You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Auditing and Attestation
Free CPA Auditing and Attestation Practice Questions & Answers
500 exam-style Auditing and Attestation questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 31
Control risk is best defined as the risk that:
Select an option first.
Correct answer: D — A misstatement will not be prevented, or detected and corrected, on a timely basis by the entity's internal control
Explanation: Control risk is the risk that the entity's own internal control fails to prevent or to detect and correct a misstatement on a timely basis. It is a property of the CLIENT. Option B defines detection risk (the auditor's risk). Option C defines inherent risk. Option A defines audit risk, the overall objective the model is solving for.
Question 32
Which factor would MOST likely cause an auditor to assess control risk at the maximum?
Select an option first.
Correct answer: C — The client's controls are well designed but management routinely overrides them
Explanation: Design without operation is worthless. If management routinely OVERRIDES otherwise well-designed controls, those controls cannot be relied upon and control risk is at maximum. This is why the standards require override testing in every audit. Options A, B and D all describe features that would ordinarily SUPPORT a lower control risk assessment.
Question 33
An auditor decides NOT to rely on controls and to take a fully substantive approach. In that case, the auditor:
Select an option first.
Correct answer: D — Must still obtain an understanding of internal control relevant to the audit
Explanation: Obtaining an UNDERSTANDING of internal control relevant to the audit is REQUIRED in every audit, regardless of whether the auditor intends to rely on controls. The understanding informs risk assessment and the design of procedures. What is optional is TESTING OPERATING EFFECTIVENESS, which the auditor performs only when planning to rely on the controls, or when substantive procedures alone cannot provide sufficient evidence.
Question 34
Which of the following is NOT a component of the COSO internal control framework?
Select an option first.
Correct answer: B — Materiality determination
Explanation: The five COSO components are the Control environment, Risk assessment, Information and communication, Monitoring activities, and Control activities (mnemonic: CRIME). MATERIALITY DETERMINATION is an auditor's planning judgement, not a component of the client's internal control system. Confusing the auditor's process with the client's control framework is the trap.
Question 35
Vestrom Pharma has a highly effective control environment but a control activity over rebate accruals that is poorly designed. The auditor should:
Select an option first.
Correct answer: C — Assess control risk for the rebate accrual assertion as high, because a strong environment does not cure a specific deficient control
Explanation: Control risk is assessed at the ASSERTION level, not globally. A strong control environment is necessary but not sufficient — it cannot substitute for a specific control that does not work. So control risk for the rebate accrual is high, even while it may be low elsewhere. Option B over-corrects by contaminating every assertion with one deficiency.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 36
The auditor's understanding of an entity and its environment includes all of the following EXCEPT:
Select an option first.
Correct answer: C — The specific dollar amount of each proposed audit adjustment
Explanation: Understanding the entity covers external factors, the nature of the entity, its accounting policies, its objectives and strategies, and the measurement and review of its financial performance. PROPOSED AUDIT ADJUSTMENTS are an OUTPUT of performing the audit, not an input to understanding the entity — they cannot be known during planning.
Question 37
Which of the following would MOST likely be identified as a fraud risk factor under the fraud triangle's 'opportunity' element?
Select an option first.
Correct answer: C — A single individual controls both cash receipts and the accounts receivable ledger
Explanation: The fraud triangle has three elements: PRESSURE (incentive), OPPORTUNITY, and RATIONALISATION. A lack of segregation of duties — one person controlling both cash and the related ledger — is a textbook OPPORTUNITY. Options B and D are PRESSURE. Option A is RATIONALISATION. Identifying which element a fact represents is the exam's typical framing.
Question 38
Substantive procedures must be performed for:
Select an option first.
Correct answer: C — All relevant assertions for each material class of transactions, account balance and disclosure
Explanation: Substantive procedures are REQUIRED for ALL RELEVANT ASSERTIONS relating to each MATERIAL class of transactions, account balance and disclosure — irrespective of how effective the controls are. Controls can REDUCE the extent of substantive work; they can never eliminate it. This is an absolute rule and one the exam tests frequently.
Question 39
An auditor observes that a client's gross margin increased from 22% to 34% while the industry average remained flat. This observation is MOST useful for:
Select an option first.
Correct answer: D — Identifying a potential risk area warranting further investigation
Explanation: A preliminary analytical procedure IDENTIFIES risk — it does not prove misstatement. An unexplained margin expansion against a flat industry is a signal to look harder (at cut-off, at inventory costing, at fictitious revenue), not a conclusion. Options B and D leap from a signal to a verdict; option C confuses an analytic with a benchmark calculation.
Question 40
In planning the audit of Ridgemont Bank, the auditor notes the bank holds Level 3 fair-valued securities with no observable market inputs. The auditor should:
Select an option first.
Correct answer: D — Treat the valuation as a significant risk and design substantive procedures accordingly
Explanation: Level 3 fair values rest on UNOBSERVABLE inputs — the entity's own assumptions and models. That combination of complexity, subjectivity and susceptibility to bias marks it as a SIGNIFICANT RISK, requiring substantive procedures specifically responsive to it (and possibly an auditor's specialist). Difficulty is a reason to do MORE work, not less.
Question 41
An auditor's consideration of the risk of material misstatement due to fraud should include:
Select an option first.
Correct answer: D — Discussion among the engagement team about how and where the financial statements might be susceptible to fraud
Explanation: A BRAINSTORMING DISCUSSION among the engagement team is a REQUIRED procedure — it exchanges knowledge, sets scepticism, and considers how fraud might be perpetrated and concealed. A management representation (option B) is required but is never the end of the matter, since management may itself be the perpetrator. Fraud consideration extends well beyond revenue (option D).
Question 42
Which is the BEST example of a compensating control?
Select an option first.
Correct answer: B — The controller reviews and approves all journal entries above $10,000 in a company where the accounting clerk records and posts entries without independent review
Explanation: A COMPENSATING CONTROL mitigates a deficiency in another control. Where segregation of duties is not feasible (a small accounting team), a detective review by a competent supervisor can reduce the risk to an acceptable level. Insurance (option B) transfers the LOSS but does not prevent or detect the misstatement. A code of conduct is part of the control environment, and an external audit is not a control at all.
Question 43
Which of the following would LEAST likely be considered a significant deficiency?
Select an option first.
Correct answer: B — A control failure that resulted in an immaterial misstatement being detected and corrected by another control
Explanation: If another control CAUGHT and CORRECTED the misstatement, the system as a whole worked — which argues against a significant deficiency. Options C, D and A are all explicit INDICATORS of material weaknesses under the standards: failures in period-end reporting, absent risk assessment, and ineffective governance oversight all point to a systemic problem rather than an isolated lapse.
Question 44
Detection risk is:
Select an option first.
Correct answer: B — The only element of the audit risk model the auditor can directly manipulate
Explanation: Detection risk is the ONLY component the auditor directly controls, by varying the NATURE, TIMING and EXTENT of substantive procedures. Inherent and control risk are ASSESSED, not set — they belong to the client and exist whether or not an audit occurs. This single insight resolves most audit risk model questions.
Question 45
The auditor's risk assessment procedures should include inquiries of:
Select an option first.
Correct answer: C — Management, internal audit (if any), and others within the entity such as operations or legal personnel
Explanation: Inquiries should extend BEYOND management, precisely because management may be the source of a misstatement. The standards direct the auditor to inquire of internal audit, in-house counsel, operating personnel and others who may have information about risks of material misstatement — people less likely to be complicit and more likely to speak candidly.
Question 46
Marchetti Retail operates 400 stores. The auditor plans to test the same cash-handling control at a sample of locations. This approach is appropriate if:
Select an option first.
Correct answer: C — The control is applied consistently across all locations under centralised oversight
Explanation: Sampling locations works only if the control is HOMOGENEOUS — designed centrally and applied consistently — so that results from the sample can be extrapolated. If each manager designs their own procedure (option B), there is no single control to test, only 400 different ones. Option B would remove the need for testing but ignores that immaterial locations can aggregate to a material amount.
Question 47
An entity's use of a service organisation affects the user auditor's risk assessment because:
Select an option first.
Correct answer: B — Some of the user entity's controls over the relevant transactions reside at the service organisation
Explanation: Outsourcing a PROCESS does not outsource ACCOUNTABILITY. The user entity remains responsible for its financial statements, but some of the relevant controls now sit at the service organisation. The user auditor must therefore obtain an understanding of those controls — usually through a SOC 1 report, or by performing procedures at the service organisation directly.
Question 48
The auditor should design and perform audit procedures that are responsive to the assessed risks at:
Select an option first.
Correct answer: D — Both the financial statement level and the assertion level
Explanation: Risks are assessed and responded to at BOTH levels. FINANCIAL STATEMENT level risks (a weak control environment, going concern doubt) are pervasive and call for OVERALL responses — assigning more experienced staff, heightening scepticism, adding unpredictability. ASSERTION level risks call for specific further procedures. Candidates who work only at one level miss half the response.
Question 49
Which of the following best describes the concept of 'unpredictability' in audit procedures?
Select an option first.
Correct answer: B — Varying the timing, location or nature of procedures so the client cannot anticipate them
Explanation: Incorporating an element of UNPREDICTABILITY — testing a location not visited before, arriving unannounced for a count, testing balances usually deemed immaterial — is a required response to fraud risk. If management can anticipate exactly what will be tested, concealment becomes far easier. Option D describes the opposite, and option D describes a systematic (predictable) selection method.
Question 50
Analytical procedures are REQUIRED:
Select an option first.
Correct answer: C — During planning and at the overall review stage near the end of the audit
Explanation: Analytical procedures are MANDATORY at two points: during PLANNING (as a risk assessment procedure) and at the FINAL REVIEW stage (to corroborate the conclusions formed and assess whether the statements as a whole are consistent with the auditor's understanding). Their use as SUBSTANTIVE procedures in between is OPTIONAL, depending on their expected effectiveness.
Question 51
Inherent risk for the existence of cash is generally considered:
Select an option first.
Correct answer: A — High, because cash is highly susceptible to theft and is liquid
Explanation: Cash is LIQUID, PORTABLE and universally desirable, which makes inherent risk for misappropriation high — regardless of how easy it is to count. Ease of AUDIT (option B) is not the same as low inherent risk; it affects the auditor's ability to detect, not the account's susceptibility to misstatement. Confirmations reduce DETECTION risk, not inherent risk.
Question 52
The audit committee's responsibilities with respect to the external auditor include:
Select an option first.
Correct answer: A — Appointing, compensating and overseeing the work of the auditor
Explanation: Under SOX, the AUDIT COMMITTEE is directly responsible for the APPOINTMENT, COMPENSATION and OVERSIGHT of the external auditor, and the auditor reports to the committee rather than to management. This structure exists to prevent management from controlling the very people auditing it. Preparing the statements is MANAGEMENT's job; performing procedures and setting materiality are the AUDITOR's.
Question 53
Which statement about the relationship between materiality and audit risk is correct?
Select an option first.
Correct answer: D — They are inversely related: as materiality decreases, the auditor must do more work to keep audit risk low
Explanation: Materiality and audit risk are INVERSELY related. A LOWER materiality threshold means more items are considered material, so the auditor must perform MORE work to hold audit risk at the same acceptably low level. Materiality is not itself a component of the audit risk model (option D) — that model contains only inherent, control and detection risk.
Question 54
Hollowell Corp has a December year-end. The auditor plans substantive testing of receivables at 31 October. This is acceptable if:
Select an option first.
Correct answer: D — The auditor performs roll-forward procedures covering November and December and control risk is not high
Explanation: Interim substantive testing is permitted, but it leaves a ROLL-FORWARD period exposed. The auditor must cover that remaining period — through analytical procedures, tests of details on intervening transactions, or a combination — and interim testing is generally inappropriate where control risk is HIGH, because there is nothing to rely on across the gap. Client agreement (option C) is irrelevant to audit sufficiency.
Question 55
The primary purpose of obtaining an understanding of the entity's information system is to:
Select an option first.
Correct answer: B — Understand how transactions are initiated, recorded, processed and reported, and identify where misstatements could occur
Explanation: The auditor traces the flow of transactions from INITIATION through RECORDING, PROCESSING and REPORTING — including the accounting records, supporting information, and the process for capturing significant events other than transactions — precisely to identify WHERE a misstatement could arise. This 'walkthrough' understanding is what makes a targeted risk assessment possible.
Question 56
Which of the following would increase the risk of material misstatement at the FINANCIAL STATEMENT level (rather than the assertion level)?
Select an option first.
Correct answer: A — Significant doubt about the entity's ability to continue as a going concern
Explanation: Financial statement level risks are PERVASIVE — they affect many assertions and cannot be confined to one account. Going concern doubt is the classic example, because it colours the valuation and classification of virtually everything. Options D, C and B are each confined to a specific account or assertion, and are therefore assertion-level risks.
Question 57
Professional scepticism requires the auditor to:
Select an option first.
Correct answer: B — Maintain a questioning mind and critically assess audit evidence, neither assuming dishonesty nor unquestioned honesty
Explanation: Professional scepticism sits between two errors. The auditor must NOT assume dishonesty (option A) — that would make an audit impossible — but must equally NOT assume unquestioned honesty (option C). The standard is a QUESTIONING MIND and a critical assessment of evidence, alert to conditions that may indicate misstatement and to evidence that contradicts other evidence.
Question 58
An auditor identifies that the client's controls over IT access permit terminated employees to retain system credentials for up to 60 days. This is primarily a deficiency in:
Select an option first.
Correct answer: A — Logical access
Explanation: LOGICAL ACCESS covers authentication, authorisation and segregation of duties within the system — including the timely REMOVAL of access when an employee leaves. A 60-day lag creates a window in which a disgruntled former employee retains system rights. Change management concerns modifications to programmes; IT operations concerns job scheduling and backups; systems development concerns the SDLC.
Question 59
When the auditor identifies a risk of material misstatement due to fraud in revenue recognition, an appropriate response would include:
Select an option first.
Correct answer: B — Confirming contract terms directly with customers and testing revenue transactions recorded near period-end
Explanation: A fraud risk in revenue calls for a targeted, substantive response: confirming TERMS directly with customers (to detect undisclosed side agreements, rights of return, or consignment arrangements), and testing transactions recorded near PERIOD-END (where cut-off manipulation concentrates). For a fraud risk, reliance on controls alone is never sufficient, and analytics alone are too blunt.
Question 60
An auditor holds audit risk constant and the client remediates a previously ineffective control. All else equal, the auditor may now:
Select an option first.
Correct answer: C — Accept a higher detection risk and reduce substantive testing
Explanation: Effective controls lower CONTROL RISK, which lowers RMM. With audit risk held constant, a lower RMM permits a HIGHER acceptable detection risk — meaning the auditor can do LESS substantive work. The relationship is a see-saw: as client-side risk falls, the auditor's permitted detection risk rises. The auditor never 'increases' inherent risk or audit risk; one is assessed, the other is set low by design.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.