Auditing 101 | Part 3: Main Audit Phase

How an Audit Works from Start to Finish (Part 3 of 4)

Substantive Testing: Cash, AR, Inventory, Investments, Fixed Assets, Liabilities, Equity, Sampling, and the Legal Inquiry Letter

AUD 101 Series • Last updated: March 2026 • Reviewed by Kyle Lee Ashcraft, CPA

In Part 1, we covered client acceptance, the engagement letter, and planning. In Part 2, we covered the audit risk formula, materiality, assertions, and types of procedures. Now in Part 3, we actually test the accounts.

This is the fieldwork phase of the audit. We walk through the entire balance sheet, account by account, covering the specific procedures auditors perform for each area: cash, accounts receivable and revenue, inventory, investments, fixed assets, accounts payable, notes payable, and equity. We also cover audit sampling and the legal inquiry letter. Every procedure in this article traces back to the risk assessment and assertion framework from Part 2.

AUD 101: The Complete Audit Process

• Part 1: Client Acceptance, Engagement Letter, Documentation, and Planning
• Part 2: Audit Risk, Materiality, Assertions, and Types of Procedures
• Part 3: Substantive Testing -- Every Balance Sheet Account, Sampling, and the Legal Inquiry Letter (this article)
• Part 4: Audit Reports and Opinions (coming soon)

Who this guide is for:

• AUD students who need to understand what auditors actually do when testing each account
• Students preparing for TBS that ask which procedure tests which assertion for a specific account
• Audit interns and staff who want to see the full picture of how fieldwork connects to the balance sheet
• Retakers who lost points on procedural questions and need the account-by-account walkthrough

Jump to:

• Directional Risk
• Auditing Cash
• Auditing AR and Revenue
• Auditing Inventory
• Auditing Investments
• Auditing Fixed Assets
• Auditing Accounts Payable
• Auditing Notes Payable
• Auditing Equity
• Audit Sampling
• The Legal Inquiry Letter
• FAQ

Video: The Entire Audit Process Explained (Part 3 of 4)

Want to see what real audit documentation looks like?

My Free CPA 101 course includes a complete study roadmap for AUD, with strategies for connecting procedures to assertions on exam day.

Get My Free CPA 101 Course

Directional Risk: The One Rule That Governs Every Account Key Framework

Before testing any account, understand this: companies tend to overstate assets and equity and understate liabilities. This single idea tells you which assertion matters most for every account on the balance sheet.

Why? Because more assets and fewer liabilities make the company look stronger. This creates predictable incentives that drive the entire audit approach:

Account Type	Management Incentive	Primary Assertion	What the Auditor Looks For
Assets (cash, AR, inventory)	Overstate	Existence	Do these assets actually exist? Are they real?
Revenue	Overstate	Occurrence	Did these sales actually happen?
Liabilities (AP, debt)	Understate	Completeness	Are there liabilities missing from the books?
Expenses	Understate	Completeness	Were expenses left off to inflate net income?
Equity	Overstate	Existence / Accuracy	Is equity correctly calculated and legitimate?

Kyle's 90+ Score Insight: This table is the single most useful framework for AUD procedural questions. When a question asks which assertion a procedure addresses, ask yourself: "Is the auditor worried about things being fabricated (existence) or things being left out (completeness)?" That tells you whether you are on the asset side or the liability side of the balance sheet.

Auditing Cash AUD

Cash has high inherent risk. There is a high fraud risk because employees could steal it, and the company has an incentive to overstate the cash balance to look stronger.

Two Cash Fraud Schemes

Lapping

An employee steals a customer's payment, then covers it up by applying the next customer's payment to the first customer's account. The third customer's payment covers the second, and so on. The employee is "running laps," cycling payments to hide the theft.

Kiting

This is not theft but fraudulent financial reporting. When a company has multiple bank accounts, it transfers money from one to the other but fails to record the decrease in the first account. Cash is effectively double-counted, overstating the total balance.

Key Procedures for Cash

1

Cash Confirmations

The auditor sends a confirmation directly to the company's bank asking the bank to verify the cash balance. The bank responds directly to the auditor, preventing the client from interfering with the evidence. This tests the existence assertion.

2

Reperforming Bank Reconciliations

The auditor reperforms the client's bank reconciliation to verify that the book balance and bank balance reconcile properly. This includes checking outstanding checks, deposits in transit, and making sure the beginning balance agrees to the bank statement and the ending balance agrees to the general ledger.

Common Trap: Students sometimes forget that confirmations go directly from the third party (the bank) to the auditor. The client is not involved in the response. This is what makes confirmations strong evidence for the existence assertion.

Auditing Accounts Receivable and Revenue High-Yield

AR and revenue are tested together because they share the same journal entry: debit Accounts Receivable, credit Revenue. Testing one naturally provides evidence about the other.

1

AR Confirmations

The auditor sends confirmations directly to the company's customers asking them to verify that they actually owe the recorded amount. If the customer confirms the balance, it supports the existence assertion for AR.

2

Subsequent Collections Testing

For AR balances where confirmations were not received, the auditor looks at cash collections received after year-end. If the customer actually paid the balance after the reporting date, that provides evidence that the year-end AR balance was legitimate. This is an alternative procedure when confirmations are not returned.

3

Scanning the AR Aging Report

The AR aging shows which customers owe money and how long those balances have been outstanding. The auditor scans for old, overdue items that may need to be written off as uncollectible. This tests the valuation assertion.

Study Tip: AR confirmations test existence (does the customer actually owe this?). The AR aging tests valuation (is the balance recorded at the right amount, or should some of it be written off?). Know which procedure maps to which assertion.

Auditing Inventory AUD

Inventory carries risk in three areas: it might not actually exist, it might be miscounted, or it might be obsolete and need to be written down.

The Inventory Observation

The primary procedure for inventory is the inventory observation. The auditor goes to the company's warehouse and watches the employees perform their physical count of inventory. The auditor is not counting the inventory. The auditor is observing the company's count process to evaluate whether it can be trusted.

If the company's counting process is reliable, the auditor can trust the year-end inventory balance that results from that process. This is the highest quality evidence because the auditor is seeing it with their own eyes (direct observation).

Common Trap: Students sometimes say the auditor "counts the inventory." The auditor observes the company's count. The company performs the count; the auditor evaluates the process. This distinction matters on the exam.

Kyle's 90+ Score Insight: Inventory observation tests existence (is this inventory physically here?) and can also provide evidence about valuation (does the inventory look obsolete or damaged?). If the exam asks what assertion inventory observation primarily addresses, the answer is existence.

Auditing Investments AUD

Investments include stocks and bonds the company holds in other entities. The primary concern is valuation: are the investments recorded at the correct amount?

Recalculations

The auditor independently recalculates expected income from the investments. For a $1,000 bond with a 5% interest rate, the auditor expects $50 of annual interest income. For a $100 stock that receives a 10% stock dividend, the auditor expects $10 of dividend income. The recalculated amounts are compared to what the company recorded.

Confirmations

If a third-party custodian holds the company's investments, the auditor sends a confirmation to the custodian to verify that the company actually owns those securities. This tests the existence and rights assertions.

Segregation of Duties for Investments

Function	Who Performs It	What It Covers
Authorization	Board of directors or senior management	Approving the purchase and sale of investments
Recording	Accounting staff	Making the journal entries for investment transactions
Custody	Third-party custodian	Physically holding the securities

Study Tip: Segregation of duties means no single person should handle authorization, recording, and custody. When the same person can buy stocks and record the journal entries, the opportunity for fraud increases significantly.

Testing each account traces back to the same risk and assertion logic from Part 2.

My Free CPA 101 Course includes the study system I used to score 90+ on every section, including how to approach AUD's procedure-to-assertion matching questions. Start it here for free.

Auditing Fixed Assets (Property, Plant, and Equipment) AUD

Fixed assets make up a large portion of many companies' balance sheets. They involve multiple accounting transactions: the initial purchase, ongoing depreciation, and eventual disposal.

The Fixed Asset Roll Forward Schedule

The auditor creates a roll forward schedule that tracks the movement in fixed assets during the year:

Beginning Balance + Additions - Disposals = Ending Balance

The auditor compares the calculated ending balance to the company's general ledger balance. A separate roll forward is performed for accumulated depreciation to verify that the company is calculating depreciation correctly.

Key Areas of Concern

1

Recalculating gains and losses on disposal: Sales proceeds minus net book value should equal the gain or loss. The auditor recalculates and compares to the company's recorded amount.

2

Capitalize vs. expense: Did the company correctly determine which costs should be capitalized as fixed assets and which should be expensed as repairs and maintenance? This is the classification assertion.

3

Depreciation recalculation: The auditor independently recalculates depreciation expense to verify the company's method, useful life, and salvage value assumptions are applied correctly.

Auditing Accounts Payable High-Yield

Now we shift to the liability side of the balance sheet, where the primary concern flips. Companies tend to understate liabilities. The most critical assertion for AP is completeness: are there liabilities missing from the books?

1

Search for Unrecorded Liabilities

The auditor obtains the company's check register (cash disbursements) for the period between year-end and the date of the audit. For each disbursement above the materiality threshold, the auditor determines whether it relates to the prior year or the current year. If it relates to the prior year, there should be a corresponding AP balance at year-end. If there is not, the liability was unrecorded.

2

Scanning the AP Aging Report

Just like the AR aging shows who owes you money, the AP aging shows who you owe money to. The auditor scans for old, outstanding AP items and asks the company whether those amounts are still valid obligations or whether they should be written off.

Common Trap: The search for unrecorded liabilities is the signature procedure for testing the completeness of accounts payable. If an exam question describes an auditor looking at subsequent cash disbursements to find missing year-end liabilities, the assertion being tested is completeness.

Auditing Notes Payable (Long-Term Debt) AUD

Notes payable involves both balance sheet presentation and income statement accuracy. The auditor needs to verify proper classification between current and long-term portions, and that interest expense is recorded correctly.

The Debt Roll Forward

Beginning Notes Payable + New Borrowings - Principal Payments = Ending Notes Payable

Two Key Documents

Debt Agreement

The original loan contract. It specifies how much was borrowed, the interest rate, the repayment schedule, and the loan term. The auditor uses this to verify the terms of the debt.

Amortization Schedule

Shows how each payment is split between principal and interest expense over the life of the loan. The auditor uses this to recalculate the note payable roll forward and to verify that the company is recording interest expense correctly.

Study Tip: The key assertion for debt classification is making sure the current portion (principal due within one year) is properly separated from the long-term portion. This is the classification assertion. For liabilities overall, the primary concern remains completeness: did the company record all of its debt?

Auditing Equity AUD

Like assets, companies tend to overstate equity because higher equity makes the company look stronger. The auditor tests both the retained earnings and the stock components.

Retained Earnings Recalculation

Beginning RE + Net Income - Dividends = Ending RE

The auditor independently recalculates retained earnings and compares to the recorded balance.

Stock and Dividends

The auditor scans the board meeting minutes to identify stock issuances, stock buybacks (treasury stock), and dividend declarations. The minutes provide the authorization evidence for these equity transactions.

Complete Account-by-Account Procedure Map

Account	Primary Assertion	Key Procedures
Asset Accounts (concern: overstatement)
Cash	Existence	Bank confirmations, reperform bank reconciliations
Accounts Receivable	Existence, Valuation	AR confirmations, subsequent collections, scan AR aging
Inventory	Existence	Inventory observation
Investments	Valuation, Existence	Recalculations, confirmations to custodian
Fixed Assets	Existence, Classification	Roll forward schedule, recalculate depreciation and gains/losses, capitalize vs. expense review
Liability Accounts (concern: understatement)
Accounts Payable	Completeness	Search for unrecorded liabilities, scan AP aging
Notes Payable	Completeness, Classification	Debt roll forward, review debt agreement and amortization schedule
Equity Accounts (concern: overstatement)
Retained Earnings	Accuracy	Recalculation (beginning RE + NI - dividends)
Stock / APIC	Existence, Accuracy	Scan board meeting minutes for issuances, buybacks, dividends

Audit Sampling High-Yield

Auditors cannot test 100% of a company's transactions. Instead, they select a sample, test it, and project conclusions about the entire population based on the results.

If a company's accounts payable includes 100 invoices, the auditor might test 15 of them. The results from those 15 invoices are used to draw conclusions about all 100. That is sampling.

Two Approaches Based on What You Are Testing

Variable Sampling

Used for substantive tests of details. Focuses on dollar amounts. The auditor is trying to determine whether account balances are materially misstated.

Attribute Sampling

Used for tests of controls. Focuses on rates of occurrence. The auditor is trying to determine how often the company follows a specific control (a percentage, not a dollar amount).

Statistical vs. Nonstatistical Sampling

Statistical Sampling

Uses mathematical calculations to select the sample. Every item in the population has an equal chance of being selected. Allows the auditor to quantify sampling risk.

Nonstatistical Sampling

Uses auditor judgment to select the sample. Does not involve calculations for selection. Sampling risk cannot be mathematically quantified.

Attribute Sampling: Key Terms

Since attribute sampling is used for tests of controls, these terms relate to whether the auditor can rely on the controls:

Term	Definition
Sample Deviation Rate	The percentage of items in the sample that do not follow the control. If 5 out of 100 tested items deviate, the sample deviation rate is 5%.
Allowance for Sampling Risk	An additional percentage added to account for the fact that the sample may not perfectly represent the entire population.
Upper Deviation Rate	Sample Deviation Rate + Allowance for Sampling Risk. This is the auditor's best estimate of the maximum deviation rate in the entire population.
Tolerable Rate	The maximum deviation rate the auditor is willing to accept and still rely on the control.

The Decision

If Upper Deviation Rate ≤ Tolerable Rate → Rely on the control → Decrease control risk

If Upper Deviation Rate > Tolerable Rate → Cannot rely on the control → Control risk stays at maximum

Common Trap: Students sometimes confuse variable sampling and attribute sampling. Variable = dollar amounts = substantive testing. Attribute = rates = tests of controls. If the question asks about deviation rates, you are in attribute sampling territory.

The Legal Inquiry Letter AUD

The auditor needs to know whether the company is involved in any lawsuits that could affect the financial statements. To find out, the auditor sends a legal inquiry letter (sometimes called a lawyer's letter) to the company's attorney.

The letter asks the attorney to provide information about any pending or threatened litigation, including the likelihood that the company will lose and an estimate of the potential loss amount. The attorney responds directly to the auditor.

How the Response Affects the Financial Statements

Likelihood of Loss	Accrue a Liability?	Disclose in Footnotes?
Probable	Yes (record a liability for the estimated loss)	Yes
Reasonably Possible	No	Yes
Remote	No	No

Common Trap: "Reasonably possible" requires disclosure but not accrual. Students often confuse this with "probable," which requires both. Remember: only probable losses are accrued. Reasonably possible losses are disclosed only. Remote losses require neither.

Study Tip: The legal inquiry letter is a type of confirmation. It goes from the auditor to the company's attorney, and the attorney responds directly to the auditor. This is the same confirmation framework used for cash and AR, just applied to contingent liabilities.

FAQ

What is directional risk in auditing?

Directional risk describes the predictable incentives management has regarding financial statement accounts. Companies tend to overstate assets and equity (to look stronger) and understate liabilities (to look less leveraged). This means the primary assertion for assets is existence, while the primary assertion for liabilities is completeness.

What is the difference between lapping and kiting?

Lapping is employee theft where customer payments are misapplied to cover up stolen funds in a rotating cycle. Kiting is fraudulent financial reporting where cash is double-counted across multiple bank accounts by failing to record the decrease when transferring between accounts.

What assertion does an inventory observation test?

The inventory observation primarily tests the existence assertion: is the inventory physically present? It can also provide evidence about valuation if the auditor observes obsolete or damaged inventory during the count.

What is the search for unrecorded liabilities?

The auditor reviews cash disbursements made after year-end to determine whether any of those payments relate to obligations that existed at year-end. If a payment relates to the prior period but no AP balance was recorded, the liability was unrecorded. This procedure tests the completeness assertion for accounts payable.

What is the difference between variable sampling and attribute sampling?

Variable sampling is used for substantive tests of details and focuses on dollar amounts. Attribute sampling is used for tests of controls and focuses on rates of deviation (how often a control is followed). Variable = dollars. Attribute = rates.

When does a contingent liability need to be accrued vs. disclosed?

A probable loss must be both accrued (recorded as a liability) and disclosed in the footnotes. A reasonably possible loss must be disclosed but not accrued. A remote loss requires neither accrual nor disclosure.

Ready for the final phase?

In Part 4, we cover the post-audit phase: audit reports, the four types of opinions, going concern, subsequent events, and management representations. My Free CPA 101 Course gives you the complete study system for AUD and every other CPA exam section.

Start Free CPA 101 Today

Kyle Ashcraft is a CPA who scored a 90+ on all four CPA exams. Kyle founded Maxwell CPA Review, which is an exam-prep company that offers a comprehensive CPA exam review course and private tutoring.

Explore the Complete AUD 101 Series

Part 1: Acceptance & Planning

The foundation of the audit, from engagement letters to initial strategy.

Part 2: Risk & Assertions

Master the audit risk formula, materiality, and the framework that drives procedures.

Part 3: Substantive Testing

A complete walkthrough of the balance sheet, sampling, and the legal letter.

Part 4: Reports & Opinions

Concluding the audit, handling subsequent events, and issuing the final report.