: Application of professional judgment and skepticism in realistic scenarios.
How Auditors Plan an Engagement Using the Audit Risk Model
Every single audit planning question boils down to the audit risk model. This isn't just a formula to memorize; it's the auditor's central logic for deciding how much work to do. Master this relationship, and you'll have the key to dozens of scenario questions.
Studying for CPA AUD? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The Formula Explained
Audit Risk (AR) = Risk of Material Misstatement (RMM) x Detection Risk (DR)Where RMM is a combination of Inherent Risk (IR) and Control Risk (CR).
- AR (Audit Risk): The risk you'll issue an unmodified opinion when the financial statements are actually materially misstated. Your professional duty is to reduce this risk to an acceptably low level. It's a low target, but never zero.
- RMM (Risk of Material Misstatement): The client's risk. It's the risk that the financials are materially misstated before you even show up. You assess it; you don't control it.
- IR (Inherent Risk): The raw riskiness of an account, assuming no controls. Cash and complex derivatives have high inherent risk. A prepaid insurance account has low inherent risk.
- CR (Control Risk): The risk that the client's own internal controls will fail to prevent or detect a material misstatement. If their controls are weak, CR is high.
- DR (Detection Risk): Your risk. This is the risk that your audit procedures won't catch a material misstatement that exists. This is the only part of the formula you, the auditor, can directly control.
The Inverse Relationship Playbook
The exam will give you a scenario. Here’s how to think it through:
- Assess the Client's Risk (RMM): The question describes a new client in a fast-changing tech industry (high IR) with a brand-new, untested accounting system (high CR). Your combined assessment of RMM is high.
- Set Your Target (AR): Your goal for Audit Risk is always low. This is fixed.
- Solve for Your Action (DR): The formula is AR (low) = RMM (high) x DR (?). To make the equation balance, you must set your Detection Risk low.
The most common trap is thinking high client risk means you accept high risk. It's the opposite. High client risk forces you to lower your own risk of missing something.
And how do you lower your Detection Risk? By doing more, better audit work.
- Nature: Shift from less persuasive procedures (inquiry) to more persuasive ones (physical inspection, recalculation).
- Timing: Perform more testing at or near year-end instead of at an interim date.
- Extent: Increase your sample sizes. Test more transactions.
A lower detection risk always means more substantive testing. You can practice applying this logic with thousands of scenario questions by starting a free VoraPrep trial.
What is Materiality and How is it Applied in an Audit?
You can't audit every single dollar. Materiality is the auditor's filter for focusing on what matters—amounts or disclosures significant enough to influence a financial statement user's decisions. While it's a matter of professional judgment, it always starts with quantitative benchmarks.
Common Materiality Benchmarks (AICPA Guidelines):- For-profit entities: 3-7% of pre-tax income from continuing operations is a common starting point.
- Asset-based entities: 0.5-2% of total assets.
- Not-for-profit entities: 0.5-2% of total revenues or expenses.
Worked Example: Setting and Applying Materiality Levels
You are the lead auditor for VoraTech Solutions for the year ended December 31, 2026.
- Pre-tax income from continuing operations: $10,000,000
- Total assets: $150,000,000
The engagement partner determines that pre-tax income is the most relevant benchmark for VoraTech's investors.
Step 1: Determine Overall Materiality. Based on professional judgment, considering the stability of VoraTech's earnings, the team selects 5% from the typical range. This is the materiality for the financial statements as a whole.- Overall Materiality = $10,000,000 × 5% = $500,000
- Performance Materiality = $500,000 × 70% = $350,000
- Action: When designing tests for Inventory, the team will use this $350,000 figure. Note that Tolerable Misstatement is the application of performance materiality to a particular sampling procedure. For exam purposes, the concepts are very closely related.
- Clearly Trivial Threshold = $500,000 × 4% = $20,000
- Action: An auditor finds a $15,000 error. They will note it but won't add it to the Summary of Uncorrected Misstatements because it's below this de minimis threshold.
The exam won't ask you to choose the 5% or 70%. It will test whether you understand that a lower materiality threshold means you must perform more audit work (e.g., larger sample sizes).
What Are Management Assertions and How Do You Test Them?
Management assertions are the explicit or implicit claims management makes in the financial statements. Your entire audit consists of gathering evidence to test these claims. Per AU-C 315, the AICPA groups them into two main categories:
- Assertions about classes of transactions and events: Occurrence, Completeness, Accuracy, Cutoff, Classification.
- Assertions about account balances: Existence, Rights and Obligations, Completeness, Valuation and Allocation.
Mnemonics can help you remember these, but always be prepared to identify the specific, formal assertion being tested.
| Assertion Category | Key Assertions (and a Mnemonic) | What Management is Claiming... | A Classic Audit Procedure to Test It |
|---|---|---|---|
| Transactions & Events | Completeness, Cutoff, Accuracy, Classification, Occurrence | (C-CACO) Everything that should have been recorded was, in the right period, at the correct amount, in the proper account, and it actually happened. | Tracing: Select a sample of shipping documents (source) and trace them forward to the sales journal (books) to test for Completeness. |
| Account Balances | Completeness, Valuation & Allocation, Existence, Rights & Obligations | (C-VER) All assets, liabilities, and equity are recorded, included at the proper amount, they actually exist, and the entity owns/owes them. | Vouching: Select a sample of receivables from the A/R subledger (books) and vouch them back to shipping documents (source) to test for Existence. |
The #1 Trap: Getting Vouching vs. Tracing Backward
Don't let the similar-sounding names fool you. This is a simple but critical distinction.
Check Your State’s Exact CPA Exam Requirements
Every state has different credit hour, ethics, and residency rules. Use our 55-jurisdiction checker to verify your eligibility before applying.
- Vouching tests for overstatement (Existence/Occurrence): You start at the financial records (e.g., General Ledger) and go Vackward to the source document (e.g., Invoice). You are verifying that a recorded item is real and not fictitious.
- Tracing tests for understatement (Completeness): You start at the source document (e.g., Shipping Document) and go Torward to the financial records (e.g., Sales Journal). You are tracking an event to ensure it was properly included and nothing was left out.
What's the Difference Between an Audit, a Review, and a Compilation?
Not every CPA service provides the same level of assurance. The AUD exam requires you to know the precise differences in standards, procedures, and report language for each level of service.
| Engagement Type | Applicable Standards | Level of Assurance Provided | Report Language ("The Punchline") | Key Procedures Performed |
|---|---|---|---|---|
| Audit | GAAS (non-issuers) / PCAOB (issuers) | Reasonable Assurance (High, but not absolute) | Opinion: "In our opinion, the financial statements present fairly..." (Positive Assurance) | Risk assessment, internal control testing, extensive substantive procedures (inspection, confirmation, etc.). |
| Review | SSARs | Limited Assurance (Moderate) | Conclusion: "We are not aware of any material modifications needed..." (Negative Assurance) | Primarily inquiry of management and analytical procedures. Much narrower scope than an audit. |
| Compilation | SSARs | No Assurance | Disclaimer: "We have not audited or reviewed... and do not express an opinion..." | Assisting management in presenting financial information in the form of financial statements. No testing performed. |
A Quick Word on Attestation Engagements
The table above focuses on historical financials. Attestation Engagements (governed by SSAEs) apply to subject matter other than historical financials. The exam expects you to know the three main types:
- Examination: Provides reasonable assurance (an "opinion"), similar in rigor to an audit.
- Review: Provides limited assurance (a "conclusion"), similar in scope to a SSARs review.
- Agreed-Upon Procedures: Provides no assurance. The practitioner performs specific procedures and reports on their findings.
How Do You Choose the Correct Audit Opinion? A Decision-Tree Playbook
This is the pinnacle of AUD judgment. The exam will give you a complex scenario and ask for the appropriate report. Don't panic. Walk through this decision tree.
Step 1: Did you gather sufficient appropriate audit evidence?- Yes: Great. Proceed to Step 2.
- No: This is a Scope Limitation. The client or circumstances prevented you from performing a necessary procedure. Jump to Step 3.
- Yes: Perfect. Issue an Unmodified Opinion. Your report will include a "Basis for Opinion" section stating the audit was conducted in accordance with GAAS.
- No: This is a GAAP Departure (a material misstatement). Jump to Step 4.
- Is the potential effect material, but NOT pervasive? -> Issue a Qualified Opinion ("Except For"). The report's "Basis for Qualified Opinion" section explains the limitation.
- Is the potential effect material AND pervasive? -> Issue a Disclaimer of Opinion. You state that you cannot form an opinion and explain why in the "Basis for Disclaimer of Opinion" section.
- Is the effect material, but NOT pervasive? -> Issue a Qualified Opinion ("Except For"). The "Basis for Qualified Opinion" section explains the misstatement.
- Is the effect material AND pervasive? -> Issue an Adverse Opinion. The "Basis for Adverse Opinion" section explains why the financials do not present fairly. This is the worst opinion for a client.
When an Unmodified Opinion Needs More Detail: EOM & OM Paragraphs
Sometimes, the opinion is unmodified, but you need to flag something important for the user. These paragraphs do not change the opinion.
- Emphasis-of-Matter (EOM) Paragraph: Highlights a matter that is already appropriately disclosed in the financial statements but is fundamental to a user's understanding.
- Classic Triggers: Substantial doubt about the entity's ability to continue as a going concern (which auditors have a responsibility to evaluate), a major catastrophe, or a significant subsequent event.
- Other-Matter (OM) Paragraph: Refers to a matter other than those presented or disclosed in the financials that is relevant to understanding the audit, your responsibilities, or your report.
- Classic Triggers: Restricting the use of the audit report, or when the prior year's financials were audited by a predecessor auditor.
Understanding the specific triggers for an EOM versus an OM paragraph is a common source of exam questions. The required communications that might lead to these paragraphs are a heavily tested area.
What are the Key Mnemonics for the AUD Exam?
Mnemonics are force multipliers. They save precious cognitive load on exam day so you can focus on judgment. Burn these into your memory.
- COSO Internal Control Framework (CRIME): The five components that make up a system of internal control.
- Control Environment (The "tone at the top")
- Risk Assessment (Management's process for identifying risks)
- Information & Communication
- Monitoring
- Existing Control Activities (The "guts" - segregation of duties, reconciliations, etc.)
- Firm's Quality Control System (HELP ME): The six elements a CPA firm must have to ensure quality work.
- Human Resources
- Engagement/Client Acceptance and Continuance
- Leadership Responsibilities
- Performance of the Engagement
- Monitoring
- Ethical Requirements
For a deeper dive into controls, our guide on how to evaluate the design and implementation of controls is an excellent resource.
How Should I Use This Cheat Sheet to Study for the CPA AUD Exam?
- Prime Your Brain: Before you start a VoraPrep quiz on audit reporting, take 60 seconds to review the "Decision-Tree Playbook." This activates the correct mental models before you see a single question.
- Diagnose Your Mistakes: When you get a question wrong, don't just read the answer explanation. Come back to this sheet and pinpoint the core concept you misunderstood. Was it the vouching vs. tracing direction? The trigger for a Disclaimer vs. an Adverse opinion? This turns a mistake into a durable learning moment.
- Active Recall: Cover the page and write out the COSO framework (CRIME) or the assertions for account balances (C-VER) from memory. Do this for 5-10 minutes daily. This builds the rapid, confident recall you need under the pressure of the exam clock.
Our adaptive learning engine at VoraPrep is designed to supercharge this process. It pinpoints your weak areas, and you can use this cheat sheet to solidify the rules while our 9,500+ practice questions help you master their application in exam-like scenarios.