CPA Auditing and Attestation Cheat Sheet (2026): Key Formulas, Rules, and Mnemonics

You feel confident about audit opinions, then bam—an exam question hits you with a client-imposed scope limitation that's material but not pervasive. The #1 reason candidates stumble here isn’t forgetting the four opinion types; it’s fumbling the decision tree under pressure and mixing up the trigger for a qualified opinion versus a disclaimer.

This cheat sheet is your playbook. We're not just listing rules; we're giving you the step-by-step judgment frameworks to think like an examiner and navigate the AUD section's toughest questions. Try VoraPrep's adaptive AUD practice questions for free.

Key facts

• Exam Section: Auditing and Attestation (AUD)
• Official Body: American Institute of Certified Public Accountants (AICPA)
• Passing Score: 75 on a 0-99 scale.
• Average Study Time: 80-100 hours for the AUD section.
• 2026 Content Areas: Ethics & General Principles (15-25%), Risk Assessment & Planned Response (25-35%), Performing Procedures & Forming Conclusions (35-45%), Reporting (10-20%).
• Core Skill Tested: Application of professional judgment and skepticism in realistic scenarios.

The Core of Audit Planning: The Audit Risk Model

Every audit plan is built on the audit risk model. This isn't just a formula to memorize; it's the auditor's central tool for deciding how much work to do. Get this logic down, and you'll nail dozens of questions.

The Formula Explained

Audit Risk (AR) = Risk of Material Misstatement (RMM) x Detection Risk (DR) Where RMM is comprised of Inherent Risk (IR) and Control Risk (CR).

• AR (Audit Risk): The risk that you'll issue a clean (unmodified) opinion when the financial statements are actually materially misstated. Your goal is to reduce this risk to an acceptably low level. It's a professional judgment, not a fixed percentage.
• RMM (Risk of Material Misstatement): The risk that the financials are materially misstated before your audit even begins. It’s the client’s risk, and it has two parts:
• IR (Inherent Risk): The raw susceptibility of an assertion to a material misstatement, assuming there are no related controls. Think complex estimates (goodwill) or cash—they have high inherent risk.
• CR (Control Risk): The risk that the client's own internal controls will fail to prevent or detect a material misstatement. If controls are weak, CR is high.
• DR (Detection Risk): The risk that your audit procedures won't catch a material misstatement that exists and that the client's controls missed. This is the only part of the formula you, the auditor, can control.

The Decision-Tree Playbook

The exam will give you a scenario. Here’s how to think it through:

1. Assess the Client's Risk (RMM): The problem states the client is in a volatile industry (high IR) and has significant staff turnover in accounting (high CR). Therefore, your assessment of RMM is high.
2. Set Your Target (AR): You always want an acceptably low Audit Risk. This is a constant.
3. Solve for Your Action (DR): If RMM is high and you need AR to be low, the only way to balance the equation is to set an extremely low Detection Risk (DR).

The most common mistake is thinking high client risk means you accept high risk everywhere. It's the opposite. High client risk forces you to lower your own risk of missing something.

How do you lower Detection Risk? By doing more effective audit work.

• Nature: Use more persuasive procedures (e.g., physical inspection over inquiry).
• Timing: Perform procedures at year-end rather than an interim date.
• Extent: Increase sample sizes and test more transactions.

A lower detection risk always means more audit work.

How Auditors Decide What's Important: Materiality

You can't check every transaction. Materiality is the concept that lets you focus on amounts large enough to influence a user's decision. It's a judgment call, but it starts with quantitative benchmarks.

Common Materiality Benchmarks (Guidelines, not mandates):

• Pre-tax income from continuing operations: 3-7% (for stable, profitable companies)
• Total assets: 0.5-2% (for asset-heavy companies or non-profits)
• Total revenue: 0.5-2% (for high-growth or service companies)

Worked Example: Setting and Applying Materiality

Let's audit VoraTech Inc. for the year ended December 31, 2026.

• Pre-tax income from continuing operations: $5,000,000
• Total assets: $80,000,000
• Total revenue: $120,000,000

The audit partner selects pre-tax income as the benchmark.

Step 1: Calculate Planning Materiality (PM). The team chooses a 5% threshold.

• PM = $5,000,000 × 5% = $250,000
• Judgment: Any misstatement, or combination of misstatements, over $250,000 is presumed to be material.

Step 2: Calculate Performance Materiality. This is a lower threshold used for planning the nature, timing, and extent of audit procedures for individual accounts or disclosures. Its purpose is to reduce the probability that the aggregate of uncorrected and undetected misstatements exceeds planning materiality. Let's use 60% of PM.

• Performance Materiality = $250,000 × 60% = $150,000
• Action: The team plans its tests on accounts like Accounts Receivable based on this lower $150,000 figure.

Step 3: Set the "Clearly Inconsequential" Threshold. This is the threshold below which misstatements are considered trivial and do not need to be accumulated. Let's say the firm's policy is 3% of PM.

• Clearly Inconsequential = $250,000 × 3% = $7,500
• Action: If the team finds a $5,000 error in an invoice, they will note it but not add it to the summary of accumulated misstatements because it's below this de minimis threshold.

The exam won't ask you to set materiality, but it will test if you understand its impact.

Your Audit Assertions Cheat Sheet

Management assertions are the claims embodied in the financial statements. Your job is to test them. The exam uses specific assertions for different areas.

Assertion Category	Key Assertions (and a Mnemonic)	What Management is Claiming...	A Classic Audit Procedure to Test It
Transactions & Events	Completeness, Cutoff, Accuracy, Classification, Occurrence	(C-CACO) Everything that happened during the period is recorded, in the right period, at the right amount, in the right account, and it actually happened.	Tracing: Select a sample of shipping documents (source) and trace them to the sales journal to test for Completeness.
Account Balances	Completeness, Existence, Rights & Obligations, Valuation & Allocation	(C-ERV) All assets and liabilities are recorded, they actually exist, we own/owe them, and they are recorded at the proper amount.	Vouching: Select a sample of receivables from the A/R subledger (books) and vouch them back to shipping documents to test for Existence.
Presentation & Disclosure	Completeness, Occurrence & Rights/Obligations, Classification & Understandability, Accuracy & Valuation	(COCA) All required disclosures are included, disclosed events occurred and pertain to the entity, info is clearly presented, and amounts are accurate.	Review: Read the footnotes to ensure that required debt covenant disclosures are present and understandable, testing Completeness and Understandability.

The #1 Trap: Vouching vs. Tracing

Get this right every time.

• Vouching tests Existence/Occurrence: Start at the financial records (e.g., Sales Journal) and go back to the source document (e.g., Shipping Doc). You are verifying that a recorded item is real.
• Tracing tests Completeness: Start at the source document (e.g., Shipping Doc) and go forward to the financial records (e.g., Sales Journal). You are tracking to ensure nothing was left out.

CPA Levels of Service: Audit, Review, Compilation

Not every engagement is an audit. The AUD exam will test your ability to distinguish between the different levels of assurance a CPA can provide.

Engagement Type	Applicable Standards	Level of Assurance	Report Language (The "Punchline")	Procedures
Audit	GAAS (non-issuers) / PCAOB (issuers)	Reasonable (High, but not absolute)	Opinion: "In our opinion, the financial statements present fairly..." (Positive Assurance)	Extensive: Risk assessment, internal control testing, substantive procedures.
Review	SSARs	Limited (Moderate)	Conclusion: "We are not aware of any material modifications needed..." (Negative Assurance)	Primarily inquiry and analytical procedures. Much narrower scope.
Compilation	SSARs	None	Disclaimer: "We have not audited or reviewed... and do not express an opinion..."	Assisting management in presenting financial information. No assurance provided.
Attestation	SSAEs	Varies by engagement type	Varies: Opinion, Conclusion, or Findings	Examination: Reasonable Assurance. Review: Limited Assurance. Agreed-Upon Procedures: No Assurance (list of findings).

The key is the inverse relationship: more work equals higher assurance. For a deeper look, our guide on required communications in an audit is a great next step.

The Auditor's Report: Your Decision-Tree Playbook

Choosing the right audit opinion is a process of elimination. Learn this logic, not just the names.

Step 1: Has the auditor gathered sufficient appropriate audit evidence?

• Yes: Proceed to Step 2.
• No: This is a Scope Limitation. Go to Step 3.

Step 2: Are the financial statements free of material misstatement (i.e., they follow GAAP)?

• Yes: Issue an Unmodified Opinion. This is the clean, standard report.
• No: This is a GAAP Departure. Go to Step 4.

Step 3 (From Scope Limitation): Is the potential effect of the undetected misstatements both material and pervasive?

• Material, but NOT Pervasive: Issue a Qualified Opinion ("Except For"). "Except for the possible effects of the matter..., the financials are presented fairly."
• Material AND Pervasive: Issue a Disclaimer of Opinion. "We do not express an opinion." The limitation is so significant you can't form an opinion at all.

Step 4 (From GAAP Departure): Is the effect of the misstatement both material and pervasive?

• Material, but NOT Pervasive: Issue a Qualified Opinion ("Except For"). "Except for the effects of the [specific GAAP departure]..., the financials are presented fairly."
• Material AND Pervasive: Issue an Adverse Opinion. "The financial statements do not present fairly." This is the worst outcome for a client.

What does "pervasive" mean? It's a high bar. The misstatement isn't confined to specific accounts, represents a substantial portion of the financials, or is fundamental to users' understanding.

Beyond the Opinion: Emphasis-of-Matter and Other-Matter Paragraphs

Sometimes, an unmodified opinion is appropriate, but you need to highlight something important. These paragraphs do not modify the opinion.

• Emphasis-of-Matter (EOM) Paragraph: Used to refer to a matter that is already appropriately presented or disclosed in the financial statements but is so fundamental to users' understanding that the auditor wants to draw attention to it.
• Common Triggers: A significant subsequent event, a major catastrophe with significant effect, or substantial doubt about the entity's ability to continue as a going concern.
• Other-Matter (OM) Paragraph: Used to refer to a matter other than those presented or disclosed in the financial statements that is relevant to users' understanding of the audit, the auditor's responsibilities, or the auditor's report.
• Common Triggers: Restricting the use of the report, reporting on comparative financial statements when the prior year was audited by a different firm.

Understanding the unique triggers for these paragraphs is critical for scenario-based questions. To learn more about the controls that might prevent such issues, see our guide on evaluating design and implementation.

Essential Mnemonics for the AUD Exam

Mnemonics save precious mental energy on exam day. Internalize these.

• COSO Internal Control Framework (CRIME): The five components of internal control.
• Control Environment
• Risk Assessment (by management)
• Information & Communication
• Monitoring
• Existing Control Activities
• Firm's Quality Control System (HELP ME): The elements a CPA firm must have in place.
• Human Resources
• Engagement/Client Acceptance and Continuance
• Leadership Responsibilities ("Tone at the Top")
• Performance of the Engagement
• Monitoring
• Ethical Requirements

Common Traps on the AUD Exam

The AUD exam tests judgment, and that means it's full of plausible-sounding wrong answers.

1. Misstating Auditor vs. Management Responsibility

• The Trap: A question describes management preparing the financials and asks about the auditor's role. A distractor will say the auditor's job is to "prepare the financial statements."
• The Right Way to Think: Draw a hard line. Management is responsible for the financial statements and for designing/implementing internal controls. The Auditor is responsible for expressing an opinion on those statements.

2. Confusing Engagement Standards (GAAS vs. SSARs vs. SSAEs)

• The Trap: A question describes an engagement on a company's greenhouse gas emissions forecast. It asks which standards apply, and "GAAS" is an option.
• The Right Way to Think:
• Audit of historical financial statements? -> GAAS/PCAOB.
• Review or compilation of historical financial statements (non-issuer)? -> SSARs.
• Engagement on anything else (forecasts, compliance, controls)? -> SSAEs.

The answer for the emissions forecast is SSAEs (an attestation engagement).

3. Ignoring the "Call of the Question"

• The Trap: A question describes a significant disagreement with management over a GAAP departure. It asks, "What is the auditor's most likely first course of action?" The obvious-but-wrong answer is "Issue a qualified opinion."
• The Right Way to Think: The first step is almost always communication. The auditor must first discuss the matter with management and those charged with governance. The modified opinion comes after communication fails to resolve the issue.

How to Use This CPA Audit Exam Cheat Sheet

1. Prime Your Brain: Before starting a VoraPrep quiz on audit reporting, take 60 seconds to review the "Decision-Tree Playbook." This activates the right mental models.
2. Diagnose Your Mistakes: When you get a question wrong, come back to this sheet and identify the core concept you misunderstood. Was it the difference between a scope limitation and a GAAP departure? This turns a mistake into a learning opportunity.
3. Active Recall Practice: Cover the page and write out "CRIME" or "HELP ME" from memory. Do this for 10 minutes daily to build the recall speed you need under exam pressure.

Our adaptive learning engine at VoraPrep is designed to work with this process. It identifies your weak areas, and you can use this cheat sheet to solidify the rules while our 9,500+ practice questions help you master their application.

Related Resources

• CPA Tax Compliance & Planning: Qualified Business Income (QBI) Deduction — Complete Study Guide — The biggest mistake candidates make with the QBI deduction isn't a failure of memorization—it's a failure to apply the r
• CPA Regulation: Above-the-line deductions — Complete Study Guide — Ace CPA REG by mastering AGI deductions. This 2026 guide reveals traps in IRA phase-outs, SE tax, and alimony rules you
• CPA Regulation: Sole proprietorships — Complete Study Guide — Ace the CPA REG exam with our 2026 sole proprietorship guide. Learn the QBI deduction, self-employment tax traps, and li
• CPA Regulation: Education credits — Complete Study Guide — High-Scorer's Guide to CPA REG Education Credits (2026). Avoid common AOTC & LLC traps, master phase-outs, and see a wor
• CPA Regulation: Qualified business income (199A) — Complete Study Guide — Same-exam deep-dive from the VoraPrep library.
• Gleim vs Wiley CPA (2026): Question Bank Deep Dive — Same-exam deep-dive from the VoraPrep library.

Official resources and references

• AICPA Uniform CPA Examination Blueprints
• NASBA CPA Exam Candidate Bulletin
• U.S. Bureau of Labor Statistics - Accountants and Auditors

Frequently asked questions

What is the hardest part of the CPA AUD section? Most candidates find applying professional judgment to ambiguous scenarios is the hardest part. Unlike FAR or REG, AUD isn't about finding one right number; it's about selecting the most appropriate action based on risk assessment and evidence evaluation. How many Task-Based Simulations (TBSs) are on the AUD exam? The AUD section includes 7 task-based simulations and 78 multiple-choice questions. One TBS is a research question requiring you to search authoritative literature to find the answer to a specific issue. What is the best way to study for AUD? Focus on understanding the "why" behind audit procedures, not just memorizing the "what." The most effective method is to work through hundreds of practice multiple-choice questions and simulations to train your professional judgment. Is the AUD exam changing in 2026? The core principles of auditing are stable. However, for 2026, expect continued focus on data analytics, cybersecurity risk, and the audit implications of automated systems and controls. Always refer to the official AICPA Blueprints for current content specifications. Can I pass AUD in 4 weeks? Passing AUD in 4 weeks is aggressive but possible if you are studying full-time (30-40 hours/week) and have a strong accounting background. It demands a disciplined plan focused almost entirely on practice questions and targeted review of weak areas.

--- Ready to Pass Your CPA Exam? Don't just memorize rules; learn to think like the examiner. VoraPrep offers an adaptive learning engine that targets your weak areas, over 9,500 practice questions with detailed explanations, and our 24/7 AI tutor, Vory, to guide you. The average CPA salary ranges from $75,000-$150,000—passing the exam is the single best investment you can make in your career.

Visit voraprep.com to get started.

Start Your Free 7-Day Trial at voraprep.com →

Related VoraPrep Guides

• Types of Audit Opinions: A Simple Guide for the CPA AUD Exam