AUD I: ethics, independence, planning and risk

Auditing and Attestation tests the knowledge and judgment needed to plan and perform audits, reviews, compilations and other attestation engagements, and to meet the profession's ethical requirements. It is the section where experience helps most, but also where experienced auditors are sometimes caught out, because the exam tests the standards, not a particular firm's methodology. This lesson covers the first half of the blueprint: ethics, professional responsibilities and general principles, and assessing risk and developing a planned response. Lesson 6 covers performing procedures, obtaining evidence and forming conclusions and reports. The material was taught in ACCT-331 and ACCT-431; the examples use Tamarack Foods Group, the invented Denver food company listed on Nasdaq, and its auditor Hollis Ward LLP.

The AUD blueprint

Under the 2024 blueprint, AUD has four content areas: ethics, professional responsibilities and general principles; assessing risk and developing a planned response; performing further procedures and obtaining evidence; and forming conclusions and reporting. The weight ranges put the most emphasis on the middle two areas, with ethics and reporting each carrying a smaller but significant share. AUD covers three sets of standards, and the exam expects you to know which applies: the AICPA's Statements on Auditing Standards (the AU-C sections) for nonissuers, the PCAOB's auditing standards for issuers, and the AICPA's attestation standards (SSAEs) and Statements on Standards for Accounting and Review Services (SSARS) for other engagements. Government audits add Government Auditing Standards (the Yellow Book) and the Single Audit under the Uniform Guidance, which ACCT-412 covered.

AUD questions frequently test evaluation, the highest skill level: deciding whether evidence is sufficient, whether an opinion should be modified, whether a threat to independence is acceptable. Practice reasoning from the standards to a conclusion, not memorizing lists.

Ethics and independence

The AICPA Code of Professional Conduct is organized around principles and rules. Members in public practice must comply with rules on independence, integrity and objectivity, general standards, compliance with standards, accounting principles, acts discreditable, fees and other types of remuneration, advertising and solicitation, confidential client information and form of organization and name. The Code's conceptual framework asks members to identify threats (adverse interest, advocacy, familiarity, management participation, self-interest, self-review and undue influence), evaluate their significance and apply safeguards, or decline or end the engagement if threats cannot be reduced to an acceptable level. Specific interpretations govern common situations, such as financial interests, loans, family relationships and nonattest services.

For audits of issuers, stricter rules apply. The SEC's independence rules and the Sarbanes-Oxley Act prohibit certain nonaudit services for audit clients, including bookkeeping, financial information systems design and implementation, appraisal and valuation services, internal audit outsourcing, management functions, investment advice and legal services, and require audit committee preapproval of permitted services. Lead and concurring audit partners must rotate after five years. The PCAOB adopted a new quality control standard, QC 1000, which takes effect on December 15, 2026, replacing the older quality control standards for registered firms. For nonissuers, the AICPA's quality management standards, SQMS No. 1 and No. 2, have applied since December 15, 2025. Know which rules apply to which client.

Planning: acceptance, understanding and materiality

Before accepting an engagement, the auditor considers the integrity of management, the firm's competence and independence, and communicates with the predecessor auditor with the client's permission. An engagement letter establishes the terms, including management's responsibilities. Planning then requires understanding the entity and its environment, the applicable financial reporting framework and the system of internal control. For issuers, the PCAOB's standards add specific requirements, such as considering whether the auditor should perform an integrated audit of internal control over financial reporting under AS 2201.

Materiality is set for the financial statements as a whole, with performance materiality below it and a clearly trivial threshold for accumulating misstatements. The program below reproduces the Tamarack figures from ACCT-431 and ranks the areas by a simple inherent risk times control risk score. Pre-tax income of 28 million at 5 percent gives 1,400 thousand; performance materiality of 1,050 thousand is 75 percent of that; clearly trivial is 70 thousand.

# Assurance planning for Tamarack Foods Group (from ACCT-431), in thousands.
benchmarks = {"pre-tax income x 5%": 28000 * 0.05, "revenue x 0.5%": 412000 * 0.005}
overall = 1400                       # chosen: pre-tax income basis, rounded
performance = round(overall * 0.75)  # 75% for a recurring audit with few past errors
trivial = round(overall * 0.05)
for k, v in benchmarks.items(): print(f"{k:22}{v:>10,.0f}")
print(f"Overall {overall:,}, performance {performance:,}, clearly trivial {trivial:,}")
# Rank account-level risks: inherent risk x control risk on a 1-3 scale
areas = {"Revenue cut-off": (3, 2), "Inventory provision": (3, 3), "Goodwill": (2, 2),
         "Payroll": (1, 1), "Mexico component": (3, 2), "Cash": (1, 1)}
print()
for a, (ir, cr) in sorted(areas.items(), key=lambda kv: -kv[1][0] * kv[1][1]):
    level = ir * cr
    resp = "significant risk: tailored substantive work" if level >= 6 else "standard procedures" if level >= 3 else "minimal"
    print(f"{a:20}{level:>3}  {resp}")

pre-tax income x 5%        1,400
revenue x 0.5%             2,060
Overall 1,400, performance 1,050, clearly trivial 70

Inventory provision   9  significant risk: tailored substantive work
Revenue cut-off       6  significant risk: tailored substantive work
Mexico component      6  significant risk: tailored substantive work
Goodwill              4  standard procedures
Payroll               1  minimal
Cash                  1  minimal

The ranking flags the inventory provision, revenue cut-off and the Mexican component as significant risks. On the exam you will not be asked to multiply risk scores, but you will be asked to identify which risks require special audit consideration, how the assessed risk affects the nature, timing and extent of procedures, and which assertions are at risk. Higher assessed risk calls for more persuasive evidence: substantive procedures closer to year end, larger samples, more reliable sources such as external confirmations, and procedures designed specifically for the risk.

Risk assessment under SAS 145

SAS No. 145, effective for audits of periods ending on or after December 15, 2023, revised the AICPA's risk assessment standard. It requires the auditor to assess inherent risk and control risk separately, considering inherent risk factors (complexity, subjectivity, change, uncertainty and susceptibility to misstatement due to management bias or fraud), and to place risks on a spectrum of inherent risk, with significant risks at the upper end. It emphasizes the auditor's understanding of the entity's IT environment and general IT controls, and it requires the auditor to evaluate whether the risk assessment procedures provide an appropriate basis for identifying and assessing risks. The PCAOB's AS 2110 serves the same purpose for issuers. Under both, the auditor presumes a fraud risk in revenue recognition, which may be rebutted in rare cases, and always treats management override of controls as a fraud risk.

Fraud considerations appear frequently in AUD questions. The fraud triangle of incentive or pressure, opportunity and attitude or rationalization guides the identification of fraud risk factors, and the engagement team must discuss the susceptibility of the statements to fraud. Procedures responding to management override, testing journal entries, reviewing estimates for bias and evaluating the business rationale for significant unusual transactions, are required in every audit. ACCT-460 covered fraud in depth; AUD tests the auditor's responsibilities rather than the investigation.

Using the work of others

Many AUD questions concern when and how the auditor may use the work of others. The work of the entity's internal audit function may be used if the function's objectivity and competence are adequate and it applies a systematic and disciplined approach; the auditor must still make all significant judgments and test some of the internal auditors' work, and may not use it for areas involving significant judgments or high assessed risk to the extent that would undermine the auditor's own responsibility. Internal auditors may also provide direct assistance under the auditor's supervision, subject to restrictions. A specialist engaged by the auditor, such as a valuation expert for Tamarack's goodwill, must be competent, capable and objective, and the auditor must agree on the scope of the work and evaluate its adequacy, including the specialist's assumptions and methods. For issuers, PCAOB amendments that took effect for fiscal years ending on or after December 15, 2020 strengthened the requirements for evaluating the work of a company's specialists, and separate 2024 amendments on technology-assisted analysis apply for fiscal years beginning on or after December 15, 2025. A management's specialist, employed or engaged by the client, provides audit evidence that must be evaluated like other evidence, considering the specialist's competence and objectivity. Questions often ask which of these situations allows the auditor to refer to the specialist in the report; the answer is almost always none, except when the reference explains a modification of the opinion.

Communications in planning

Several required communications arise in planning. The auditor communicates with those charged with governance about the planned scope and timing of the audit and significant risks identified. For issuers, AS 1301 requires specific communications with the audit committee. The auditor must also consider the work of internal auditors and specialists, and plan the use of any other auditors, including the decision under SAS 149 or AS 1206 whether to make reference to another auditor's work in the report. Expect questions that ask which communication is required, to whom and when.