You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Auditing and Attestation
Free CPA Auditing and Attestation Practice Questions & Answers
500 exam-style Auditing and Attestation questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 61
Which of the following is an example of a preventive control?
Select an option first.
Correct answer: B — Requiring two signatures on cheques above $25,000
Explanation: A PREVENTIVE control stops an error or fraud BEFORE it occurs — dual signature requirements, system access restrictions, and segregation of duties are examples. Options C, D and A are all DETECTIVE controls: they identify a problem after the fact. A well-designed system uses both, since prevention is cheaper but detection catches what prevention misses.
Question 62
Landell Foods outsources its entire IT infrastructure. The user auditor obtains a SOC 1 Type 1 report. This report:
Select an option first.
Correct answer: B — Describes the design of controls at a point in time but provides no evidence of operating effectiveness
Explanation: A TYPE 1 report addresses the DESIGN and implementation of controls at a POINT IN TIME. It says nothing about whether those controls OPERATED effectively over the period, so it cannot support reliance. Only a TYPE 2 report — covering design AND operating effectiveness across a period — supports reliance. Accepting a Type 1 as a basis for reliance is a common and serious error.
Question 63
Which condition would MOST likely be assessed as a fraud risk factor relating to 'rationalisation'?
Select an option first.
Correct answer: B — Management's known history of violations of securities laws, with claims that 'everyone does it'
Explanation: RATIONALISATION is the attitude or set of ethical values that allows a person to justify a dishonest act. A management team that dismisses prior violations as normal industry behaviour is rationalising. Option D is OPPORTUNITY. Option C is PRESSURE. Option A is a fraud risk indicator but is better classified as an opportunity or a condition, not an attitude.
Question 64
The auditor's determination of performance materiality is:
Select an option first.
Correct answer: B — A matter of professional judgement, affected by the auditor's understanding of the entity and the nature and extent of misstatements identified in prior audits
Explanation: Performance materiality is a matter of PROFESSIONAL JUDGEMENT. While the 50-75% range is a common benchmark, the auditor sets it lower where prior audits revealed numerous misstatements, where the entity is new, or where the control environment is weak — all of which increase the risk that aggregation will produce a material misstatement. It is never set by management.
Question 65
Which of the following is LEAST likely to be a relevant assertion for a cash balance?
Select an option first.
Correct answer: B — Cut-off of depreciation
Explanation: Assertions are account-specific. CUT-OFF OF DEPRECIATION has nothing to do with cash — depreciation is a non-cash expense affecting fixed assets. Existence (does the cash exist?), rights (is it unrestricted and the entity's own?) and completeness (are all accounts recorded?) are all highly relevant to cash. Identifying which assertions are RELEVANT to a given account is the first step in designing procedures.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 66
Auditors are required to design procedures to identify litigation, claims and assessments. Which is a required procedure?
Select an option first.
Correct answer: C — Inquiry of management, review of board minutes, and review of legal expense accounts
Explanation: Required procedures for identifying litigation include INQUIRING of management and others, REVIEWING BOARD MINUTES (where litigation is typically discussed), reviewing correspondence with legal counsel, and REVIEWING LEGAL EXPENSE accounts (a spike in legal fees signals activity). The auditor then requests a legal letter through management to corroborate what was found.
Question 67
In an audit of a small entity where segregation of duties is impractical, the auditor should:
Select an option first.
Correct answer: D — Look for compensating controls, such as active owner involvement in reviewing transactions
Explanation: In small entities, formal segregation is often impossible. The auditor should look for COMPENSATING CONTROLS — most commonly, direct and active involvement by the OWNER-MANAGER in reviewing transactions, opening the bank statements, and approving disbursements. Where such involvement exists and is effective, control risk need not be at maximum. Option A skips the evaluation entirely; option D substitutes representation for evidence.
Question 68
An entity's audit committee is composed entirely of executive directors. This is MOST likely to:
Select an option first.
Correct answer: D — Increase the assessed risk of material misstatement at the financial statement level, due to weak governance and oversight
Explanation: An audit committee of EXECUTIVE directors cannot provide INDEPENDENT oversight of management — it is management overseeing itself. That weakens the CONTROL ENVIRONMENT, which is a PERVASIVE, FINANCIAL-STATEMENT-LEVEL risk affecting many assertions. The auditor's response is an OVERALL one: heightened scepticism, more experienced staff, greater unpredictability.
Question 69
The risk that an auditor concludes control risk is LOWER than it actually is results in:
Select an option first.
Correct answer: A — An underauditing problem, reducing effectiveness and increasing audit risk
Explanation: Underestimating control risk means the auditor sets detection risk too HIGH and performs too LITTLE substantive work. That is a problem of EFFECTIVENESS — the audit may fail to detect a material misstatement, and audit risk is actually higher than the auditor believes. The reverse error (overestimating control risk) is a problem of EFFICIENCY: the auditor does unnecessary work but reaches the right conclusion.
Question 70
Which factor would MOST increase inherent risk for the completeness of accounts payable?
Select an option first.
Correct answer: D — The client has an incentive to understate liabilities to meet a debt covenant
Explanation: INHERENT risk reflects susceptibility BEFORE controls. A management INCENTIVE to understate liabilities — to stay within a covenant, to hit a leverage target — creates a direct pressure to omit payables, which is exactly the completeness risk. Option C is a control (affecting control risk, not inherent). Options B and A describe conditions that, if anything, reduce complexity.
Question 71
An IT general control deficiency in change management means that:
Select an option first.
Correct answer: A — Automated application controls cannot be relied upon without further work
Explanation: If CHANGE MANAGEMENT is ineffective, program logic could have been altered during the period without authorisation or testing. A control tested in March may not be the control that ran in September. Therefore automated application controls cannot be relied upon without additional work — typically, more substantive testing or direct testing of the program logic at multiple points. A control deficiency is not, by itself, a misstatement.
Question 72
Which of the following is an appropriate OVERALL response to an assessed risk of material misstatement at the financial statement level?
Select an option first.
Correct answer: B — Assigning more experienced staff, providing more supervision, and incorporating unpredictability into procedures
Explanation: FINANCIAL STATEMENT LEVEL risks are pervasive, so responses must be pervasive: assigning more EXPERIENCED personnel, increasing SUPERVISION, heightening PROFESSIONAL SCEPTICISM, and introducing UNPREDICTABILITY into the nature, timing and extent of procedures. Options D, A and C are all further procedures at the ASSERTION level, responsive to specific risks rather than pervasive ones.
Question 73
A control deficiency, a significant deficiency and a material weakness differ principally in:
Select an option first.
Correct answer: A — Their severity — that is, the magnitude of the potential misstatement and the likelihood of occurrence
Explanation: The three form a SEVERITY ladder. A CONTROL DEFICIENCY exists when a control does not allow management or employees to prevent or detect misstatements on a timely basis. A SIGNIFICANT DEFICIENCY is important enough to merit attention by those charged with governance. A MATERIAL WEAKNESS creates a REASONABLE POSSIBILITY that a MATERIAL misstatement will not be prevented or detected. Severity is a function of MAGNITUDE and LIKELIHOOD — not of who found it.
Question 74
An auditor plans to use internal audit's work in obtaining evidence. Before doing so, the auditor must evaluate:
Select an option first.
Correct answer: C — The internal audit function's objectivity, competence, and whether it applies a systematic and disciplined approach
Explanation: Three criteria: OBJECTIVITY (organisational status and reporting lines — reporting to the AUDIT COMMITTEE supports objectivity, reporting to the CFO undermines it), COMPETENCE, and whether the function applies a SYSTEMATIC AND DISCIPLINED APPROACH including quality control. Option B names a specific fact that would COUNT AGAINST objectivity, but the requirement is the full three-part evaluation.
Question 75
The nature of audit procedures refers to:
Select an option first.
Correct answer: B — The purpose and type of the procedure (e.g. inspection, confirmation, recalculation)
Explanation: NATURE = the purpose and TYPE of procedure. TIMING = when it is performed (interim vs year-end). EXTENT = how many items (sample size). The auditor responds to higher risk by changing all three: more reliable types of procedure (nature), performed closer to year-end (timing), on larger samples (extent). Distinguishing the three is fundamental to designing a response.
Question 76
Which entity-level control would MOST directly mitigate the risk of management override?
Select an option first.
Correct answer: C — An active, independent audit committee that reviews significant unusual transactions and maintains a whistleblower hotline
Explanation: Management override is uniquely hard to control, because management sits ABOVE the process-level controls. The only effective mitigation comes from ABOVE management — an INDEPENDENT AUDIT COMMITTEE with real authority, reviewing unusual transactions and providing a channel (the whistleblower hotline) that bypasses management entirely. Process-level controls (options A, D, D) can all be overridden by the very people who designed them.
Question 77
In assessing the risk of material misstatement for a newly acquired subsidiary, the auditor should consider:
Select an option first.
Correct answer: A — That integration of systems and controls may be incomplete, elevating risk in the first year
Explanation: A newly acquired subsidiary often runs on DIFFERENT systems, DIFFERENT policies and an UNINTEGRATED control environment — and the acquirer's controls may not yet extend to it. That elevates risk in the first year, particularly around purchase accounting, opening balances, and the consistency of accounting policies. Prior auditors' opinions do not transfer.
Question 78
Tests of controls are NOT necessary when:
Select an option first.
Correct answer: A — Substantive procedures alone provide sufficient appropriate evidence and the auditor does not intend to rely on controls
Explanation: The auditor performs tests of controls only when INTENDING TO RELY on them, or when substantive procedures ALONE cannot provide sufficient appropriate evidence (as is common in highly automated environments where a paper trail does not exist). If neither condition applies, a fully substantive approach is legitimate and tests of controls are unnecessary.
Question 79
The auditor should treat which of the following as a presumed significant risk?
Select an option first.
Correct answer: C — Revenue recognition fraud risk and management override of controls
Explanation: The standards PRESUME a fraud risk in REVENUE RECOGNITION (rebuttable, with documentation) and REQUIRE testing of MANAGEMENT OVERRIDE in every audit (not rebuttable). Both are treated as significant risks demanding substantive responses. The remaining options are routine, low-judgement processes that would rarely rise to a significant risk.
Question 80
An auditor notes that the client's accounting personnel lack knowledge of a newly effective accounting standard that materially affects the financial statements. This is MOST directly:
Select an option first.
Correct answer: C — A risk factor relating to competence, elevating the risk of material misstatement
Explanation: COMMITMENT TO COMPETENCE is a principle of the COSO control environment. Accounting staff who do not understand a standard that materially affects the statements create a heightened RISK OF MATERIAL MISSTATEMENT for the affected balances. It is not a scope limitation (the auditor can still obtain evidence) and it is not, in itself, a reason to modify the opinion.
Question 81
Which statement about audit risk is correct?
Select an option first.
Correct answer: C — The auditor sets audit risk at an acceptably low level as a matter of judgement, typically before designing procedures
Explanation: AUDIT RISK — the risk of expressing an inappropriate opinion on materially misstated statements — is SET by the auditor at an acceptably LOW level (often described as 5%), as a matter of professional judgement, and it drives the design of the audit. It can never be ELIMINATED (option D), because of the inherent limitations of an audit — which is why the opinion offers reasonable, not absolute, assurance.
Question 82
The engagement partner's responsibility for the direction, supervision and performance of the audit means the partner must:
Select an option first.
Correct answer: C — Be satisfied that sufficient appropriate evidence has been obtained and that the engagement team's work supports the conclusions
Explanation: The engagement partner takes RESPONSIBILITY for the overall quality of the engagement and must be SATISFIED that sufficient appropriate evidence has been obtained to support the opinion. That requires review of critical areas, significant judgements and the financial statements — but it does not require the partner to perform every procedure personally or to review every single working paper.
Question 83
A material weakness in a non-issuer audit must be communicated:
Select an option first.
Correct answer: D — In writing to management and those charged with governance, even if the weakness was remediated during the period
Explanation: Material weaknesses (and significant deficiencies) must be communicated IN WRITING to MANAGEMENT and THOSE CHARGED WITH GOVERNANCE. Notably, the communication is required even if the deficiency was REMEDIATED during the period — governance still needs to know it existed. And a deficiency need not have produced an actual misstatement to require communication; the potential is enough.
Question 84
Which of the following would an auditor consider a 'relevant assertion'?
Select an option first.
Correct answer: D — An assertion that has a reasonable possibility of containing a misstatement that would cause the financial statements to be materially misstated
Explanation: A RELEVANT ASSERTION is one with a reasonable possibility of containing a misstatement that would MATERIALLY misstate the financial statements. Identifying relevant assertions focuses the audit where it matters — the auditor need not test every assertion for every account. For cash, existence is highly relevant; for a payables balance, completeness is; for a Level 3 investment, valuation is.
Question 85
Berrow Group's management has significant estimation uncertainty in warranty provisions. The auditor should:
Select an option first.
Correct answer: D — Evaluate how management made the estimate, test the data and assumptions, and consider developing an independent estimate or range
Explanation: For accounting estimates, the auditor may: (1) test how MANAGEMENT made the estimate (data, assumptions, method); (2) test events occurring UP TO THE REPORT DATE that provide evidence about the estimate; or (3) develop an INDEPENDENT point estimate or range. Estimation uncertainty is a reason to work harder, never a reason to accept the number or to abandon the audit.
Question 86
The primary difference between a significant deficiency and a material weakness is:
Select an option first.
Correct answer: A — A material weakness creates a reasonable possibility that a MATERIAL misstatement will not be prevented or detected on a timely basis
Explanation: A MATERIAL WEAKNESS is a deficiency, or combination of deficiencies, such that there is a REASONABLE POSSIBILITY that a MATERIAL misstatement will not be prevented or detected on a timely basis. A SIGNIFICANT DEFICIENCY is less severe but still important enough to merit the attention of those charged with governance. Both must be communicated in writing; the difference is severity, not fraud, not audience, not entity type.
Question 87
An auditor is auditing a client that has adopted a new ERP system mid-year. The auditor should:
Select an option first.
Correct answer: D — Obtain an understanding of, and test as necessary, the controls in BOTH systems and the data conversion process
Explanation: Two systems operated during the period, so BOTH must be understood and, if reliance is planned, tested. Critically, the DATA CONVERSION (migration of opening balances and master data) is a high-risk, one-off event that can introduce material errors — and it is the step candidates and auditors most often forget to address.
Question 88
A client's whistleblower hotline received three anonymous allegations of expense report fraud by a divisional manager. The auditor should:
Select an option first.
Correct answer: A — Consider the allegations in the fraud risk assessment and evaluate management's response and investigation
Explanation: Allegations of fraud — however received, including anonymously — are INPUTS to the auditor's fraud risk assessment. The auditor evaluates the nature of the allegations, how MANAGEMENT investigated and responded, and whether the response was adequate. Dismissing them because they are anonymous is a failure of professional scepticism; anonymity is the norm for whistleblowers, for obvious reasons.
Question 89
The extent of audit procedures generally increases when:
Select an option first.
Correct answer: B — The risk of material misstatement increases
Explanation: A higher RMM forces detection risk DOWN, and the auditor lowers detection risk by increasing the EXTENT (larger samples), improving the NATURE (more reliable procedures), and moving the TIMING closer to year-end. Options A, C and D all describe conditions that would permit LESS work, not more.
Question 90
Sampling risk is BEST described as the risk that:
Select an option first.
Correct answer: C — The auditor's conclusion based on a sample differs from the conclusion that would be reached had the entire population been tested
Explanation: SAMPLING risk arises solely from examining a SUBSET rather than the whole population — the sample may simply not be representative. NON-SAMPLING risk covers everything else that can go wrong: using an inappropriate procedure, misinterpreting evidence, failing to recognise a misstatement (options A, B and D). Non-sampling risk is reduced through planning, supervision and review; sampling risk is reduced by increasing sample size.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.