Free AUD sample questions

Correct answer: A SOC 1, Type 2 report.

A SOC 1 report focuses on internal controls over financial reporting. A Type 1 report only opines on the suitability of the design of controls at a specific point in time. A Type 2 report opines on both the design and the operating effectiveness of the controls throughout a specified period. Therefore, only a SOC 1, Type 2 report provides assurance on operating effectiveness over time. SOC 2 reports relate to Trust Services Criteria (security, availability, etc.), which may be relevant but are not the primary report for controls over financial reporting.

Correct answers: Identifying journal entries made by individuals who do not typically post entries.; Isolating entries posted on weekends or late at night outside of normal business hours.

Entries made by unusual users or at unusual times are classic indicators of management override or attempts to circumvent normal control processes. Filtering for round-dollar amounts or amounts just below an approval threshold are also effective. Ensuring debits equal credits is a basic system function and not an indicator of override.

Correct answer: False

A material weakness in internal control relates to the control system, not necessarily the financial statements themselves. If the auditor can perform sufficient substantive procedures to confirm that the financial statements are not materially misstated despite the control weakness, an unmodified opinion on the financial statements can still be issued. The material weakness must be communicated in writing to management and those charged with governance.

Correct answer: Abandon substantive analytical procedures and shift to detailed tests of transactions, including insisting on inspecting the underlying contracts and sending confirmations to the new customers.

The significant, unexplained variance from substantive analytics, combined with identified fraud risk factors (pressure, CFO override) and management's resistance, is a strong indicator of potential misstatement. The auditor must abandon reliance on analytics for this assertion and gather more persuasive evidence. The most appropriate response is to perform detailed tests of transactions, which includes inspecting the actual contracts to verify terms and confirming the existence and terms of the arrangements directly with the customers. This shift from less to more rigorous testing is a critical application of professional skepticism.

Correct answer: The state of mind that permits the performance of an attest service without being affected by influences that compromise professional judgment.

Independence in fact relates to the auditor's actual state of mind—an internal, unbiased mental attitude that allows for objectivity and integrity. It is about acting with professional judgment that is not subordinated to other interests. In contrast, independence in appearance is how the auditor's independence is perceived by third parties.

Correct answer: Confirm the auditor's understanding of the process flow and the design and implementation of controls.

A walkthrough involves tracing a transaction from its initiation to its recording in the financial statements. Its primary purpose is to confirm the auditor's understanding of the process and to verify that the controls the auditor plans to rely on have been designed and implemented. It is not, by itself, sufficient to test the operating effectiveness of the controls, which requires a more extensive test of controls.

Correct answer: The risk of material misstatement is assessed as low and controls are effective.

Negative confirmations provide less persuasive evidence than positive confirmations because no reply is assumed to mean agreement. They are only appropriate when all of the following conditions are met: the risk of material misstatement is low, relevant controls are effective, the population consists of many small, similar balances, and the auditor does not expect recipients to ignore the requests. High risk would necessitate the use of more persuasive positive confirmations.

Correct answer: Obtaining a written representation from management stating the estimate is reasonable and relying solely on this representation.

Auditing standards require auditors to take one or a combination of three approaches to audit estimates: (1) test management's process, (2) develop an independent expectation, or (3) review subsequent events. A management representation is required but is not a substitute for performing these substantive audit procedures. Relying solely on the representation would be a failure to obtain sufficient appropriate audit evidence.

Correct answer: The auditor must issue a report on the entity's compliance and on internal control over financial reporting.

Government Auditing Standards (GAS), also known as the Yellow Book, require auditors to do more than just opine on the financial statements. They must also issue written reports on the entity's internal control over financial reporting and on its compliance with provisions of laws, regulations, contracts, or grant agreements that have a material effect on the financial statements. This is a key difference from a standard GAAS audit of a non-issuer.

Correct answer: Set DR to low and perform more persuasive substantive tests.

The audit risk model is AR = IR x CR x DR. To maintain an acceptably low level of overall audit risk (AR), if the risk of material misstatement (IR x CR) is high, the auditor must compensate by setting a low level of detection risk (DR). A low DR is achieved by performing more extensive and persuasive substantive tests (e.g., larger sample sizes, tests performed at year-end, more rigorous procedures like confirmations instead of analytics).