You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Auditing and Attestation
Free CPA Auditing and Attestation Practice Questions & Answers
500 exam-style Auditing and Attestation questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 91
In a test of controls, the risk of ASSESSING CONTROL RISK TOO LOW is a concern because it:
Select an option first.
Correct answer: C — Affects audit EFFECTIVENESS — the auditor over-relies on a control that is not effective and performs insufficient substantive work
Explanation: The risk of assessing control risk TOO LOW (also called over-reliance, or beta risk) is an EFFECTIVENESS problem: the auditor concludes a control works when it does not, sets detection risk too high, does too little substantive testing, and may fail to detect a material misstatement. The opposite error — assessing control risk too HIGH (under-reliance, alpha risk) — is merely an EFFICIENCY problem: unnecessary work, but the right conclusion.
Question 92
In a substantive test, the risk of INCORRECT ACCEPTANCE relates to:
Select an option first.
Correct answer: C — Concluding a materially misstated balance is fairly stated
Explanation: The risk of INCORRECT ACCEPTANCE is the risk of concluding that a balance is NOT materially misstated when in fact it IS — an EFFECTIVENESS failure, and the one auditors care about most, because it leads to an unqualified opinion on misstated statements. The risk of INCORRECT REJECTION (option B) leads to unnecessary additional work, an efficiency problem only.
Question 93
Segregation of duties is designed to separate:
Select an option first.
Correct answer: C — Authorisation, recording and custody of assets
Explanation: The three incompatible functions are AUTHORISATION (approving a transaction), RECORDING (entering it in the books), and CUSTODY of the related assets. Any one person holding two of the three can perpetrate AND conceal a misappropriation — for instance, someone who both receives cash (custody) and posts to the receivable ledger (recording) can steal a payment and write off the account.
Question 94
The audit STRATEGY differs from the audit PLAN in that the strategy:
Select an option first.
Correct answer: D — Sets the overall scope, timing and direction of the audit, and guides the development of the more detailed plan
Explanation: The overall AUDIT STRATEGY sets the SCOPE, TIMING and DIRECTION — the reporting objectives, the materiality levels, the areas of higher risk, and the resources needed. The AUDIT PLAN is more detailed: it describes the NATURE, TIMING and EXTENT of the specific risk assessment procedures and further audit procedures. Strategy first, plan second, and both are revised as the audit progresses.
Question 95
In a GROUP audit, component materiality is:
Select an option first.
Correct answer: B — Set LOWER than group materiality, to reduce the risk that the aggregate of uncorrected misstatements across components exceeds group materiality
Explanation: COMPONENT materiality must be LOWER than GROUP materiality. The reason is aggregation: if each of ten components were audited at group materiality, undetected misstatements could accumulate to ten times that amount. The GROUP engagement partner is responsible for determining component materiality — it is not left to the component auditor.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 96
In an INITIAL audit engagement, the auditor must obtain sufficient appropriate evidence about:
Select an option first.
Correct answer: C — OPENING BALANCES, including whether they contain misstatements that materially affect the current period and whether accounting policies have been consistently applied
Explanation: In an INITIAL engagement, the auditor must obtain evidence about OPENING BALANCES — because a misstated opening balance flows straight into the current period's income statement. The auditor reviews the predecessor's working papers, performs procedures on the opening balances, and determines whether accounting policies were CONSISTENTLY applied. The predecessor's opinion does not transfer.
Question 97
Under the standards on noncompliance with laws and regulations, laws with a DIRECT effect on the financial statements:
Select an option first.
Correct answer: C — Require the auditor to obtain sufficient appropriate evidence regarding compliance
Explanation: Laws with a DIRECT and MATERIAL effect on the determination of amounts in the financial statements — tax law, pension law — require the auditor to obtain SUFFICIENT APPROPRIATE EVIDENCE about compliance, because non-compliance directly misstates the numbers. For laws with only an INDIRECT effect (environmental, health and safety, licensing), the auditor's responsibility is narrower: inquiry, inspection of correspondence with regulators, and remaining alert.
Question 98
Which is an example of a law with an INDIRECT effect on the financial statements?
Select an option first.
Correct answer: A — Occupational health and safety regulations, breach of which could give rise to fines or closure
Explanation: HEALTH AND SAFETY regulations do not determine any amount in the financial statements directly — but a breach could lead to fines, litigation or a plant shutdown, which WOULD have a financial effect. That indirect chain is what defines this category. Options C and C have a DIRECT effect on reported amounts, and option D is an accounting standard rather than a law.
Question 99
Benford's Law is used in audit analytics to:
Select an option first.
Correct answer: D — Test whether the distribution of leading digits in a data set conforms to an expected natural pattern, flagging possible manipulation
Explanation: BENFORD'S LAW holds that in many naturally occurring data sets, the leading digit is '1' about 30% of the time, '2' about 18%, and so on in decreasing frequency. Fabricated numbers rarely follow this distribution — people inventing figures spread the leading digits too evenly, or cluster them just below approval thresholds. A significant departure is a red flag warranting investigation, not proof of fraud.
Question 100
The two types of fraud relevant to the auditor are:
Select an option first.
Correct answer: C — Fraudulent financial reporting and misappropriation of assets
Explanation: The standards recognise two types: FRAUDULENT FINANCIAL REPORTING (intentional misstatement of the statements — typically by MANAGEMENT, to deceive users) and MISAPPROPRIATION OF ASSETS (theft — typically by EMPLOYEES, though management can do it too). They differ in perpetrator, motive and materiality: employee theft is often immaterial, while management fraud is usually material by design. 'Unintentional fraud' (option D) is a contradiction — intent is what makes it fraud rather than error.
Question 101
An auditor is auditing a client with a highly automated environment where NO paper audit trail exists for revenue transactions. In this situation:
Select an option first.
Correct answer: C — Substantive procedures alone may not provide sufficient appropriate evidence, so the auditor MUST test controls
Explanation: Where information is initiated, recorded, processed or reported ONLY in electronic form and substantive procedures alone cannot provide sufficient appropriate evidence, the auditor is REQUIRED to test controls. This is the one circumstance in which control testing is mandatory rather than a matter of the auditor's efficiency judgement — there is simply no other route to the evidence.
Question 102
Which of the following is an application control rather than an IT general control?
Select an option first.
Correct answer: A — A limit check that rejects any purchase order over $1,000,000
Explanation: A LIMIT CHECK operates at the TRANSACTION level, validating individual inputs — that is an APPLICATION control. Options D, B and C are IT GENERAL CONTROLS (logical access, change management and IT operations respectively), which operate across the whole environment and provide the foundation on which application controls can be relied upon.
Question 103
The auditor's evaluation of whether the entity has the ability to continue as a going concern includes considering:
Select an option first.
Correct answer: A — Conditions such as recurring losses, negative working capital, loan defaults, loss of a key customer or supplier, and legal proceedings
Explanation: The standards list a range of conditions and events: FINANCIAL (recurring operating losses, negative working capital, adverse ratios, loan defaults, arrears in dividends, inability to obtain credit), OPERATING (loss of key management, key customer or supplier, labour difficulties), and OTHER (legal proceedings, loss of a franchise or licence). No single indicator is decisive; the auditor weighs them in aggregate, alongside management's mitigating plans.
Question 104
An auditor uses NONSTATISTICAL sampling. Compared with statistical sampling, this means:
Select an option first.
Correct answer: A — Sampling risk exists but cannot be quantified; the auditor uses judgement to determine sample size and evaluate results
Explanation: NONSTATISTICAL sampling is entirely acceptable under the standards. Sampling risk still EXISTS — it just cannot be MEASURED, so the auditor relies on judgement to set sample size and to evaluate results. Results are still PROJECTED to the population (option D is wrong). The sample size for a nonstatistical sample should be COMPARABLE to what a statistical sample would require in the same circumstances.
Question 105
Stratification of a population in audit sampling is used to:
Select an option first.
Correct answer: D — Reduce the variability within each subgroup, which improves efficiency by allowing a smaller total sample
Explanation: STRATIFICATION divides a population into subgroups (strata) with similar characteristics — usually by dollar value. Because variability WITHIN each stratum is lower, a smaller total sample achieves the same precision. It also lets the auditor test high-value items with certainty (100% examination of the top stratum) while sampling the rest, which is the opposite of avoiding them.
Question 106
The direction of the auditor's testing for a small entity with an owner-manager who reviews all transactions:
Select an option first.
Correct answer: D — May place reliance on the owner's review as a compensating control, but must consider the owner's ability to override it
Explanation: Active OWNER-MANAGER involvement is a genuine COMPENSATING control in a small entity, and it can support a lower control risk assessment. But it cuts both ways: the very concentration of authority that makes the review effective ALSO gives the owner unrestricted ability to OVERRIDE controls. The auditor must weigh both effects — this dual nature is the classic small-entity dilemma.
Question 107
Which of the following would MOST likely indicate a risk of bill-and-hold revenue manipulation?
Select an option first.
Correct answer: A — The client recognises revenue for goods invoiced but still physically held in its own warehouse at the customer's request
Explanation: BILL-AND-HOLD arrangements — invoicing the customer while retaining physical possession — are a classic revenue manipulation, because they let the seller pull revenue into the current period. Strict criteria must be met before revenue is recognised: the arrangement must be substantive, the goods must be identified separately as the customer's, they must be ready for physical transfer, and the seller must not be able to use them or direct them to another customer.
Question 108
Channel stuffing is BEST described as:
Select an option first.
Correct answer: D — Shipping excessive product to distributors near period-end, often with generous return rights, to inflate current-period revenue
Explanation: CHANNEL STUFFING inflates current-period revenue by pushing more product into the distribution channel than the channel can sell — usually sweetened with extended payment terms or liberal return rights. The revenue reverses in later periods as returns come back. Audit signals: a spike in shipments in the final days of the period, rising receivable days, and unusually high subsequent returns.
Question 109
A 'side agreement' in the context of revenue recognition is:
Select an option first.
Correct answer: B — A supplementary contract term, often undisclosed to the accounting department, that alters the customer's obligations (such as a right of return or a cancellation right)
Explanation: SIDE AGREEMENTS are undisclosed terms — a right of return, a contingency, a cancellation right — that undermine the revenue recognition the accounting records reflect. Because they are deliberately kept from the accounting function, the only reliable way to find them is to CONFIRM THE FULL TERMS directly with the customer, and to inquire of sales personnel rather than relying solely on the contract file.
Question 110
The auditor's consideration of an entity's use of a specialist as part of the CLIENT's control environment means the auditor should:
Select an option first.
Correct answer: A — Understand the specialist's role in the entity's process and evaluate whether the entity's controls over the specialist's work are adequate
Explanation: Where an entity RELIES on a specialist (an actuary, a valuation expert) in preparing its financial statements, that reliance is part of the entity's PROCESS. The auditor must understand how the entity uses the specialist, what data it gives them, how it reviews and challenges their output, and whether those controls are adequate. A client that accepts an actuary's report without scrutiny has a control gap.
Question 111
In a governmental audit, 'opinion units' refer to:
Select an option first.
Correct answer: C — Separate levels of reporting on which the auditor expresses distinct opinions, such as governmental activities, business-type activities, each major fund, and the aggregate remaining fund information
Explanation: Governmental financial statements require opinions on multiple OPINION UNITS — governmental activities, business-type activities, each MAJOR FUND, the aggregate discretely presented component units, and the aggregate remaining fund information. Materiality is determined SEPARATELY for each opinion unit, which is why governmental audits can produce a modified opinion on one unit and an unmodified opinion on the others.
Question 112
An imprest payroll bank account is a control that:
Select an option first.
Correct answer: B — Limits the entity's exposure by holding only the exact amount needed to cover the payroll, making unauthorised disbursements immediately apparent
Explanation: An IMPREST account is funded with EXACTLY the amount of the net payroll and no more. Any cheque presented beyond that amount will not clear, and the account should reconcile to zero (or to outstanding cheques) after the payroll clears. It CONTAINS the exposure and makes anomalies obvious — a classic and elegant control.
Question 113
Which statement about the relationship between tests of controls and substantive procedures is correct?
Select an option first.
Correct answer: A — Effective controls may reduce, but never eliminate, substantive procedures
Explanation: Substantive procedures are REQUIRED for all relevant assertions of every MATERIAL class of transactions, balance and disclosure — irrespective of control effectiveness. Effective controls REDUCE the extent, and may permit interim rather than year-end timing, but they never ELIMINATE substantive testing. This is an absolute rule and a favourite exam point.
Question 114
When an entity's internal audit function has performed a physical inventory count at several locations, the external auditor:
Select an option first.
Correct answer: A — May use the work if internal audit is objective and competent, but must still perform sufficient procedures directly, including re-performing some of the work
Explanation: Using internal audit's work requires evaluating OBJECTIVITY, COMPETENCE and a SYSTEMATIC AND DISCIPLINED APPROACH, and then performing sufficient procedures on the body of work used — including RE-PERFORMING some of it to confirm its adequacy. The external auditor cannot rely wholesale (option C), because sole responsibility for the opinion is undivided; but neither must every item be redone (option D), which would defeat the purpose.
Question 115
The auditor's assessment of risk for an entity operating in a hyper-competitive industry with thin margins should recognise that:
Select an option first.
Correct answer: B — Pressure to meet targets increases the fraud risk relating to fraudulent financial reporting
Explanation: Thin margins and intense competition create PRESSURE — the first leg of the fraud triangle. Small manipulations can flip a loss into a profit when margins are narrow, which magnifies the incentive. The auditor should heighten scepticism around revenue cut-off, expense deferral, and the reserves that management can most easily flex.
Question 116
Which is a valid reason for the auditor to modify the planned audit approach mid-engagement?
Select an option first.
Correct answer: D — Evidence obtained indicates that a control the auditor planned to rely on is not operating effectively
Explanation: The audit plan is DYNAMIC. If evidence contradicts the auditor's original risk assessment — a control fails, an unexpected misstatement emerges, a new fraud indicator appears — the auditor MUST revise the assessment and the planned procedures. Client requests (option A) and budget pressure (option C) are emphatically NOT valid reasons to change the approach.
Question 117
The auditor determines that a control is well designed but has NOT been implemented. The auditor should:
Select an option first.
Correct answer: B — Conclude that the control cannot be relied upon; there is nothing to test
Explanation: A control that has not been IMPLEMENTED does not exist in operation — there is literally nothing to test. Design and implementation are evaluated FIRST (typically via a walkthrough); only if a control is both well designed AND implemented does the question of testing its OPERATING EFFECTIVENESS arise. Testing an unimplemented control is a waste of time and would produce a meaningless result.
Question 118
In risk assessment, 'inquiry of those charged with governance' is useful primarily because governance:
Select an option first.
Correct answer: C — May have knowledge of fraud risks, management's oversight, and matters that management may be reluctant to disclose
Explanation: Those charged with GOVERNANCE oversee management, and are therefore positioned to know about matters management might prefer to conceal — suspected or alleged fraud, the tone at the top, management's response to prior deficiencies, and significant unusual transactions. Their perspective is an independent check on management's account of the business, which is exactly why the inquiry is required.
Question 119
The auditor identifies that a client capitalises repairs that should be expensed, in amounts that are individually immaterial but that consistently push earnings upward. The auditor should:
Select an option first.
Correct answer: A — Consider whether the pattern indicates management BIAS and evaluate the misstatements in AGGREGATE
Explanation: Individually immaterial misstatements that all run in the SAME DIRECTION are a hallmark of MANAGEMENT BIAS. The auditor must accumulate them, evaluate them in AGGREGATE against materiality, and consider what the pattern says about management's integrity and the reliability of its representations. Dismissing them one by one on grounds of size is precisely the failure the aggregation rule exists to prevent.
Question 120
A CHECK DIGIT is an input control that:
Select an option first.
Correct answer: B — Appends a computed digit to an identification number so that transposition or entry errors in that number are detected
Explanation: A CHECK DIGIT is an extra digit mathematically derived from the other digits of an identifier (an account or part number). If the number is mis-keyed or transposed, the recomputed check digit will not match, and the entry is rejected. Option D describes a record count; option C describes a field (validity) check; option D describes a control total. All are input controls, but the check digit specifically guards the accuracy of identification numbers.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.