AUD II: procedures, internal control, reporting and attestation

The second half of the AUD blueprint covers what the auditor does after assessing risk: performing further procedures, obtaining sufficient appropriate evidence, evaluating the results, and forming conclusions and reports. It also covers engagements other than audits: reviews and compilations under SSARS, attestation engagements under the SSAEs, and the Single Audit. This lesson reviews these topics, continues the Tamarack Foods Group example and adds the small clients from ACCT-431, Kestrel Landscaping and Larch Street Bakery.

Evidence and procedures

Audit evidence must be sufficient (enough of it) and appropriate (relevant and reliable). Reliability increases when evidence comes from independent external sources, when it is obtained directly by the auditor, when it is documentary rather than oral, when it is an original rather than a copy, and when the related controls are effective. The exam often presents four procedures and asks which provides the most reliable evidence for a particular assertion; work from the assertion first, then pick the procedure that addresses it with the most reliable evidence. Confirmation addresses existence; vouching from records to documents addresses occurrence; tracing from documents to records addresses completeness; recalculation addresses accuracy; inspection of subsequent events addresses valuation.

Analytical procedures appear at three stages: in planning, to identify risks; as substantive procedures, when the expectation is precise enough to detect a material misstatement; and at the end, as an overall review. A substantive analytical procedure requires developing an independent expectation, defining a threshold for acceptable differences, comparing the recorded amount and investigating differences above the threshold. Questions test whether an analytical procedure is precise enough to be substantive and what the auditor must do with an unexplained difference.

Sampling

AUD tests audit sampling conceptually and with simple calculations. For tests of controls, attribute sampling estimates the deviation rate; sample size increases with the desired confidence, with a lower tolerable rate and with a higher expected rate. For substantive tests, variables sampling or monetary unit sampling estimates misstatement. The program below calculates attribute sample sizes at 95 percent confidence with a 5 percent tolerable deviation rate and evaluates the results.

# Attribute sampling for a test of controls, and evaluating the result.
import math
def sample_size(tolerable, expected_errors=0, confidence=0.95):
    # smallest n such that P(at most e deviations | rate = tolerable) <= 1 - confidence
    n = 1
    while True:
        p = sum(math.comb(n, k) * tolerable**k * (1 - tolerable)**(n - k) for k in range(expected_errors + 1))
        if p <= 1 - confidence: return n
        n += 1
def upper_limit(n, found, confidence=0.95):
    lo, hi = 0.0, 1.0
    for _ in range(60):
        mid = (lo + hi) / 2
        p = sum(math.comb(n, k) * mid**k * (1 - mid)**(n - k) for k in range(found + 1))
        lo, hi = (mid, hi) if p > 1 - confidence else (lo, mid)
    return hi
for e in (0, 1, 2):
    print(f"Tolerable 5%, expecting {e} deviations: n = {sample_size(0.05, e)}")
n = sample_size(0.05, 1)
for found in (0, 1, 2):
    ul = upper_limit(n, found)
    print(f"n={n}, found {found}: upper deviation limit {ul:.1%} -> {'rely' if ul <= 0.05 else 'do not rely'}")

Tolerable 5%, expecting 0 deviations: n = 59
Tolerable 5%, expecting 1 deviations: n = 93
Tolerable 5%, expecting 2 deviations: n = 124
n=93, found 0: upper deviation limit 3.2% -> rely
n=93, found 1: upper deviation limit 5.0% -> rely
n=93, found 2: upper deviation limit 6.6% -> do not rely

With a sample of 93, finding one deviation gives an upper deviation limit of 5.0 percent, exactly the tolerable rate, so the planned reliance is just supported; finding two gives 6.6 percent, so the auditor must reduce reliance on the control and increase substantive work. The exam asks about this relationship in several forms: which change would increase sample size, what the auditor should do when the upper limit exceeds the tolerable rate, and the risks involved. The risk of assessing control risk too low, also called the risk of overreliance, affects audit effectiveness; the risk of assessing it too high affects efficiency.

Internal control and the integrated audit

For nonissuers, the auditor obtains an understanding of internal control to assess risk, may test controls to support reliance, and must communicate significant deficiencies and material weaknesses in writing to management and those charged with governance under AU-C 265. For larger issuers, accelerated and large accelerated filers, the auditor performs an integrated audit under PCAOB AS 2201, expressing an opinion on the effectiveness of internal control over financial reporting as well as on the financial statements. AS 2201 uses a top-down approach: start at the financial statement level and entity-level controls, identify significant accounts and relevant assertions, and test the controls that address the risks. A material weakness, a deficiency or combination of deficiencies creating a reasonable possibility that a material misstatement will not be prevented or detected on a timely basis, results in an adverse opinion on internal control.

Tamarack is an accelerated filer, so Hollis Ward performed an integrated audit. ACCT-431 concluded that a deficiency in the review control over the goodwill impairment model was a material weakness, giving an adverse opinion on internal control and an unmodified opinion on the financial statements, because substantive testing supported the impairment amount. That combination surprises many candidates, and the exam tests it: an adverse ICFR opinion does not by itself require a modified opinion on the statements.

Forming conclusions and reporting

The auditor accumulates misstatements above the clearly trivial threshold, asks management to correct them and evaluates the uncorrected ones individually and in total. Modified opinions follow a simple matrix: a material misstatement that is not pervasive gives a qualified opinion and a pervasive one an adverse opinion; an inability to obtain sufficient appropriate evidence that is material but not pervasive gives a qualified opinion and a pervasive one a disclaimer. The report also includes, when appropriate, a going concern section, an emphasis-of-matter paragraph drawing attention to a matter already disclosed, or an other-matter paragraph about something not in the statements.

For issuers, AS 3101 requires the auditor to communicate critical audit matters, matters communicated to the audit committee that relate to material accounts or disclosures and involved especially challenging, subjective or complex judgment. For nonissuers, the auditor may be engaged to communicate key audit matters under AU-C 701. Know the order and content of the report sections, the auditor's responsibilities statement and the management responsibilities statement, which differ in small ways between AU-C 700 and AS 3101.

Documentation and completion

Several completion procedures appear regularly on AUD. Audit documentation must be sufficient for an experienced auditor with no previous connection to the engagement to understand the work performed, the evidence obtained and the conclusions reached; for nonissuers the documentation must be assembled within 60 days after the report release date and retained for at least five years, and for issuers within 45 days and for seven years. Before the report is released, the auditor obtains written representations from management, dated as of the report date, reads other information included with the statements for material inconsistencies, performs subsequent events procedures up to the report date and, for issuers and some other engagements, obtains an engagement quality review. Questions often test dates: the report is dated no earlier than the date on which sufficient appropriate evidence was obtained, which includes management's acceptance of responsibility for the statements, and the representations carry the same date.

Reviews, compilations and preparation engagements

Under SSARS, a review engagement (AR-C 90) provides limited assurance through inquiry and analytical procedures and requires independence. A compilation (AR-C 80) provides no assurance; the accountant may compile statements without being independent but must disclose the lack of independence in the report. A preparation engagement (AR-C 70) provides no assurance and no report, but each page must state that no assurance is provided. Kestrel Landscaping's lender accepted a review; Larch Street Bakery's owner wanted only prepared statements for her tax return. Questions ask which engagement fits a client's need, which procedures are required and what the report says. The most common trap is applying audit procedures, such as confirmations or internal control testing, to a review; they are not required.

Attestation engagements and SOC reports

Attestation engagements under the SSAEs report on subject matter other than historical financial statements, or on assertions about it. An examination provides reasonable assurance and results in an opinion; a review provides limited assurance and a conclusion; an agreed-upon procedures engagement under AT-C 215 provides findings without assurance, and the engaging party must agree that the procedures are appropriate. System and Organization Controls reports are attestation engagements on a service organization's controls: SOC 1 reports address controls relevant to user entities' financial reporting and are used by user auditors; SOC 2 reports address security, availability, processing integrity, confidentiality or privacy. A Type 2 report includes tests of operating effectiveness over a period; a Type 1 report addresses design at a point in time. ISC tests SOC engagements in more depth; AUD tests the user auditor's perspective.

Government audits

Audits under Government Auditing Standards, the Yellow Book, add requirements on independence, continuing professional education and reporting on internal control and compliance. The 2024 revision of the Yellow Book took effect for periods beginning on or after December 15, 2025. A Single Audit under the Uniform Guidance is required for nonfederal entities that spend 1,000,000 dollars or more of federal awards in a fiscal year, for fiscal years beginning on or after October 1, 2024; the auditor identifies major programs using risk-based criteria and a Type A threshold, and reports on compliance with requirements for each major program. ACCT-412 worked through the City of Aspen Ridge's Single Audit; on the exam, know the threshold, the major program determination and the reports required.