Most AUD candidates can define an audit, a review, and a compilation. The exam doesn't care. It tests whether you can spot the single fact in a client's file—a city spending $800,000 in federal grants—that instantly makes those basic definitions dangerously incomplete. The real test isn't what you've memorized; it's whether you can apply the right rulebook when the facts change.
"Types of engagements and related standards" on the CPA AUD exam requires you to apply the correct professional standards (SAS, SSAE, SSARS, GAGAS) to a given client scenario. The key is identifying triggers, like federal funding levels or the need for limited vs. reasonable assurance, that dictate the scope of the audit, review, compilation, or attestation engagement.
Key facts
- Governing Standards (Non-issuers): SAS (Audits), SSAE (Attestations), SSARS (Reviews/Compilations), SQMS (Firm Quality).
- Governing Standards (Issuers): PCAOB Auditing Standards (AS).
- Governmental Standards: Government Auditing Standards (GAGAS), also known as the "Yellow Book."
- Single Audit Threshold: Required for entities expending $750,000 or more in federal awards in a fiscal year.
- Assurance Levels: Reasonable (Audits/Examinations), Limited (Reviews), and None (Compilations/AUPs).
- Official Body: American Institute of Certified Public Accountants (AICPA).
The AICPA reports the cumulative AUD pass rate was 47.88% in 2023 (AICPA), underscoring that nearly half of candidates struggle with applying these nuanced standards under pressure.
What are the Different Types of Engagements and Why Do They Matter?
This area defines the menu of services a CPA firm provides and the rulebooks—the professional standards—that govern each one. Getting this right is the core logic of the AUD exam. Given a scenario, you must select the right service and apply the correct set of rules. Answering these questions correctly requires judgment, not just memory.
Studying for CPA AUD? Benchmark your score in 5 minutes.
Get an instant weak-spot assessment and a custom 12-week study plan PDF generated for your exam window.
The content appears in two formats:
- Multiple-Choice Questions (MCQs) test specific requirements, like independence rules for a compilation versus a review.
- Task-Based Simulations (TBSs) present a client scenario and require you to select the appropriate report, identify deficiencies, or determine necessary procedures.
The most common failure point is assuming all audits are the same. Examiners know candidates focus on standard corporate audits under GAAS. They write questions to trap those who can't pivot when a fact pattern mentions "federal funds," "a public company," or "a report for a specific lender." Try VoraPrep's free CPA practice questions to see how you handle these nuanced scenarios.
How do Audits, Reviews, Compilations, and Attestations Differ?
Your goal is to build a mental decision tree. When you read a question, you should immediately start filtering: Is this an issuer or non-issuer? Is it a government entity? Are federal funds involved? Is the user seeking reasonable assurance, limited assurance, or just factual findings?
This table breaks down the core engagements for non-issuers.
| Engagement Type | Primary Standard | Level of Assurance | Independence Required? | Key Report Language |
|---|---|---|---|---|
| Audit | SAS (GAAS) | Reasonable ("positive") | Yes | "In our opinion, the financial statements present fairly..." |
| Review | SSARS | Limited ("negative") | Yes | "Based on our review, we are not aware of any material modifications..." |
| Compilation | SSARS | None | No (but lack of independence must be disclosed) | "We have not audited or reviewed the financial statements..." |
| Examination | SSAE | Reasonable ("positive") | Yes | Similar to an audit opinion, but on subject matter other than historical financials. |
| Agreed-Upon Procedures (AUP) | SSAE | None | Yes | A description of procedures performed and a list of findings. No opinion or conclusion. |
The Critical Distinction: Issuers vs. Non-Issuers
This is the first gate in your decision tree.- Non-Issuers (Private Companies): Audits are governed by the AICPA's Statements on Auditing Standards (SAS), which constitute U.S. GAAS.
- Issuers (Public Companies): Audits are governed by the Public Company Accounting Oversight Board (PCAOB) Auditing Standards (AS).
While there is significant overlap, the PCAOB standards are often more prescriptive, especially regarding internal control reporting (required for most issuers) and audit documentation.
The Governmental Layers: GAGAS and the Single Audit
This is where many candidates lose points.GAGAS (The Yellow Book)
Government Auditing Standards (GAGAS), issued by the GAO, apply to audits of government organizations, programs, and entities receiving government funds. GAGAS incorporates U.S. GAAS but adds extra requirements, including:- Stricter Independence Rules: To avoid even the appearance of impairment.
- Specific CPE: Auditors need government-specific continuing education.
- Expanded Reporting: Auditors must report on internal control over financial reporting and on compliance with laws and regulations.
Single Audit Act
This is a bright-line rule. An entity (governmental or non-profit) that expends $750,000 or more in federal awards in its fiscal year must have a Single Audit. This is an audit of the entire organization that covers both the financial statements and compliance with federal award requirements under Title 2 U.S. Code of Federal Regulations Part 200, Uniform Guidance.Special Purpose Frameworks (SPF)
Not every entity uses U.S. GAAP. Some use an SPF (formerly OCBOA), such as the cash basis, tax basis, or a contractual basis. When auditing these statements, you have two key responsibilities:- Determine if the chosen framework is acceptable for the engagement.
- Ensure the auditor's report is modified to identify the framework and that the financial statements include adequate disclosures about it.
A Step-by-Step Application of Engagement Standards
Let's walk through a scenario that mirrors an AUD simulation. It's not about complex math; it's about layering the rules correctly.
> 💡 Worked example: > The City of Oakhaven, a small municipal government, hired your CPA firm, Smith & Jones, LLP, to perform its annual audit for the year ended December 31, 2026. Oakhaven's controller provides a schedule showing they expended funds from several federal grants during the year: a $500,000 community development block grant from HUD and a $350,000 grant from the Department of Transportation for road repairs. The engagement partner asks you, the audit senior, to define the applicable standards for the engagement.
A candidate in a hurry sees "audit" and thinks "GAAS." A candidate who will pass thinks in steps.
Step 1: Identify the Entity and Baseline Standard
The client is a "municipal government." This is the first flag. Audits of government entities must be conducted in accordance with Government Auditing Standards (GAGAS), the Yellow Book. This means U.S. GAAS is the floor, not the ceiling.Step 2: Calculate Federal Expenditures and Check the Threshold
The Single Audit trigger is based on what was expended, not just received. The controller's schedule confirms expenditures:- HUD Grant Expended: $500,000
- DOT Grant Expended: $350,000
- Total Federal Expenditures: $850,000
This total exceeds the $750,000 threshold. This is the second, critical flag. This engagement must be conducted as a Single Audit.
Step 3: Define the Full Scope of Applicable Standards
Because this is a Single Audit for a government entity, three distinct layers of standards apply:- U.S. GAAS (SAS): The foundation for the audit of the basic financial statements.
- GAGAS (Yellow Book): Adds requirements for expanded reporting on internal controls and compliance.
- Single Audit Act (Uniform Guidance): Requires a compliance audit of major federal award programs and an opinion on that compliance.
> ⚠️ Exam trap: > The most tempting wrong answer on an MCQ for this scenario is: "An audit performed in accordance with Generally Accepted Auditing Standards (GAAS)." > > This is wrong because it's incomplete. It ignores the GAGAS and Single Audit requirements triggered by the facts. A second distractor might be "An audit performed in accordance with GAGAS," which is also incomplete because it omits the specific compliance audit requirements of the Single Audit Act. The correct answer must encompass all three layers. VoraPrep's adaptive engine has thousands of questions designed to test this kind of judgment, with detailed explanations that show you how to avoid these traps.
Practice Questions: Test Your Judgment
Let's see if you can apply these rules under pressure.
---
Check Your State’s Exact CPA Exam Requirements
Every state has different credit hour, ethics, and residency rules. Use our 55-jurisdiction checker to verify your eligibility before applying.
An audit senior at a CPA firm is planning an engagement for a local municipal government that receives substantial federal funding. To comply with Government Auditing Standards (GAGAS), the audit team must possess which of the following competencies?
Click to see explanation
Correct Answer: A. This is the best answer. GAGAS General Standard 3.81 requires the audit organization's staff to collectively possess the technical knowledge, skills, and experience necessary for the work. For a government audit, this includes understanding the government environment and its programs. While organizational independence (C) is a critical GAGAS General Standard (3.17), the question asks about "competencies" in the sense of skills and knowledge, making A the most direct answer to the competence standard itself.---
Sample Question 2The Bright Future Foundation, a not-for-profit entity, expended federal awards from multiple grant programs during its fiscal year. The total expenditures amounted to $800,000. Under the Single Audit Act, which of the following is a primary responsibility of the auditor?
Click to see explanation
Correct Answer: B. The core objective of a compliance audit under the Single Audit Act is for the auditor to provide an opinion on whether the entity complied with federal statutes, regulations, and the terms of the federal awards for its major programs. The auditor does not ensure goals are met (A), prepare the SEFA (C), or evaluate cost-effectiveness (D); these are management's responsibilities.---
Sample Question 3An auditor is performing a single audit for the City of Metropolis. To comply with Government Auditing Standards (GAGAS), the auditor's report on internal control over financial reporting must include:
Click to see explanation
Correct Answer: B. GAGAS requires the auditor's report on internal control over financial reporting and on compliance to describe the scope of the auditor's testing and to report any significant deficiencies and material weaknesses found. A GAGAS financial statement audit does not include an opinion on the effectiveness of internal control over financial reporting (making A incorrect). While a Single Audit involves reporting on internal control over compliance, this question specifies the report on internal control over financial reporting.---
The Vory tutor, available 24/7 on the VoraPrep platform, can walk you through detailed explanations for hundreds of similar questions until you're confident for exam day.