CPA AUD Assessing risk and developing a planned response: practice questions with answers

Question 1

Pratt & Esquivel CPAs is planning the audit of Seabright Chandlery, a nonissuer boat-parts wholesaler, for the year ended December 31, 2026. The senior has drafted several planning documents. Which matter belongs in the overall audit strategy rather than in the detailed audit plan?

1. A The reporting deadlines, the timing of interim and year-end fieldwork, and the assignment of experienced staff to high-risk areas
2. B The nature, timing and extent of the risk assessment procedures planned for each significant business process and account
3. C The specific substantive procedures for the existence of receivables, including how the confirmation sample is chosen
4. D The sample size and selection method for testing the operating effectiveness of the purchase-approval control

Show the answer

Answer: A. AU-C 300 (PCAOB AS 2101 is similar for issuers) separates two planning outputs.

- Overall audit strategy: sets the scope, timing and direction of the audit and guides the development of the audit plan. It covers the characteristics that define the scope (framework, locations), reporting objectives and deadlines, the timing of the audit and required communications, the factors that direct the team's efforts, and the nature, timing and extent of resources (for example, experienced staff on high-risk areas).
- Audit plan: describes the nature, timing and extent of planned risk assessment procedures, of further audit procedures at the relevant assertion level, and of other procedures needed to comply with GAAS.

Reporting deadlines, fieldwork timing and staffing therefore sit in the strategy; risk assessment procedures, substantive procedures and sample sizes sit in the plan.

Question 2

Varnell Aerospace Components, an issuer that manufactures aircraft parts, lent its CFO $450,000 on March 1, 2026, to buy a home. The audit committee approved the loan in advance, it bears a market interest rate, and it is disclosed in the proxy statement. Varnell does not lend money in its ordinary business. Which statement is correct?

1. A The loan is prohibited by Section 402 of the Sarbanes-Oxley Act despite the approval, rate and disclosure
2. B The loan is permitted because the audit committee approved it and it is disclosed in the proxy statement
3. C The loan is permitted because it bears a market rate and is not more favorable than terms offered to others
4. D The loan is permitted because Section 402 covers loans to directors only, and the CFO is not a director

Show the answer

Answer: A. SOX Section 402 (Exchange Act Section 13(k)) makes it unlawful for an issuer to extend or arrange credit in the form of a personal loan to any director or executive officer. A narrow exception covers consumer credit such as home-improvement loans and credit cards made in the ordinary course of the issuer's consumer-credit business on terms no more favorable than those offered to the public. Varnell is a manufacturer, so the exception does not apply, and audit committee approval and proxy disclosure do not make the loan lawful.

For the auditor, this is possible noncompliance with laws and regulations (PCAOB AS 2405 for an issuer) and a related-party matter (AS 2410).

Question 3

A senior auditing Halcyon Garden Nursery, a nonissuer, traced one customer order from receipt through credit approval, shipping, invoicing and posting to the general ledger. She used the same documents and systems the employees use and asked each employee what they do when an error or exception arises. What does this procedure primarily give the auditor?

1. A Sufficient evidence that the controls operated effectively throughout 2026
2. B Evidence about whether the process controls are suitably designed and implemented
3. C Substantive evidence about the existence of all trade receivables at year-end
4. D Evidence that the revenue population is complete, removing the need for cutoff tests

Show the answer

Answer: B. A walkthrough follows a transaction from origination through the entity's processes and information system until it is reflected in the financial records, using the same documents and IT the personnel use, combining inquiry with observation, inspection and reperformance. Under AU-C 315 (SAS 145) the auditor evaluates the design of controls relevant to the audit and determines whether they have been implemented; inquiry alone is not enough, and walkthroughs are a common way to do this. PCAOB AS 2201 describes walkthroughs similarly for issuers.

Evidence of operating effectiveness over the period comes from tests of controls under AU-C 330, which require more than one instance.

Question 4

Tollhouse Self Storage LP, a nonissuer, earns all its revenue from about 2,400 month-to-month unit rentals. Rents are billed automatically at posted rates, there are no discounts, rebates or estimates, and no one's pay depends on revenue. For the 2026 audit the engagement team concludes that the presumed fraud risk in revenue recognition does not apply. Which statement is correct?

1. A The presumption can never be rebutted in an audit of a nonissuer, so revenue must be treated as a significant fraud risk.
2. B The presumption may be rebutted, but only with written approval from those charged with governance of the partnership.
3. C The presumption may be rebutted here, and the auditor documents why revenue recognition is not a fraud risk.
4. D Once rebutted, revenue needs no substantive procedures beyond an analytical review of total rental income.

Show the answer

Answer: C. Under AU-C 240 the auditor presumes, when identifying fraud risks, that there are risks of fraud in revenue recognition. The presumption is rebuttable: where revenue is a single, simple, automatically billed stream with no judgment or incentive, the auditor may conclude it does not apply. If so, the auditor documents the reasons for that conclusion.

Rebutting the presumption does not change other requirements: revenue is still material, so AU-C 330 requires substantive procedures for it. TCWG approval is not part of the rule.

Question 5

Each week the credit manager of Lathbury Paper Supply Co., a nonissuer, reviews a system report of sales orders released above customers' credit limits, investigates each order and initials the report. The auditor plans to rely on this control for the 2026 audit. Which is the most appropriate test of its operating effectiveness?

1. A Ask the credit manager how the review is carried out each week and record the explanation in a process narrative.
2. B Send positive confirmations at year-end to a sample of customers whose orders exceeded their credit limits.
3. C Inspect a sample of 2026 weekly reports for the manager's initials and reperform the follow-up on selected orders.
4. D Recalculate the allowance for doubtful accounts from the year-end aged receivables listing and loss rates.

Show the answer

Answer: C. A test of operating effectiveness asks whether the control operated consistently, throughout the period, and by whom (AU-C 330). For a manual review control that leaves documentary evidence, appropriate procedures are:

- inspection of a sample of reports across the period for evidence of review; and
- reperformance of the follow-up on selected items, to see whether the review was effective, not just signed.

AU-C 330 says inquiry alone is not sufficient to test operating effectiveness. Confirmations and recalculating the allowance are substantive procedures.

Question 6

The group auditor of Mountjoy Outdoor Holdings, Inc., a nonissuer with a December 31, 2026, year-end, is considering whether to make reference in the group audit report to the report of Pembrey & Coyle CPAs, which audited the Wyeth subsidiary. Under SAS 149, which fact would prevent the group auditor from making reference?

1. A Wyeth's 2026 financial statements were audited under PCAOB standards rather than GAAS.
2. B Pembrey & Coyle does not meet the independence requirements that apply to the group audit.
3. C Wyeth accounts for about 35% of consolidated revenue and of total consolidated assets.
4. D Pembrey & Coyle is based in another state and is not a member of the group auditor's network.

Show the answer

Answer: B. Under SAS 149 the group auditor may make reference to a referred-to auditor's report only if conditions are met, including:

- the group auditor has determined that the other auditor understands and complies with the ethical requirements, including independence, relevant to the group audit, and is competent;
- the other auditor has performed an audit of the component's financial statements under GAAS or, where relevant, PCAOB standards, and has issued an auditor's report that is not restricted as to use.

If the other auditor is not independent, the group auditor may neither make reference nor use its work, and must obtain the evidence some other way. Size, location and network do not prevent reference; the report indicates the magnitude of the portion audited by the referred-to auditor.