You’re on a roll
Create a free account to save your CPA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › CPA › Auditing and Attestation
Free CPA Auditing and Attestation Practice Questions & Answers
500 exam-style Auditing and Attestation questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 151
Barrowford Ltd has overall materiality of $500,000 and performance materiality of $350,000. During the audit, the team identifies uncorrected misstatements of $180,000 in receivables and $160,000 in accruals, both overstatements. Management corrects the receivables item only. The auditor should:
Select an option first.
Correct answer: B — Evaluate the remaining $160,000 against OVERALL materiality of $500,000, together with prior-period uncorrected misstatements and qualitative factors
Explanation: Performance materiality is a PLANNING tool that governs the EXTENT of testing — it is NOT the threshold against which uncorrected misstatements are evaluated. Uncorrected misstatements are compared, in AGGREGATE (including prior-period uncorrected items and qualitative factors), against OVERALL materiality. Using performance materiality as the evaluation threshold (options A and C) is a conceptual error that appears constantly in practice.
Question 152
An auditor assesses control risk at the maximum for the existence of revenue but plans to rely on controls for the completeness of revenue. This is:
Select an option first.
Correct answer: A — Proper, because control risk is assessed at the ASSERTION level and may differ across assertions within the same account
Explanation: Control risk is assessed at the ASSERTION level, not the account level. A client may have strong controls preventing OMITTED sales (completeness) while having weak controls over FICTITIOUS sales (existence) — for instance, a system that reliably invoices every shipment, but permits manual entries with no approval. Assessing a single control risk for the whole account would blur precisely the distinction the standards require.
Question 153
A client's material weakness in ICFR was fully remediated in November, and the auditor tested the new control over November and December (two months) before the December 31 as-of date. The auditor concludes two months is NOT a sufficient period to support an effectiveness conclusion. The ICFR opinion should be:
Select an option first.
Correct answer: D — Adverse, because the auditor cannot conclude the new control operated effectively for a sufficient period as of the assessment date
Explanation: Remediation alone is not enough — the auditor must obtain sufficient evidence that the NEW control operated effectively for a PERIOD LONG ENOUGH to support the conclusion AS OF the assessment date. If two months is insufficient (a judgement depending on the control's frequency), the auditor cannot conclude ICFR was effective at year-end, and the opinion is ADVERSE. Note there is no 'qualified' ICFR opinion for a material weakness: control is effective or it is not.
Question 154
An auditor identifies that a client's CFO has the ability to post journal entries directly to the general ledger without independent review, AND also prepares the bank reconciliations. The MOST severe implication is:
Select an option first.
Correct answer: C — A segregation of duties failure combining recording and reconciliation, which defeats the very control that would detect the CFO's own entries — a strong material weakness indicator
Explanation: The reconciliation is the DETECTIVE control that would normally catch improper entries. When the SAME person who can POST the entries also PERFORMS the reconciliation, the detective control is neutralised — the person concealing the entry is the person checking for it. Combined with the CFO's seniority (management override capability), this is a powerful material weakness indicator, not a minor deficiency.
Question 155
Under the audit risk model, if inherent risk is assessed at 100% (the maximum) and the auditor sets audit risk at 5%, then even with control risk assessed at 100%, detection risk must be:
Select an option first.
Correct answer: D — 5%
Explanation: DR = 0.05/(1.00 x 1.00) = 0.05, or 5%. When both inherent and control risk are at the maximum, detection risk collapses to equal AUDIT RISK itself — the auditor's substantive procedures must do ALL the work, because nothing about the client reduces the risk. Detection risk is never zero (option B), because that would require testing every item with perfect accuracy, which is neither possible nor economic.
Get the full CPA question bank — free
Drop your email and we'll send you fresh CPA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 156
Which of the following, if identified, would be LEAST likely to be an indicator of a material weakness?
Select an option first.
Correct answer: A — Identification by MANAGEMENT'S OWN monitoring controls of a material misstatement, which was then corrected before the statements were issued
Explanation: If MANAGEMENT'S OWN controls DETECTED and CORRECTED the misstatement, the system WORKED — that argues AGAINST a material weakness. Options B, D and C are all explicit INDICATORS of material weakness under the standards: a restatement, a misstatement the auditor (not the client) found, and ineffective governance oversight. The distinction turns on WHO caught it: a client that catches its own errors has functioning controls.
Question 157
An auditor plans to rely on a control that operates DAILY. To test its operating effectiveness for the full year, the sample size required will generally be:
Select an option first.
Correct answer: D — Larger than for a control that operates monthly, because the population of control operations is far greater
Explanation: Control testing sample sizes are driven principally by FREQUENCY of operation: a daily manual control has hundreds of operations and needs a larger sample than a monthly one (which has twelve). Note the important exception in option D — for a fully AUTOMATED control, once the logic is verified and ITGCs are effective, a SINGLE instance may suffice, because a program executes identically every time. But the question specifies no such automation, so frequency governs.
Question 158
An auditor determines that fraud risk exists in revenue. The client's revenue controls tested as HIGHLY EFFECTIVE. The auditor may:
Select an option first.
Correct answer: D — Reduce, but not eliminate, substantive procedures — and must still perform substantive procedures specifically responsive to the fraud risk
Explanation: For a SIGNIFICANT RISK — and a fraud risk in revenue is presumed to be one — substantive procedures SPECIFICALLY RESPONSIVE to that risk are MANDATORY, regardless of how effectively the controls tested. Effective controls may reduce the EXTENT, but they can never eliminate the requirement. Management can override even the most effective control, which is precisely why the rule admits no exception.
Question 159
A client operates 200 retail stores with identical, centrally designed cash controls. The auditor tests the control at 15 stores and finds it effective at 14 and ineffective at 1. The auditor should:
Select an option first.
Correct answer: A — Investigate the cause of the exception — if it indicates the control is not applied consistently across locations, the homogeneity assumption underlying the sampling of locations may be invalid
Explanation: Sampling LOCATIONS depends on the assumption that the control is HOMOGENEOUS — designed centrally and applied consistently. A single failure may be an isolated lapse, or it may reveal that application VARIES by location, which would invalidate the entire extrapolation. The auditor must investigate the CAUSE. Simply computing a pass rate (option A) or dismissing it as isolated (option D) both skip the question that matters.
Question 160
Which of the following BEST describes the relationship between performance materiality and the risk of material misstatement?
Select an option first.
Correct answer: C — Performance materiality is set LOWER when the RMM is higher, in order to reduce the risk that undetected and uncorrected misstatements aggregate above overall materiality
Explanation: Performance materiality is set at the LOWER end of the range (closer to 50% than 75% of overall materiality) when the RMM is HIGHER, when the entity is new to the auditor, or when prior audits revealed numerous misstatements. A lower PM means more items are tested and smaller misstatements are pursued — an appropriate response to a greater risk of aggregation. Setting it higher (option C) would compound the risk.
Question 161
An entity's controls over a significant estimate consist solely of a review by the CFO, who is also the person who prepares the estimate. This control:
Select an option first.
Correct answer: C — Provides no assurance, because a review by the preparer is not an independent control — the reviewer cannot objectively challenge their own work
Explanation: A 'review' performed by the SAME PERSON who PREPARED the item is not a control at all — there is no independent challenge, and the self-review threat is total. Competence (option A) does not cure the absence of independence. For a review control to be effective, the reviewer must be independent of the preparer, must possess the competence to challenge the assumptions, and the review must operate at a level of PRECISION sufficient to detect a material misstatement.
Question 162
The auditor concludes that a client's IT general controls over change management are INEFFECTIVE, but the client's automated three-way match control tested effectively when examined in October. The auditor should:
Select an option first.
Correct answer: B — Recognise that ineffective change management means the program logic could have been altered at any point, so the October result cannot be extrapolated across the period; substantive procedures must be expanded
Explanation: This is the ITGC dependency in its purest form. If CHANGE MANAGEMENT is ineffective, the auditor has no assurance that the program tested in October is the same program that ran in March or December. A point-in-time test of an automated control extrapolates across the period ONLY if ITGCs guarantee the program did not change. Without that, the auditor must fall back on substantive procedures.
Question 163
Which combination would MOST strongly indicate a significant risk requiring substantive procedures and precluding sole reliance on controls?
Select an option first.
Correct answer: C — A non-recurring, complex transaction with a related party, involving a subjective valuation, executed close to year-end
Explanation: Significant risk indicators include COMPLEXITY, NON-ROUTINE transactions, RELATED PARTIES, SUBJECTIVE ESTIMATES and FRAUD potential — option B stacks four of them, plus period-end timing (a classic window for manipulation). Options D, B and A describe routine, systematic, objectively verifiable processes. The consequence of the significant risk conclusion is that substantive procedures become mandatory.
Question 164
An auditor sets overall materiality using 5% of pre-tax income. The client reports pre-tax income of $80,000 on revenue of $60 million. Applying 5% would give materiality of $4,000. The auditor should:
Select an option first.
Correct answer: A — Reconsider the benchmark, because a near-break-even income produces a materiality figure that is unreasonably low relative to the entity's size; a revenue or asset benchmark may be more appropriate
Explanation: Benchmark selection is a matter of JUDGEMENT, and an income benchmark becomes meaningless when income is near break-even — $4,000 on a $60 million business would demand an absurd amount of testing. The auditor should select a benchmark that is STABLE and relevant to users, such as revenue (0.5%-1%, giving $300,000-$600,000) or total assets. Note option C misapplies the RATE: 5% is the income rate; revenue benchmarks use 0.5%-1%.
Question 165
A client's audit committee consists of three independent directors, none of whom has any accounting or financial expertise. Under SEC rules this:
Select an option first.
Correct answer: C — Requires the company to disclose that it does not have an audit committee financial expert, and to explain why
Explanation: SEC rules require a company to DISCLOSE whether it has at least one 'audit committee financial expert' and, if NOT, to EXPLAIN WHY. It is a comply-or-explain requirement rather than an absolute prohibition. From the auditor's perspective, however, an audit committee lacking financial expertise weakens governance oversight and may elevate the assessed risk of material misstatement at the financial statement level.
Question 166
An auditor discovers that a client's internal auditor, whose work the external auditor intended to use, reports administratively to the CFO and has no direct access to the audit committee. The external auditor should:
Select an option first.
Correct answer: B — Conclude that the internal audit function's OBJECTIVITY is impaired by its reporting line, and reduce or eliminate reliance on its work accordingly
Explanation: OBJECTIVITY is one of the three criteria (with competence and a systematic, disciplined approach) for using internal audit's work. A function that reports to the CFO — and cannot reach the audit committee directly — cannot objectively audit the CFO's own domain. Competence alone (option A) does not cure impaired objectivity: a highly skilled but compromised auditor is not a reliable source of evidence.
Question 167
The auditor determines that a control operates at a level of precision that would detect a misstatement of $600,000, while performance materiality is $350,000. This control:
Select an option first.
Correct answer: D — Is NOT sufficiently precise, because it would fail to detect misstatements between $350,000 and $600,000
Explanation: PRECISION is the threshold at which a control would actually catch an error. A control that detects only misstatements above $600,000 would MISS anything between $350,000 (performance materiality) and $600,000 — precisely the range the auditor needs covered. A larger SAMPLE (option D) cannot fix a precision problem: testing an imprecise control more times only confirms, more confidently, that it is imprecise.
Question 168
Crandall Textiles has a material misstatement in its inventory valuation. The misstatement is material but confined to one account and does not affect the financial statements as a whole. The appropriate opinion is:
Select an option first.
Correct answer: D — Qualified
Explanation: A misstatement that is MATERIAL but NOT PERVASIVE results in a QUALIFIED opinion (an 'except for' opinion). If the misstatement were material AND PERVASIVE — affecting many accounts or being fundamental to a user's understanding — the opinion would be ADVERSE. A DISCLAIMER arises from a SCOPE LIMITATION that is material and pervasive, not from a misstatement. The 2x2 grid resolves every reporting question: misstatement or scope limitation, crossed with material-not-pervasive or material-and-pervasive.
Question 169
An auditor is unable to observe the physical inventory count and cannot satisfy themselves by alternative procedures. Inventory represents 45% of total assets. The appropriate opinion is:
Select an option first.
Correct answer: B — Disclaimer of opinion
Explanation: This is a SCOPE LIMITATION (the auditor could not obtain evidence), and at 45% of total assets it is both MATERIAL and PERVASIVE. A material and pervasive scope limitation results in a DISCLAIMER OF OPINION — the auditor cannot form an opinion at all. Note that ADVERSE (option B) would be wrong: adverse opinions arise from GAAP departures, never from an inability to obtain evidence. Remember the pairing: adverse = a GAAP problem; disclaimer = a SCOPE problem.
Question 170
Substantial doubt about an entity's ability to continue as a going concern exists, and management has adequately disclosed the circumstances. The auditor should issue:
Select an option first.
Correct answer: C — An unmodified opinion with a going concern emphasis-of-matter paragraph
Explanation: When substantial doubt exists but disclosure is ADEQUATE, the opinion remains UNMODIFIED and the auditor adds an emphasis-of-matter (going concern) paragraph AFTER the opinion paragraph. A going concern paragraph does NOT modify the opinion — this is the point candidates most often get wrong, assuming that doubt about survival must qualify the report. It does not. What DOES modify the opinion is INADEQUATE DISCLOSURE, which is a GAAP departure and produces a qualified or adverse opinion.
Question 171
Which matter would be reported as a Critical Audit Matter (CAM)?
Select an option first.
Correct answer: D — The valuation of a Level 3 goodwill impairment estimate, communicated to the audit committee and involving especially subjective auditor judgement
Explanation: A CAM must meet ALL THREE conditions: it was COMMUNICATED to the audit committee, it RELATES to material accounts or disclosures, AND it involved especially CHALLENGING, SUBJECTIVE or COMPLEX auditor judgement. A Level 3 goodwill impairment estimate is the archetype. CAMs apply to ISSUER audits only (PCAOB AS 3101) and they do NOT modify the opinion — they inform the reader about where the audit was hardest. Option C is reported separately as a control matter, not as a CAM.
Question 172
Under SSARS, a REVIEW engagement provides:
Select an option first.
Correct answer: C — Limited assurance, expressed negatively
Explanation: A REVIEW (AR-C 90) provides LIMITED (negative) assurance — the accountant states that they are not aware of any material modifications that should be made. It requires INDEPENDENCE and a written report, and it is based principally on inquiry and analytical procedures. A COMPILATION (AR-C 80) provides NO assurance but does produce a report, and a lack of independence is permitted if disclosed. A PREPARATION engagement (AR-C 70) provides no assurance, issues no report, and does not require independence. Only an AUDIT provides reasonable assurance and an opinion.
Question 173
Halvorsen County expends $920,000 in federal awards during the fiscal year. Under the Uniform Guidance, the county:
Select an option first.
Correct answer: A — Must undergo a Single Audit, because it expended $750,000 or more in federal funds
Explanation: The Single Audit threshold under the Uniform Guidance (2 CFR 200) is triggered when a non-federal entity EXPENDS $750,000 or more in federal awards in a fiscal year. At $920,000 of expenditures, Halvorsen County is over the threshold. Note the trigger is EXPENDED, not received or awarded — an entity holding a $5 million multi-year grant that spent only $200,000 this year would NOT trigger a Single Audit. Options D and C invent conditions that do not exist.
Question 174
An auditor's report on a non-issuer contains an emphasis-of-matter paragraph describing a change in accounting principle. This paragraph:
Select an option first.
Correct answer: A — Does not modify the opinion and refers to a matter appropriately presented in the financial statements
Explanation: An EMPHASIS-OF-MATTER paragraph draws attention to a matter that is APPROPRIATELY PRESENTED OR DISCLOSED in the financial statements and that is fundamental to users' understanding — a change in accounting principle, a going concern uncertainty, or a major catastrophe. It does NOT modify the opinion, and it is placed AFTER the opinion paragraph. Contrast this with an OTHER-MATTER paragraph, which refers to something NOT presented in the financial statements but relevant to users' understanding of the audit, the auditor's responsibilities, or the report.
Question 175
Management refuses to provide a written representation letter. The auditor should:
Select an option first.
Correct answer: A — Disclaim an opinion or withdraw from the engagement
Explanation: Management's refusal to provide the written representation letter is a SCOPE LIMITATION of the most serious kind, and it also calls into question the reliability of management's other representations and the integrity of management generally. The auditor should DISCLAIM an opinion or WITHDRAW from the engagement. An oral substitute (option D) is not acceptable — the standard requires a written letter, dated as of the date of the auditor's report. This is an area where the standards are unusually absolute.
Question 176
The auditor's report on a non-issuer's financial statements is dated:
Select an option first.
Correct answer: D — The date the auditor obtained sufficient appropriate audit evidence to support the opinion
Explanation: The report is dated no earlier than the date on which the auditor obtained SUFFICIENT APPROPRIATE AUDIT EVIDENCE to support the opinion — which includes evidence that the financial statements have been prepared and that management has taken responsibility for them (the representation letter). The report date drives the subsequent events evaluation period, which runs from the balance sheet date THROUGH the report date. Options A, B and C each name a date that has no bearing on when the auditor's evidence was complete.
Question 177
An auditor is engaged to audit the financial statements of Larkham Group, which includes a material subsidiary audited by another firm. The group auditor decides to make reference to the component auditor in the report. This means:
Select an option first.
Correct answer: D — Responsibility is divided, and the report indicates the magnitude of the portion audited by the other auditor
Explanation: When the group auditor DIVIDES responsibility, the report makes REFERENCE to the component auditor and states the MAGNITUDE of the portion of the financial statements audited by that other firm (for example, in terms of total assets and revenues). The opinion remains UNMODIFIED — division of responsibility is not a qualification (option C). The alternative approach is to ASSUME full responsibility (option A), in which case NO reference is made at all. The two approaches are mutually exclusive, and confusing them is a standard trap.
Question 178
Which of the following would result in an ADVERSE opinion rather than a qualified opinion?
Select an option first.
Correct answer: D — The client's financial statements omit the statement of cash flows entirely and misstate multiple accounts
Explanation: An ADVERSE opinion is required when a misstatement is MATERIAL AND PERVASIVE. Omitting an entire primary financial statement, combined with misstatements across multiple accounts, is pervasive — it is fundamental to a user's understanding. Option C is a SCOPE limitation that is material but NOT pervasive, giving a QUALIFIED opinion. Option B is a properly disclosed accounting change, which calls for an unmodified opinion with an emphasis-of-matter paragraph. Option A is immaterial and requires nothing. Remember: adverse = a GAAP problem; disclaimer = a SCOPE problem.
Question 179
Under PCAOB standards, the auditor's report on an issuer must state the year in which the auditor:
Select an option first.
Correct answer: B — Began serving consecutively as the company's auditor (auditor tenure)
Explanation: PCAOB AS 3101 requires the auditor's report to disclose AUDITOR TENURE — the year in which the auditor began serving CONSECUTIVELY as the company's auditor. The purpose is to give investors information relevant to assessing auditor independence and the familiarity threat arising from long association. This is an ISSUER-only requirement; non-issuer reports under AICPA standards contain no such statement. Options D, C and A are not required disclosures in the report.
Question 180
An entity presents supplementary information alongside the audited financial statements. The auditor has applied procedures to that information. The auditor should report on it in:
Select an option first.
Correct answer: B — An other-matter paragraph
Explanation: Supplementary information is addressed in an OTHER-MATTER paragraph. The distinction is precise: an EMPHASIS-OF-MATTER paragraph refers to something PRESENTED OR DISCLOSED IN the financial statements that is fundamental to users' understanding (a going concern uncertainty, a change in principle). An OTHER-MATTER paragraph refers to something NOT presented in the financial statements but relevant to users' understanding of the audit, the auditor's responsibilities, or the report — which is exactly what supplementary information is.
More free CPA topics
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.