The CPA AUD Exam Guide: How to Think Like an Auditor
Kyle Ashcraft, CPA · 2019 CPA Exam Scores · 95 FAR · 98 BEC · 91 REG · 90 AUD
AUD is the section where studying harder stops working. There is very little to calculate and almost nothing that rewards raw recall, and candidates who did well on FAR by grinding questions often find that the same approach produces a 71 here.
The reason is that AUD tests judgment. Many of its multiple choice questions are a single sentence long, which means every word in that sentence is load-bearing, and the four answer choices are usually all things an auditor might reasonably do. You are being asked which one this situation calls for.
I sat AUD after about five weeks and roughly 100 hours of study and scored a 90 in 2019. What follows is the structure I used, which is less a list of facts than a way of reading the questions.
In this guide
What is an audit, exactly?
An examination of a company's financial statements to determine whether they are fairly presented. The word doing the work is examination. The auditor does not take management's word for anything. Management says there is $100 million in cash; the auditor writes to the bank and asks.
Part 1: the foundational steps of an audit engagement.
That single idea, that the auditor gathers independent evidence rather than accepting assertions, generates most of the section. It is why third-party confirmations beat internally generated documents, why observing a count beats reading a count sheet, and why an auditor's own recalculation is stronger evidence than a schedule management prepared.
Audit, review, compilation
| Engagement | Assurance given | What the accountant does |
|---|---|---|
| Audit | Reasonable, the highest available | Tests controls where relevant, gathers substantive evidence, confirms with third parties |
| Review | Limited | Mainly analytical procedures and inquiry |
| Compilation | None | Assembles the statements without providing assurance |
Reasonable assurance is the ceiling, not absolute assurance. That is not a technicality the profession hides behind, it follows from the inherent limitations of any control system: people err, judgment is imperfect, colluding parties defeat segregation of duties, and management can override the controls it designed.
What are the four content areas?
| Area | Weight | What it covers |
|---|---|---|
| I. Ethics, professional responsibilities and general principles | 15–25% | Independence and engagement basics |
| II. Assessing risk and developing a planned response | 25–35% | Finding where misstatement is likely, before any testing happens |
| III. Performing further procedures and obtaining evidence | 30–40% | The bulk of the exam. Evidence and sampling |
| IV. Forming conclusions and reporting | 10–20% | Choosing the right report |
Part 3: evidence and procedures for specific accounts, which is Area III.
Where the weights mislead. Area IV looks small at 10 to 20%, and candidates study it last and lightly. But reporting questions are the most answerable on the exam, because the decision rules are mechanical once you know them. It is the cheapest area to lock down, and leaving it until the final week is the most common avoidable mistake on AUD.
What is the auditor's mindset?
Three questions, asked of every scenario. Most AUD questions are one of them wearing a disguise.
- What risk is this procedure addressing? Every procedure exists because something could go wrong. Name the thing that could go wrong and the right procedure usually becomes obvious.
- Which assertion is being tested? A procedure that tests existence tells you nothing about completeness. Answer choices frequently offer a perfectly good procedure aimed at the wrong assertion.
- Why is this control strong or weak? Not whether it exists. Whether it would actually catch the error or prevent the fraud described.
The habit that raises AUD scores fastest. Before looking at the answer choices, decide what you would do. Then find the choice closest to it. AUD distractors are written to be attractive when read cold, because all four are usually things auditors genuinely do, and reading them first tends to talk you out of an answer you already had right.
How do assertions work, and which direction do you test?
Part 2: the risk assessment and assertion roadmap.
Assertions are the claims management makes by putting a number in the statements. The auditor's job is to test those claims one at a time, which is why identifying the assertion is usually the whole question.
| Classes of transactions | Account balances |
|---|---|
| Occurrence, it really happened | Existence, it is really there |
| Completeness, nothing was left out | Completeness, nothing was left out |
| Accuracy, the amounts are right | Valuation and allocation, carried at the right amount |
| Cutoff, recorded in the right period | Rights and obligations, the entity owns it or owes it |
| Classification, in the right account | Classification and presentation |
The direction rule
Vouching: the records → source document. Tests existence or occurrence.
Start from a shipping document and look for the sale in the ledger, and you are asking whether anything was left out. Start from a recorded sale and look for the shipping document, and you are asking whether it really happened.
Why the direction is the entire point. You cannot detect an omitted transaction by starting in the ledger, because an omitted transaction is not in the ledger to be selected. That is why understated liabilities are chased through the search for unrecorded liabilities, working from subsequent payments and unmatched receiving reports back into the records, rather than by testing what is already recorded.
It also explains a pattern in the answer choices: overstatement worries point to vouching, understatement worries point to tracing. Revenue is usually an overstatement worry. Liabilities and expenses are usually understatement worries.
What does segregation of duties actually separate?
Four functions, and the exam expects you to spot when one person holds two of them.
| Function | What it means |
|---|---|
| Authorization | Approving the transaction |
| Recordkeeping | Entering it in the books |
| Custody | Holding the asset |
| Reconciliation | Independently checking that the records agree to the asset |
Custody plus recordkeeping is the dangerous pair. Someone who holds the asset and also writes the records can take the asset and adjust the books to hide it. That is the combination behind most textbook fraud scenarios, and if a question describes one employee doing both, you have found the deficiency without reading further.
The AP example works because the clerk prepares the cheque, which is recordkeeping, while a manager signs it, which is both authorization and custody of the outgoing funds. Neither can complete a payment alone.
How does the audit risk formula work?
Risk of Material Misstatement = Inherent Risk × Control Risk
Audit risk is the risk of giving a clean opinion on statements that are materially misstated. The auditor sets it at an acceptably low level and holds it there.
| Component | What it is | Who controls it |
|---|---|---|
| Inherent risk | Susceptibility to misstatement before any controls | The client's circumstances |
| Control risk | Risk the client's controls fail to catch it | The client's control system |
| Detection risk | Risk the auditor's procedures fail to catch it | The auditor |
Detection risk is the only one the auditor sets, and that is the whole mechanism. Inherent and control risk are assessed, not chosen. If the assessment comes back high, audit risk would rise unless something offsets it, so the auditor lowers detection risk to compensate.
Lowering detection risk means doing more: larger samples, more effective procedures, more work performed at year end rather than at an interim date, and more experienced staff assigned to it. Higher risk of material misstatement leads to more substantive work, every time.
What are the four audit opinions?
Part 4: the four opinions and the structure of the report.
Reporting questions look intimidating and are among the most mechanical on the exam, because the answer turns on two questions asked in order.
- What is the problem? Either the statements are misstated, or the auditor could not get enough evidence. Those are the only two categories.
- How bad is it? Material but confined to one area, or material and pervasive, meaning it affects the statements as a whole.
| Material but not pervasive | Material and pervasive | |
|---|---|---|
| Statements are misstated | Qualified opinion | Adverse opinion |
| Could not obtain evidence | Qualified opinion | Disclaimer of opinion |
With no problem at all, the opinion is unmodified, or unqualified under PCAOB wording.
Read that grid once more, because it answers most reporting questions on its own. Adverse and disclaimer both sit in the pervasive column, and candidates mix them up constantly. The distinction is not severity, it is which row you are in. Adverse means the auditor knows the statements are wrong. A disclaimer means the auditor does not know anything, because the evidence was never obtained.
So a scope limitation, however severe, never produces an adverse opinion, and a known misstatement never produces a disclaimer.
Two things that are not opinion modifications at all: an emphasis-of-matter paragraph and an other-matter paragraph. Both leave the opinion unmodified. A going concern uncertainty that is adequately disclosed is the classic example, and a question describing one is often checking whether you will wrongly reach for a qualification.
What do SOC reports tell you?
When a client outsources something that touches financial reporting, the auditor needs comfort over controls sitting inside another company. A SOC report from the service organization's auditor provides it.
| Type | Covers | Period | Assurance |
|---|---|---|---|
| Type I | Whether controls are suitably designed and implemented | As of a single date | Lower |
| Type II | Design, plus whether the controls operated effectively | Over a period | Higher |
Type I is a photograph, Type II is a film. If you intend to rely on those controls rather than simply understand them, you need Type II, because a control that was well designed on one day tells you nothing about whether anyone operated it in March.
SOC 1 addresses controls relevant to financial reporting, which is the one that matters on AUD. SOC 2 addresses the trust services criteria and comes up more on ISC.
The full Auditing 101 series
- Part 1: Starting the audit and engagement letters
- Part 2: Risk assessment and assertions
- Part 3: Further procedures and sampling
- Part 4: Conclusions and reports
Frequently asked questions
What makes AUD different from FAR and REG?
It tests judgment rather than computation. The questions are shorter, often a single sentence, and the wrong answers are usually procedures an auditor might genuinely perform, just not the one this situation calls for.
How do I know whether to trace or vouch?
Ask which direction the error would hide in. If you are worried something was left out, start from the source document and trace into the records, which tests completeness. If you are worried something recorded did not happen, start from the record and vouch back to the support, which tests existence.
What is the difference between an adverse opinion and a disclaimer?
An adverse opinion means the auditor obtained evidence and concluded the statements are materially and pervasively misstated. A disclaimer means the auditor could not obtain sufficient evidence and therefore expresses no opinion. Knowing something is wrong against not knowing at all.
What happens to detection risk when control risk is assessed as high?
It has to come down. Audit risk is held at an acceptably low level, so if the risk of material misstatement is higher, the auditor compensates with more substantive work: larger samples, more effective procedures and more testing at year end rather than at an interim date.
Which two duties are most dangerous to combine?
Custody of an asset and recordkeeping for it. Someone who holds the asset and writes the records can take it and adjust the books to conceal the loss.
Which SOC report gives more comfort, Type I or Type II?
Type II, because it tests whether the controls actually operated across a period rather than only whether they were suitably designed on a single date.
How long should I study for AUD?
I spent roughly five weeks and about 100 hours, though the right answer depends on your background and how much of the material is new to you. What matters more than the hours is whether you are practising judgment or practising recall. AUD rewards the first.
Start free with CPA 101
CPA 101 is free and includes all 25 of the 2026 AICPA released MCQs plus a study outline. No credit card required, and you will know within an evening whether the explanations work for you.
Kyle Ashcraft, CPA scored 90 or above on every section of the CPA exam in 2019, including a 90 on AUD and a 95 on FAR. He is the founder and sole instructor of Maxwell CPA Review, a complete CPA review course covering all six sections, where he creates every lecture, textbook and study outline himself.
Explore More Comprehensive CPA Guides
Master operating and finance leases, journal entries, and amortization schedules.
The ultimate cheat sheet for turnover, liquidity, and profitability ratios.
Break down variance analysis, job costing, and activity-based costing (ABC).
Understand NPV, IRR, payback period calculations, and investment decisions.
Simplify macro and microeconomic concepts, supply, demand, and market structures.
Navigate relational databases, IT governance, segregation of duties, and cybersecurity.