CPA AUD Master Guide 2026

What AUD covers

AUD is the Auditing and Attestation Core section of the Uniform CPA Examination. It tests whether you can reason through an assurance engagement: understand professional responsibilities, assess where material misstatement could occur, gather evidence that addresses those risks, and reach and report a conclusion. Knowing the name of a procedure is not enough if you cannot explain which assertion it tests or whether the evidence is reliable.

AUD is one of three Core sections. Candidates also pass Financial Accounting and Reporting (FAR), Taxation and Regulation (REG), and one Discipline section: Business Analysis and Reporting (BAR), Information Systems and Controls (ISC), or Tax Compliance and Planning (TCP). Passing AUD alone does not grant a CPA license. Each jurisdiction sets its education, experience, ethics, application, and exam-credit requirements.

The section is broad, but its work has a recognizable logic. An auditor plans an engagement, considers risks, obtains sufficient appropriate evidence, evaluates misstatements and other findings, then reports under the applicable professional standards. As you study a topic, ask where it fits in that chain and what evidence or decision it changes.

AUD exam format and scoring

The 2026 AICPA blueprint lists 78 multiple-choice questions and 7 task-based simulations (TBSs) in a four-hour section. The exam uses five testlets: two MCQ testlets of 39 questions each, then TBS testlets containing 2, 3, and 2 simulations. MCQs and TBSs each contribute 50 percent of the section score. A simulation can contain several exhibits and response parts, so seven simulations does not mean seven simple questions.

The reported score is scaled from 0 to 99, and 75 is the passing score. It is not a percentage correct. AICPA says the section score combines scaled MCQ and TBS results and is not curved. When you do not pass, the Candidate Performance Report can show relative performance by content area. Treat that report as a direction for review, not as a replacement for diagnosing why individual answers went wrong.

The MCQ testlets come first and the simulations follow. Do not infer that the second MCQ set will be harder or easier based on how the first felt. The live exam design and scoring are not something you can reliably read from a handful of items. Keep working carefully, follow the on-screen instructions, and do not leave a simulation response blank just because its format looks unfamiliar.

The four AUD content areas

The 2026 blueprint assigns ranges to four content areas. The ranges describe an approximate share of the section. Because each is a band, they do not add up to one exact allocation.

Area III has the largest published range, but the blueprint does not tell you which individual topic will appear on your appointment. The number of representative tasks listed under a topic is not a forecast of how many questions it gets. Use the percentages to protect study time across the areas, then use the detailed task statements to understand what you may need to do.

The blueprint also assigns skill ranges: Remembering and Understanding, Application, Analysis, and Evaluation. AUD tests all four. A question may ask you to recall a distinction, apply it to a fact pattern, analyze conflicting evidence, or evaluate which conclusion is best supported. A useful study session alternates rule retrieval with cases that require you to explain a decision.

How to reason through an audit scenario

Start with the engagement and the decision. Is the work an audit, a review, an examination, an agreed-upon procedures engagement, a compilation, or a preparation engagement? The service determines the objective and report. Next, identify the financial statement assertion or other objective at issue. Then ask what could go wrong, which evidence would address it, and what the results mean.

For a financial statement audit, management prepares the statements and is responsible for them. The auditor obtains reasonable assurance that the statements are free of material misstatement, whether caused by fraud or error, and expresses an opinion. Reasonable assurance is high, not absolute. An audit is not a guarantee that every fraud or error will be found.

Assertions translate balances, transactions, and disclosures into things that can be tested. For transactions, common assertions include occurrence, completeness, accuracy, cutoff, and classification. For account balances, think existence, rights and obligations, completeness, accuracy, valuation and allocation, and classification. For presentation and disclosure, consider occurrence and rights, completeness, classification and understandability, and accuracy and valuation. Learn the names, then practise matching a direction of error to evidence.

Direction is a strong clue. To test recorded sales for occurrence, select entries and trace them to shipping evidence and customer orders. To test completeness of liabilities, start with later cash payments or unmatched receiving reports and trace backward to whether an obligation existed at year end. The first procedure begins with what is recorded and asks whether it is real; the second starts outside the recorded balance and asks whether something was omitted.

Ethics, independence, and accepting the work

Area I is not a list of definitions detached from practice. You may need to recognize threats to compliance with professional rules, determine whether a safeguard can reduce a threat to an acceptable level, or conclude that the engagement cannot be accepted or continued. Identify the applicable ethical framework and the relationship that creates the threat before choosing a response.

Independence has both a conceptual and a rule-based side. Ask whether a financial, employment, business, family, or service relationship could affect the auditor’s objectivity or create an appearance problem under the applicable rules. A safeguard is not a universal cure. Some circumstances prohibit a relationship or service, so first determine whether a specific prohibition applies.

Acceptance and continuance require the firm to consider whether it can perform the engagement competently, comply with ethical requirements, and work with management that acknowledges its responsibilities. A client’s desire for a clean opinion is not a reason to accept a risky engagement. If management restricts access to records or insists on an unacceptable scope limitation, the auditor evaluates the implications before continuing.

Professional skepticism means a questioning mind and a critical assessment of evidence. It is not automatic distrust of every client statement. A signed representation letter is relevant evidence, but it does not replace other evidence the auditor should obtain. When documents conflict with explanations, follow up on the inconsistency and consider what it means for risk and planned procedures.

Planning, materiality, and risk

Risk assessment starts with understanding the entity, its environment, its financial reporting framework, and relevant internal control. The auditor identifies and assesses risks of material misstatement at the financial statement and assertion levels, including risks related to fraud. The assessment informs the nature, timing, and extent of further procedures.

Materiality is about whether an omission or misstatement could reasonably influence users’ decisions. It is a matter of professional judgment. Performance materiality is set below overall materiality to reduce the chance that uncorrected and undetected misstatements together exceed the overall amount. A lower threshold may apply to particular accounts or disclosures when smaller errors could affect users.

Inherent risk reflects susceptibility to misstatement before considering related controls. Control risk concerns the possibility that the entity’s controls will fail to prevent, detect, or correct a misstatement. Detection risk concerns the chance that the auditor’s procedures will not detect a misstatement that exists. The auditor responds to assessed risk through procedure design, timing, and extent; this is not a mechanical multiplication exercise.

Understanding internal control helps the auditor identify how transactions are initiated, authorized, recorded, and reviewed. A walkthrough follows a transaction through the process and can help establish that a control is designed and implemented. It does not, by itself, prove that the control operated effectively throughout the period. If the auditor plans to rely on a control, operating effectiveness must be tested for the relevant period and circumstances.

Fraud risk requires attention to incentives or pressures, opportunities, and attitudes or rationalizations, but a scenario may give stronger evidence for one dimension than another. Revenue recognition is presumed to involve a fraud risk unless the auditor can rebut that presumption for a particular revenue stream. Management override remains a consideration in every audit. Match the response to the identified risk rather than selecting a generic procedure.

Evidence and further procedures

Audit evidence must be sufficient and appropriate. Sufficiency concerns quantity; appropriateness concerns relevance and reliability. External evidence obtained directly by the auditor is generally more reliable than internally produced evidence, but reliability depends on circumstances and controls. A direct confirmation can be valuable, yet an unanswered confirmation is not evidence that the balance is correct.

Tests of controls evaluate whether a control operated effectively. Substantive procedures detect material misstatements at the assertion level and include tests of details and substantive analytical procedures. A strong control environment does not eliminate all substantive work. The auditor performs substantive procedures for material classes of transactions, account balances, and disclosures.

Analytical procedures compare plausible relationships among financial and nonfinancial data. A useful expectation is precise enough to identify a meaningful difference. If recorded revenue rises while shipment volume falls, do not accept a general explanation without corroboration. Investigate significant differences, obtain support, and decide whether the expectation or the recorded amount needs revision.

Sampling involves selecting less than all items to draw a conclusion about a population or to test a control. Define the population and sampling unit, set the objective, consider the risk of incorrect acceptance or rejection, and evaluate deviations or misstatements found. A sample result is not permission to ignore an unusual item. Determine whether it is representative, projectable, or an exception requiring separate follow-up.

Estimates and fair values need special care because they involve uncertainty, methods, data, assumptions, and possible management bias. The auditor may test management’s process, develop an independent estimate or range, or examine subsequent events that provide evidence about the estimate. The work should address significant assumptions and the reliability of underlying data, not merely recalculate arithmetic.

Reporting and engagement types

The audit opinion follows the evidence and reporting framework. An unmodified opinion is appropriate when the auditor concludes the statements are presented fairly, in all material respects, under the applicable framework. A qualified opinion addresses a material but not pervasive misstatement or an inability to obtain evidence with material but not pervasive possible effects. An adverse opinion is used for a material and pervasive misstatement. A disclaimer is used when the auditor cannot obtain sufficient appropriate evidence and possible effects could be material and pervasive, or in other specified circumstances.

An emphasis-of-matter paragraph draws attention to a matter appropriately presented or disclosed that is fundamental to users’ understanding; it does not modify the opinion. An other-matter paragraph concerns something outside the statements that is relevant to users’ understanding of the audit, auditor responsibilities, or the report. Read what the problem says about materiality, pervasiveness, disclosure, and evidence before choosing a report.

A review provides limited assurance, primarily through inquiry and analytical procedures, and is not an audit. A compilation presents information in financial statements without expressing assurance. A preparation engagement assists management in preparing statements and does not provide assurance. An examination under attestation standards provides reasonable assurance on a subject matter or assertion, while a review attestation engagement provides limited assurance. Agreed-upon procedures report findings from specified procedures; the practitioner does not express an opinion or conclusion on the subject matter as a whole.

Reports also depend on the applicable framework and engagement. Issuer audits follow PCAOB requirements, while nonissuer audits generally use AICPA auditing standards. Governmental or compliance engagements can add reporting responsibilities. Learn the broad purpose and report differences rather than memorizing isolated report sentences without understanding the conditions that trigger them.

How to prepare for AUD

Begin with the current AICPA blueprint. Mark the four areas and their ranges, then make a diagnostic set that touches each. Your first pass is not meant to prove readiness; it should reveal whether your gaps are factual, procedural, or judgment-based. Keep an error log with the issue, the evidence you overlooked, the rule or assertion involved, and what would make the tempting alternative correct.

Study a concept, close your notes, and explain it in your own words. Then solve a question that uses different facts. If you miss it, find the precise point where your reasoning broke: Did you confuse completeness with existence? Did you rely on a control without testing it? Did you select a procedure that tests the wrong direction? Rework the idea, then return to a fresh example after a delay.

Mix MCQs and simulations as your knowledge develops. Early in preparation, you may need focused work on a standard or audit cycle. Later, combine topics so you must identify the issue before applying a rule. At least part of each weekly session should involve exhibits, workpaper-style data, and a written or selected response that you can defend.

AICPA’s sample test is useful for becoming familiar with the software and tools. It includes questions from all sections, is shorter than the real exam, is not scored, and is not a readiness prediction. Use it to learn navigation and functionality, then use the current blueprint and your own practice evidence to judge knowledge.

In the final phase, work in timed sets and practise making a decision with the facts available. Do not spend an hour polishing notes you will never retrieve. Review the distinctions you still miss, complete fresh simulation work, and protect enough rest to read carefully. On exam day, a disciplined answer tied to evidence is better than an elaborate answer built on an assumption.

An original AUD example

A fictional retailer records a $44,000 sale on December 30. The shipping term in the contract transfers control when the goods reach the customer. The carrier record shows delivery on January 3. The related inventory cost is $26,000, and the goods remain in the retailer’s warehouse system as shipped. The year-end statements include the sale and remove the inventory.

The key issue is cutoff. Because control transferred on delivery, the December 30 entry is premature on these facts. The auditor should inspect the contract and shipping evidence, trace the transaction through the sales journal and inventory records, and determine whether similar entries near year end were recorded in the wrong period. If not corrected, revenue and receivables are overstated by $44,000; inventory is understated and cost of goods sold overstated by $26,000. The direction and assertion matter more than the date alone.

This example does not establish the answer for every shipping arrangement. A different contract term, acceptance clause, or delivery fact could change when control transfers. In an exam scenario, use the stipulated framework and facts, not an assumed rule based on a shipping label.