Print-ready PDF: 1080x1350 portrait, math pre-rendered, fonts embedded. Download once, study anywhere.
Download PDF →
All CPA AUD Formulas
Ethics, Professional Responsibilities and General Principles
8 items
Independence: financial interest threshold
Direct financial interest of ANY amount impairs independence.
Indirect financial interest: impairs independence only if material to the covered member.
Nonattest services permitted for a non-issuer audit client (with safeguards)
Bookkeeping, payroll, tax compliance and advisory, provided independence safeguards are in place.
Nonattest services prohibited for an issuer audit client (SOX section 201)
Bookkeeping, management functions, FIS design or implementation, internal audit outsourcing, broker-dealer, legal, expert witness.
AICPA Threats and Safeguards framework
Threats: Adverse Interest, Advocacy, Familiarity, Mgmt Participation, Self-Interest, Self-Review, Undue Influence. Safeguards: profession/legislation, client, firm.
Engagement letter required content
Required: objectives + scope, auditor + mgmt responsibilities, inherent limitations, reporting framework, form/content of report, laws referenced, fees/billing, period covered.
PCAOB inspection authority (issuer audits)
PCAOB inspects registered firms auditing issuers: annual if >100 issuer audits/yr, triennial if ≤100. SEC oversees PCAOB.
Quality control elements (SQCS 8 — HR-PMA-MSC mnemonic)
Human resources, engagement performance, monitoring, acceptance & continuance of clients, mgmt responsibilities (leadership/tone), ethics & independence.
AICPA Code — covered member independence categories
Covered members: engagement team, those who can influence the engagement, partners in lead partner's office, the firm, partners/managers providing ≥10 hrs nonattest services.
Assessing Risk and Developing a Planned Response
15 items
Detection risk (solved)
Higher IR or CR → lower acceptable DR → more or better substantive procedures required.
Materiality benchmarks (planning)
0.5–1% of revenues or assets
5–10% of pre-tax NI
1–2% of equity
Smaller entities: 2–5% of gross profit or 0.5% of assets.
Risk of material misstatement (RMM)
Assessed at financial statement level and assertion level.
Higher RMM → more responsive substantive procedures (nature, timing, extent).
Risk assessment procedures (RAP)
Required for ALL audits to identify risks (NOT to obtain audit evidence): 1) Inquiry of management + others; 2) Analytical procedures (preliminary); 3) Observation + Inspection. Mnemonic: IAO.
Audit Risk model (AR = IR × CR × DR)
; solve
DR = detection risk (only auditor-controlled lever).
Going concern evaluation (auditor's responsibility, ASC 205-40)
1) Evaluate substantial doubt (1 yr from F/S issue date) 2) Consider mgmt's mitigation plans 3) If doubt remains: disclosure + emphasis-of-matter paragraph.
Management's assertions about classes of transactions (OCCAC)
Occurrence, Completeness, Cutoff, Accuracy, Classification.
Management's assertions about account balances (ECRV)
Existence, Completeness, Rights and obligations, Valuation and allocation.
Management's assertions about presentation and disclosure (OCCA)
Occurrence and rights/obligations, Completeness, Classification and understandability, Accuracy and valuation.
Performance materiality vs clearly trivial threshold
; . OM = overall materiality; misstatements below CTT are not accumulated.
COSO Internal Control framework — 5 components (CRIME)
CRIME: 1) Control environment 2) Risk assessment 3) Information & communication 4) Monitoring 5) Existing control activities. COSO 2013 adds 17 underlying principles mapped across the 5 components.
Significant risks — characteristics + audit response
Indicators: complexity, fraud potential, related-party txns, subjective estimates, nonroutine txns. Response: substantive procedures REQUIRED, no reliance on controls alone.
Fraud risk — types + auditor's response
Types: misappropriation of assets, fraudulent financial reporting. Response: team discussion, inquire mgmt/audit committee, presume revenue recognition fraud risk, test mgmt override.
Materiality — overall vs performance vs tolerable
1) Overall = 0.5-1% revenue, 5-10% pretax NI, or 1-2% total assets 2) Performance = 50-75% × Overall 3) Tolerable Misstatement = subset of Performance, applied to specific account/balance
Specialist (auditor's expert vs management's expert)
Both: evaluate competence, capabilities, objectivity. Auditor's expert: + adequacy of assumptions/methods/data. Management's expert: + whether reliable as audit evidence.
Performing Further Procedures and Obtaining Evidence
22 items
Attribute sampling: sample size formula
Approximation:
R = reliability factor, TDR = tolerable deviation rate, EPER = expected population deviation rate. AICPA tables are exact.
Reliability factors (attribute sampling)
95% conf: 0 dev → R=3.0; 1 dev → R=4.75.
90% conf: 0 dev → R=2.31; 1 dev → R=3.89.
Higher conf → larger R → larger sample.
Upper deviation rate (attribute sampling)
If UDR > TDR, internal control cannot be relied upon; increase substantive testing.
Accounts receivable turnover and DSO
Analytical procedure; deviations signal potential misstatement.
Reperformance vs reliance on internal controls
Reperformance: auditor independently re-executes a control, high-quality evidence. Reliance on controls: test operating effectiveness; if effective, reduce substantive testing.
Sufficient appropriate audit evidence
Sufficiency (quantity) × Appropriateness (quality): both required. Appropriateness = Relevance + Reliability. More evidence cannot offset poor quality.
Variables (PPS / classical) sampling
PPS:
RF=reliability factor, TM=tolerable misstmt, EM=expected, EF=expansion. Tests overstatement only; classical tests both directions.
Reliability hierarchy of audit evidence
Most → least reliable: 1) Auditor direct 2) External independent 3) Internal corroborated externally 4) Internal w/ strong ICFR 5) Internal w/ weak ICFR 6) Inquiry alone.
Audit Data Analytics (ADA) — techniques
ADA = analyze patterns + flag anomalies in full populations. Uses: Benford's Law on JEs, revenue cut-off, AR aging, 3-way match, duplicate vendors.
Subsequent events procedures (Type I + II)
Read minutes, read interim F/S, inquire mgmt, obtain rep letter, review legal letter. Type I (existed at B/S): adjust F/S. Type II (arose after): disclose only.
Going concern audit response — assessment + report modification
1) Evaluate mgmt's mitigation plans 2) Assess disclosure adequacy. Adequate → unmodified + emphasis-of-matter (GC) paragraph. Inadequate → qualified or adverse.
CAATs (Computer-Assisted Audit Techniques)
CAAT types: generalized audit software, custom audit programs, integrated test facility (ITF), parallel simulation. Enables 100% population testing.
Test of controls vs substantive procedures
ToC: test operating effectiveness, only if relying on controls. Substantive: tests of details + analytical procedures at assertion level; ALWAYS required for significant risks.
Attribute sampling — control deviation rate components
TDR = max deviation rate auditor accepts to rely on control; EPDR = expected rate. Sample size = f(reliability factor, TDR − EPDR); ↑ as TDR ↓ or EPDR ↑.
Direction of audit testing — completeness vs occurrence
Completeness: trace source docs → records (catches understatement). Occurrence: vouch records → source docs (catches overstatement).
Positive confirmation (AU-C 505): when must the recipient reply?
In every case, agreeing or disagreeing. Higher-quality evidence; use for high-risk or large balances.
Negative confirmation (AU-C 505): when does the recipient reply?
Only if it disagrees with the stated information, so it gives lower-quality evidence.
Negative confirmations as the sole substantive procedure (AU-C 505), condition on risk: what level of assessed risk is required?
Low assessed risk of material misstatement.
Negative confirmations as the sole substantive procedure (AU-C 505), condition on the population: what makeup is required?
Many small balances.
Negative confirmations as the sole substantive procedure (AU-C 505), condition on exceptions: what exception rate must be expected?
A low expected exception rate.
Negative confirmations as the sole substantive procedure (AU-C 505), condition on recipients: what must be true of them?
No known circumstances suggest they are likely to disregard the requests.
Substantive analytical procedures (SAP)
Steps: 1) Develop expectation 2) Set tolerable difference 3) Compare to recorded amount 4) Investigate variances > threshold. Effective when relationships are stable/predictable.
Forming Conclusions and Reporting
9 items
Audit opinion thresholds
Unmodified: no material misstatement, full scope.
Qualified: material but not pervasive OR scope limit.
Adverse: material AND pervasive.
Disclaimer: scope limit too severe.
Going concern paragraph — issuer vs nonissuer
Issuer (PCAOB): explanatory paragraph after opinion. Nonissuer (AU-C 570): Emphasis-of-Matter paragraph after opinion.
CAM criterion 1 (PCAOB AS 3101, issuer audits only): to whom must a critical audit matter have been communicated?
The audit committee (communicated or required to be communicated).
CAM criterion 2 (PCAOB AS 3101): what must a critical audit matter relate to?
Accounts or disclosures that are material to the financial statements.
CAM criterion 3 (PCAOB AS 3101): what kind of auditor judgment must a critical audit matter involve?
Especially challenging, subjective, or complex auditor judgment.
CAM reporting (PCAOB AS 3101): what must the auditor's report say about each critical audit matter?
Identify it, explain why it is a CAM, describe how it was addressed, and name the FS accounts or disclosures affected.
Audit report opinion ladder (5 outcomes)
1) Unmodified 2) Unmodified + EoM/OM 3) Qualified: material, not pervasive 4) Adverse: material AND pervasive misstatement 5) Disclaimer: scope limit material AND pervasive
SSARS — preparation, compilation, review (no opinion)
Preparation: no assurance, no report, independence not required. Compilation: no assurance, report issued, lack of independence OK if disclosed. Review: limited assurance, independence required.
Single Audit (Uniform Guidance / 2 CFR 200)
Trigger: nonfederal entity expends $750K federal funds/yr. Components: (1) F/S audit; (2) major-program compliance + ICOC audit.
