CPA AUD Performing further procedures and obtaining evidence: practice questions with answers

Question 1

Oxbury Building Supply, Inc., a nonissuer, gives its auditor two tables from its billing database. The CUSTOMER table has one row per customer, identified by Customer_ID. The INVOICE table has one row per invoice, identified by Invoice_No, and also holds a Customer_ID field showing which customer was billed. How is the Customer_ID field in the INVOICE table best described?

1. A A record, because it holds all of the data about one customer within the INVOICE table
2. B A unique field, so each Customer_ID value can appear only once in the INVOICE table
3. C A foreign key, which refers to the primary key of the CUSTOMER table and links each invoice to one customer
4. D The primary key of the INVOICE table, since it is the field that identifies which customer was billed on each invoice

Show the answer

Answer: C. In a relational database each table holds rows (records) made up of fields. The primary key uniquely identifies each record in its own table (Customer_ID in CUSTOMER; Invoice_No in INVOICE). A foreign key is a field in one table that holds the primary key of another table, creating the relationship between them. Customer_ID in INVOICE is therefore a foreign key: many invoices can point to one customer (a one-to-many relationship).

Auditors rely on these keys when they join tables in data analytics (blueprint Area III, group A1).

Question 2

Management of Lindell Dental Lab, Inc., a nonissuer, has stated in writing that there are no side agreements with customers. One customer's reply to a receivables confirmation agrees the balance but adds a handwritten note: "Unsold units may be returned under our December arrangement with your sales VP." What should the auditor do?

1. A Rely on the written representation, because it is signed by senior management and covers every customer arrangement
2. B Withdraw from the engagement at once, because the note proves management committed fraud
3. C Disregard the note, because a receivables confirmation provides evidence about the balance only
4. D Decide what added procedures are needed to resolve the conflict and reconsider management's other representations

Show the answer

Answer: D. If audit evidence from one source is inconsistent with evidence from another, or the auditor doubts the reliability of information, the auditor determines what modifications or additions to procedures are needed to resolve the matter and considers its effect on other aspects of the audit (AU-C 500.11; AS 1105.29). AU-C 580 adds that if written representations are inconsistent with other evidence, the auditor performs procedures to resolve the matter and may need to reconsider the reliability of representations in general.

An undisclosed right of return affects revenue recognition and may signal a fraud risk (AU-C 240), so the auditor would, for example, inquire of the sales VP and others, confirm terms with more customers and review credit memos after year-end.

Question 3

While walking through vendor master file changes at Stroud Medical Distributors, a nonissuer, the auditor asks the accounts payable clerk how bank details are updated. The clerk says: "If a vendor e-mails new bank details, I update the record. My supervisor usually reviews the change report when she has time." Which follow-up question would best help the auditor evaluate this control?

1. A Have you ever had any problems with vendors or with their bank details in the time you have worked here?
2. B How do you confirm a bank change really came from the vendor, and what shows when the change report was reviewed?
3. C Would you agree that your supervisor's review of the vendor change report is an effective control over payment fraud?
4. D You do verify each bank change by calling the vendor at a number already on file, don't you?

Show the answer

Answer: B. Analyzing interview responses and asking follow-up questions is a blueprint task (Area III, group D1). The clerk's answer raises two red flags: changes are made on the strength of an e-mail (a common route for vendor impersonation fraud) and the detective review happens only "when she has time".

Good follow-up questions are open, specific and aimed at evidence the auditor can then inspect or reperform (for example, call-back logs and dated sign-offs on change reports). Leading questions, vague questions and requests for opinions produce weak evidence. Inquiry alone is never sufficient to conclude that a control operates effectively (AU-C 330; AS 2301).

Question 4

The auditor of Velmont Robotics Corp., an issuer, plans to confirm Velmont's cash balances at four banks for December 31, 2026, through a third-party electronic confirmation platform. Under PCAOB AS 2310, what must the auditor do about using the platform?

1. A Telephone each of the four banks to confirm verbally every balance that is received through the platform
2. B Ask Velmont's treasury staff to send the requests through the platform from Velmont's own user account to save time
3. C Understand the platform's controls against interception and alteration, and determine whether they are designed and operating effectively
4. D Nothing further, because responses that are received electronically through a confirmation platform are inherently reliable evidence

Show the answer

Answer: C. Under AS 2310 (adopted by the PCAOB in PCAOB Release No. 2023-008, September 28, 2023, and effective for audits of fiscal years ending on or after June 15, 2025), the auditor must keep control of the confirmation process. When an intermediary is used to send and receive confirmations electronically (AS 2310.17 and Appendix B), the auditor:

- obtains an understanding of the intermediary's controls that address the risk of interception and alteration, and determines whether they are designed and operating effectively, for example by using a SOC report on those controls or by testing them (AS 2310.17 and .B1);
- assesses whether the company could override those controls through financial, ownership or other relationships;
- if the controls are not designed or operating effectively (and other procedures cannot address the risk), or the company could override them, does not use the intermediary (AS 2310.B2) and instead sends requests directly or uses other procedures.

Question 5

Driscoll Marine Coatings, a nonissuer, is preparing letters of inquiry to its outside counsel for the 2026 audit. Management believes a former distributor may sue over the termination of its contract, although no claim has been made. Management considers an assertion probable and an unfavorable outcome reasonably possible. How should this unasserted claim be handled in the letter of inquiry?

1. A Counsel is asked to list for the auditor every unasserted claim it knows of, including any that management has not described
2. B Management describes it, and counsel is asked to comment where its views differ and confirm it will advise management on disclosure
3. C It is left out of the letter entirely, because counsel may comment only on claims and assessments that have actually been asserted
4. D Counsel is asked to give its own estimate of the probability of assertion and of the loss for every unasserted claim

Show the answer

Answer: B. Under AU-C 501 (letter of inquiry), management lists unasserted claims and assessments that it considers probable of assertion and, if asserted, have at least a reasonably possible unfavorable outcome. Counsel is asked to:
- comment where its views differ from management's evaluation; and
- confirm its understanding that it will advise management when an unasserted possible claim needs disclosure under the framework (ASC 450).

To protect privilege, the lawyer is not asked to identify unasserted claims for the auditor.

Question 6

For the 2026 audit of Locust Hill Brewing Co., a nonissuer, fieldwork ended on February 19, 2027. The auditor obtained sufficient appropriate evidence on March 3, 2027, and dated the report that day. The report was released to the client on March 10, 2027. As of what date should management's written representations be dated?

1. A December 31, 2026
2. B February 19, 2027
3. C March 3, 2027
4. D March 10, 2027

Show the answer

Answer: C. AU-C 580 requires the written representations to be dated as of the date of the auditor's report (and not after it), and to cover all financial statements and periods referred to in the report. Under AU-C 700, the report is dated no earlier than the date on which the auditor obtained sufficient appropriate evidence, here March 3, 2027. The report release date (March 10) is later and is used for documentation assembly (AU-C 230), not for dating representations.