You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Auditing and Attestation
Free CPA Auditing and Attestation Practice Questions & Answers
500 exam-style Auditing and Attestation questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 121
A BATCH TOTAL and a HASH TOTAL differ in that a hash total:
Select an option first.
Correct answer: A — Sums a field that has no intrinsic meaning, such as customer account numbers, purely to detect processing errors
Explanation: A HASH TOTAL sums a field that is otherwise MEANINGLESS as a total — the sum of all customer account numbers, for example. The figure has no financial significance; its only purpose is to detect whether any record was lost, added or altered during processing. A BATCH (financial) total sums a MEANINGFUL field such as dollar amounts. A RECORD COUNT counts records. All three are reconciliation controls.
Question 122
The 'test data' approach to testing programmed application controls involves:
Select an option first.
Correct answer: A — Processing the auditor's own fictitious transactions, including invalid ones, through the client's program to see whether controls handle them correctly
Explanation: The TEST DATA approach runs the auditor's OWN prepared transactions — deliberately including invalid ones (a negative quantity, an unauthorised code) — through the CLIENT'S program to confirm that the programmed controls accept the valid and reject the invalid. Option D describes PARALLEL SIMULATION. Option C describes an INTEGRATED TEST FACILITY. A key limitation of test data: it tests the program AT A POINT IN TIME, so it relies on change management to confirm the same program ran all year.
Question 123
General IT controls (ITGCs) support the effective functioning of application controls by:
Select an option first.
Correct answer: B — Providing assurance that programs operate consistently and that data is protected from unauthorised change
Explanation: ITGCs (logical access, change management, IT operations, and systems development) do not process transactions themselves — they create the ENVIRONMENT in which application controls can be relied upon. If ITGCs are effective, the auditor can be confident a programmed control operated consistently all period. If they are not, even a perfectly designed application control cannot be relied upon.
Question 124
A TOLERABLE RATE of deviation in a test of controls should be set:
Select an option first.
Correct answer: A — Lower when the auditor plans to place greater reliance on the control
Explanation: The more RELIANCE the auditor plans to place on a control, the LOWER the tolerable deviation rate must be — greater reliance demands greater confidence that the control works, which leaves less room for deviation. A lower tolerable rate, holding other factors constant, INCREASES the required sample size. Setting it equal to the expected rate (option C) would leave no margin at all and force an impossibly large sample.
Question 125
DISCOVERY SAMPLING is a form of attribute sampling designed for situations where:
Select an option first.
Correct answer: D — The auditor wants to detect at least one instance of a critical deviation (such as fraud) if the deviation rate exceeds a specified low rate
Explanation: DISCOVERY SAMPLING is used when even a SINGLE occurrence would be critical — for example, evidence of fraud or a circumvented key control. The sample is sized so that if the true deviation rate is at or above a specified (low) rate, the sample will contain at least one example with a given confidence. Finding even one such item typically prompts an expanded investigation.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 126
The engagement quality control reviewer for an issuer audit must:
Select an option first.
Correct answer: A — Have competence and independence, and evaluate the significant judgements and conclusions without being a member of the engagement team
Explanation: The EQ reviewer must possess the COMPETENCE and INDEPENDENCE to perform an objective evaluation, and must NOT be part of the engagement team (to preserve objectivity). The reviewer evaluates the significant JUDGEMENTS and CONCLUSIONS but does not re-perform the audit. For issuers, the review is required before the firm grants permission to issue the report.
Question 127
'Tone at the top' is an element of the control environment because it:
Select an option first.
Correct answer: C — Sets the ethical climate and the importance management places on internal control, which pervades the entire organisation
Explanation: TONE AT THE TOP reflects the integrity, ethical values and control consciousness demonstrated by management and those charged with governance. It is the most PERVASIVE element of the control environment: employees take their cue from leadership, so a poor tone at the top undermines every other control, while a strong one reinforces them. This is why the control environment is the foundation of COSO.
Question 128
A FRAUD BRAINSTORMING session among the engagement team is REQUIRED and should:
Select an option first.
Correct answer: C — Occur during planning, with the engagement partner's participation, to consider how and where the financial statements might be susceptible to fraud
Explanation: The fraud brainstorming discussion is MANDATORY in every audit, occurs during PLANNING, and must include the engagement partner (who may use judgement about which team members participate in each part). It considers how management could perpetrate and conceal fraudulent financial reporting, how assets could be misappropriated, and how the team should respond. Management is NOT included — the discussion is about how management itself might commit fraud.
Question 129
An entity-level control that operates at a level of precision sufficient to prevent or detect material misstatements:
Select an option first.
Correct answer: C — May reduce or, in some cases, replace the testing of certain process-level controls
Explanation: A PRECISE entity-level control — for example, a detailed management review that would catch a material misstatement — may REDUCE or even REPLACE the need to test certain process-level controls, because it addresses the same risk at a higher level. The key word is PRECISION: a high-level control that is too imprecise to catch a material error provides no such substitution.
Question 130
Which of the following is an example of professional scepticism in practice?
Select an option first.
Correct answer: D — Corroborating a significant, unexpected management explanation with independent evidence rather than accepting it at face value
Explanation: Professional scepticism is a QUESTIONING MIND and a critical assessment of evidence. Corroborating a significant explanation with INDEPENDENT evidence — rather than accepting it because it is plausible or because management seems trustworthy — is scepticism in action. Options A, C and B all describe the ABSENCE of scepticism: deference to authority, complacency from a clean history, and uncritical acceptance.
Question 131
In a computerised environment, the auditor's decision to audit 'around the computer' rather than 'through' it is appropriate when:
Select an option first.
Correct answer: B — A visible audit trail exists and the volume of transactions is low enough to test inputs and outputs directly
Explanation: Auditing 'AROUND' the computer ignores the processing and tests only INPUTS against OUTPUTS — it works only when a clear AUDIT TRAIL exists and volumes are manageable. In a complex, high-volume, paperless environment (options A and C), the trail disappears inside the system and the auditor must audit 'THROUGH' the computer using CAATs (test data, parallel simulation, ITF).
Question 132
A validity check (as an input control) verifies that:
Select an option first.
Correct answer: A — A field contains data of the correct type or from an authorised list of values
Explanation: A VALIDITY check confirms that entered data is valid — for instance, that a transaction code matches an authorised list, or that a state field contains a real state code. It rejects entries that are of the wrong type or that fall outside the permissible set. Options B, C and D describe control totals, record counts and check digits respectively — different input/processing controls addressing different error types.
Question 133
The risk of material misstatement is a function of:
Select an option first.
Correct answer: B — Inherent risk and control risk, assessed together at the assertion level
Explanation: RMM = INHERENT RISK x CONTROL RISK. It represents the risk that an assertion is materially misstated BEFORE considering the auditor's own detection procedures. It is a property of the CLIENT and exists independently of the audit. The auditor ASSESSES it (rather than setting it) and then designs procedures to reduce detection risk to a level that brings overall audit risk to an acceptably low level.
Question 134
A limit (reasonableness) check would MOST likely detect which error?
Select an option first.
Correct answer: B — A payroll entry recording 400 hours worked in a single week
Explanation: A LIMIT or REASONABLENESS check rejects values outside a predetermined range — 400 hours in a week is impossible, so the check flags it. A missing field (option B) is caught by a COMPLETENESS check; a duplicate (option C) by a duplicate check; an unauthorised login (option D) by access controls. Matching the error type to the control is the skill being tested.
Question 135
When an auditor identifies a deficiency in the DESIGN of a control, this means:
Select an option first.
Correct answer: C — The control is missing or is not properly designed to meet the control objective, so that even if it operated as designed it would not prevent or detect the misstatement
Explanation: A DESIGN deficiency exists when a necessary control is MISSING, or an existing control is designed such that — even if it operated perfectly — it would not achieve the objective. This contrasts with an OPERATING deficiency, where a well-designed control does not operate as intended, or is applied by someone lacking the authority or competence. Design is evaluated first, in a walkthrough; operation is tested only if the design is sound.
Question 136
The audit committee's pre-approval of a permitted non-audit service for an issuer is required because:
Select an option first.
Correct answer: C — SOX requires the audit committee to pre-approve all audit and permitted non-audit services to protect auditor independence
Explanation: Under SOX, the audit committee must PRE-APPROVE all audit services AND all PERMITTED non-audit services provided by the external auditor — a control designed to keep management from steering lucrative extra work to the auditor in a way that could compromise independence. Pre-approval cannot rescue a PROHIBITED service; it only authorises permitted ones.
Question 137
A SHELL COMPANY scheme, in which a fraudster sets up a fictitious vendor to divert payments, is BEST prevented by:
Select an option first.
Correct answer: D — Requiring three-way matching and independent maintenance of the approved vendor master file, with segregation from those who approve payments
Explanation: A SHELL (fictitious vendor) scheme relies on the fraudster's ability to both CREATE a vendor and APPROVE payments to it. THREE-WAY MATCHING (purchase order, receiving report, invoice) ensures goods were actually ordered and received, and INDEPENDENT control of the vendor master file — segregated from payment approval — prevents one person from inventing a payee and paying it. This is segregation of duties applied to a specific fraud.
Question 138
In assessing risk, the auditor's determination that a control relies on IT means the auditor should consider:
Select an option first.
Correct answer: D — Both the application control and the general IT controls on which its continued effective operation depends
Explanation: An IT-dependent control cannot be evaluated in isolation. Its continued effective operation over the period depends on GENERAL IT CONTROLS — particularly change management (was the program altered?) and access (could an unauthorised person change it or the data?). The auditor must therefore consider both the application control AND the ITGCs that underpin it.
Question 139
The principal advantage of statistical over nonstatistical sampling is that statistical sampling:
Select an option first.
Correct answer: B — Allows the auditor to measure and control sampling risk and to objectively evaluate sample results
Explanation: STATISTICAL sampling allows sampling risk to be MEASURED and CONTROLLED, and results to be projected with a quantified precision and confidence. It does NOT eliminate non-sampling risk (option C), does not necessarily require smaller samples (option A), and still demands professional JUDGEMENT (option D) in defining the population, the deviation conditions, and the tolerable rate. Nonstatistical sampling is equally acceptable but cannot quantify sampling risk.
Question 140
Which control would BEST address the risk that a purchase is recorded in the wrong period (purchase cut-off)?
Select an option first.
Correct answer: A — Matching receiving report dates to the date the liability is recorded, with a documented cut-off procedure at period-end
Explanation: Purchase CUT-OFF depends on recording the liability in the period the goods were RECEIVED (when control passed). A control that matches the RECEIVING REPORT DATE to the recording date, reinforced by a documented period-end cut-off procedure, directly addresses the risk. The other options are valid controls but address access, cash and input reasonableness — not period allocation.
Question 141
An auditor should consider whether identified control deficiencies, taken TOGETHER, constitute a material weakness because:
Select an option first.
Correct answer: A — Individually minor deficiencies affecting the same account or assertion may aggregate to a reasonable possibility of a material misstatement
Explanation: Deficiencies must be evaluated INDIVIDUALLY AND IN COMBINATION. Several minor deficiencies affecting the SAME account or assertion can, together, create a REASONABLE POSSIBILITY that a MATERIAL misstatement would not be prevented or detected — meeting the definition of a material weakness even though no single deficiency does. This aggregation principle mirrors the one applied to misstatements.
Question 142
Which of the following would MOST likely increase the extent of the auditor's substantive procedures?
Select an option first.
Correct answer: D — A higher assessed risk of material misstatement at the assertion level
Explanation: EXTENT of substantive procedures increases as the assessed RMM at the assertion level rises — higher risk demands lower detection risk, achieved partly through larger samples. Options B, A and C all describe conditions that would REDUCE the necessary extent, because they lower the risk that a material misstatement exists undetected by the client's own systems.
Question 143
The primary reason an auditor obtains an understanding of an entity's use of IT is to:
Select an option first.
Correct answer: B — Identify and assess the risks of material misstatement arising from the IT environment, including risks from ineffective ITGCs and from unauthorised access or changes
Explanation: Understanding the IT environment is a RISK ASSESSMENT activity: the auditor identifies how IT is used to initiate, record, process and report transactions, and assesses the risks that arise — reliance on automated controls, susceptibility to unauthorised access or program change, reliance on systems that process inaccurately. It is not an advisory or valuation exercise.
Question 144
A parallel simulation, as a CAAT, involves the auditor:
Select an option first.
Correct answer: D — Processing real client data through a program the AUDITOR wrote (or controls) to independently reproduce the expected output
Explanation: In PARALLEL SIMULATION the auditor writes (or uses) an independent program that replicates the logic of the client's application, runs the CLIENT'S REAL DATA through it, and compares the auditor's output to the client's. A difference points to a defect in the client's processing. Contrast TEST DATA (fake data through the client's program) and the ITF (a dummy entity in the live system).
Question 145
An auditor is assessing a client whose management compensation is heavily weighted toward stock options that vest on hitting an earnings target. This creates:
Select an option first.
Correct answer: A — A fraud risk factor relating to incentive/pressure for fraudulent financial reporting
Explanation: Compensation tied to an EARNINGS TARGET is a classic INCENTIVE/PRESSURE factor in the fraud triangle — management personally benefits from reporting earnings that hit the threshold, creating a motive to manipulate. The auditor responds by heightening scepticism around the estimates and cut-offs management can most readily flex, and by scrutinising transactions near period-end.
Question 146
The auditor determines that a client control is manual and depends on the diligence of a single reviewer. Compared with an automated control, this manual control:
Select an option first.
Correct answer: A — Is more susceptible to human error, fatigue and override, so the auditor may need a larger sample to test its operating effectiveness
Explanation: A MANUAL control is subject to human error, fatigue, misunderstanding and override — so it does NOT operate with the consistency of an automated control. The auditor generally needs a LARGER sample to test a manual control's operating effectiveness, because each instance is an independent opportunity for the control to fail. An automated control, once its logic is verified and ITGCs are sound, operates consistently and can be tested with fewer instances.
Question 147
Which of the following describes a 'walkthrough' correctly?
Select an option first.
Correct answer: D — Tracing one or a few transactions through the entire process to confirm understanding of the flow and to evaluate the design and implementation of controls
Explanation: A WALKTHROUGH follows one (or a very few) transaction(s) from initiation through the accounting system to the general ledger and financial statements. Its purpose is to CONFIRM UNDERSTANDING of the transaction flow and to evaluate whether relevant controls are DESIGNED and IMPLEMENTED effectively. It is not a test of operating effectiveness (which requires a sample) — it is a design-and-implementation procedure.
Question 148
In the audit risk model, if the auditor decides to rely on controls and testing confirms they are effective, the effect is to:
Select an option first.
Correct answer: D — Lower assessed control risk, permit higher detection risk, and reduce the extent of substantive procedures
Explanation: Confirming that controls operate effectively LOWERS assessed control risk, which lowers RMM. With audit risk held constant, a lower RMM permits a HIGHER acceptable detection risk, and the auditor may therefore REDUCE the extent (and sometimes change the timing) of substantive procedures. This is the whole efficiency rationale for testing controls in the first place.
Question 149
A duplicate-check control in a purchasing system is designed to prevent:
Select an option first.
Correct answer: A — Paying the same invoice twice
Explanation: A DUPLICATE CHECK compares a new transaction against those already processed and rejects an exact repeat — its classic use is preventing the same invoice from being PAID TWICE, whether by error or by a fraudster resubmitting a paid invoice. Option C is addressed by a validity check, option C by a limit check, and option D by a completeness check. Each error type has its matching control.
Question 150
An auditor originally set AR=5%, IR=100%, CR=50%, giving DR=10%. After control testing, the auditor revises CR upward to 80%. To keep audit risk unchanged, the revised detection risk must be approximately:
Select an option first.
Correct answer: D — 6.25%
Explanation: DR = AR/(IR x CR) = 0.05/(1.00 x 0.80) = 0.0625, or 6.25%. Because control risk ROSE, the acceptable detection risk must FALL — the auditor must do MORE substantive work. Candidates who answer 16% have divided in the wrong direction; those who answer 10% have failed to revise at all. The lesson: a failed control test does not merely 'add procedures', it mathematically compresses the detection risk the auditor may accept.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.