CPA AUD (Auditing and Attestation) is one of the three Core sections of the CPA exam, and its pass rate is about 50%, my rounded estimate from AICPA's recent quarterly releases. You get 4 hours for 78 multiple-choice questions and 7 task-based simulations, and you need a scaled score of 75 to pass, which isn't the same as 75% correct. The questions cover auditing standards, procedures, evidence, internal controls and professional ethics.
AUD is the most conceptual of the Core sections. FAR tests accounting standards and REG tests tax rules, but AUD tests whether you understand the audit process from planning through reporting, and why an auditor does what they do.
Scroll horizontally to view all columns.
| AUD | FAR | REG | |
|---|---|---|---|
| Main skill | Judgment and reasoning | Applying and analyzing standards | Rule application |
| Calculation | Low | High | Medium |
| Pass rate | ~50% (AICPA) | ~43% (AICPA) | ~64% (AICPA) |
| Study hours (my planning estimate) | 110 hr | 160 hr | 120 hr |
| Hardest part | Conceptual depth | Volume of material | Detail memorization |
What AUD covers
The AICPA splits AUD into four content areas.
1. Ethics, Professional Responsibilities and General Principles (15 to 25%)
This area covers the AICPA Code of Professional Conduct, independence, quality management standards, professional skepticism and an auditor's ethical obligations. Independence and professional responsibilities also turn up inside questions from the other areas, so give the Code its own study time.
2. Assessing Risk and Developing a Planned Response (25 to 35%)
Here you're tested on understanding the entity and its environment, assessing the risk of material misstatement, designing procedures, the COSO internal control framework and entity-level controls, and the audit risk model (Audit Risk = Inherent Risk x Control Risk x Detection Risk). I'd learn that model before anything else. Once you understand how auditors identify, assess and respond to risk, the rest of the exam falls into place.
3. Performing Further Procedures and Obtaining Evidence (30 to 40%)
This is the largest area, and it's the "doing" part of the audit. It covers the types of evidence and how reliable each one is (external versus internal, documentary versus oral), substantive procedures versus tests of controls and when to use each, sampling and how sample size relates to risk, analytical procedures and documentation. Memorizing procedure names won't get you far here. The exam gives you a risk assessment and asks which procedure fits, so learn why an auditor would pick one over another.
4. Forming Conclusions and Reporting (10 to 20%)
The last area covers audit opinions, emphasis-of-matter paragraphs, going concern, group audits, reviews, compilations and other reporting engagements. The four standard opinions are unmodified (the statements are presented fairly in all material respects), qualified (a misstatement, or a gap in evidence, that's material but not pervasive), adverse (misstatements that are material and pervasive) and a disclaimer (the auditor couldn't obtain sufficient appropriate evidence, and the possible effects could be material and pervasive). Whether a problem is material, or material and pervasive, decides between a qualified opinion and an adverse opinion or disclaimer. Whether it's a known misstatement or missing evidence decides between adverse and disclaimer.
An 8-week plan and how to practice
I'd plan on about 110 hr over 8 weeks. That's a planning estimate, not a measured average, and audit experience can bring it down.
- Weeks 1 and 2: the audit risk model, planning and the COSO framework. Do 20 to 30 multiple-choice questions a day.
- Weeks 3 and 4: evidence, substantive procedures and tests of controls. Give this extra time, since it's 30 to 40% of the exam.
- Weeks 5 and 6: opinions, reporting, ethics and professional responsibilities. Drill questions that give you a set of facts and ask for the right opinion.
- Weeks 7 and 8: full-length timed practice exams, with extra attention on the simulations. My own target is 80% or better on practice exams before exam day. That's separate from the passing score of 75, which is scaled and isn't a percentage correct.
I'd work at least 500 practice multiple-choice questions, and focus on why the right answer is right. When you miss one, ask whether it was a conceptual gap (you didn't understand the audit risk model) or a detail slip (you mixed up the two types of sampling), because the fix is different for each. Practice simulations on their own too. They usually hand you a scenario and ask you to identify risks, pick procedures or evaluate evidence, which multiple-choice practice alone won't prepare you for.
On every question, name the risk first, then decide whether the procedure in front of you addresses it. AUD's procedures all follow the same logic (assess risk, design a response, gather evidence, form a conclusion), and if you hold on to that you can reason through questions you've never seen.
For free material, start with the AICPA's sample tests, which give you practice in the AUD format, and its Audit and Attest Standards, which are the source material for reporting. FreeFellow's AUD bank has 1,363 free practice questions at three difficulty levels, each with a step-by-step solution, and there are 60 written lessons to go with it, all free with an account. Timed mock exams, task-based simulations and analytics are part of Fellow.