CPA AUD Exam Topics

How the AUD blueprint is organized

The AUD blueprint is more useful as a map of professional work than as a list to memorize. It organizes content by Area, Group, and Topic, then gives representative tasks and skill levels. The four Areas describe broad kinds of work expected of a newly licensed CPA: professional responsibilities, assessing risk, performing procedures, and forming conclusions. A single audit scenario can connect more than one Area.

The 2026 blueprint assigns percentage ranges rather than exact question counts to its four Areas. Those ranges help you see relative emphasis. They do not promise how many questions from a particular topic will appear on your test. AICPA also cautions that a topic with more representative task statements is not necessarily weighted more heavily. Study the stated content and tasks, not the number of lines in the PDF.

The largest range belongs to Area III. That makes evidence work central, but it does not mean that Areas I, II, or IV can be treated as optional. A risk response depends on ethical independence and a sound understanding of the engagement. Evidence work matters only if the auditor evaluates the results and reports appropriately.

Area I: Ethics, Professional Responsibilities and General Principles

Area I sets the conditions under which assurance work can be accepted, performed, and reported. Topics include the nature and scope of different engagements, professional responsibilities, ethics and independence, engagement acceptance and continuance, quality management, and general auditing principles. The same word, such as “assurance,” can mean different things across an audit, review, examination, compilation, preparation, or agreed-upon procedures engagement. Begin by identifying the service and its objective.

Independence questions ask you to notice a relationship or service that could threaten compliance with the applicable rules. Identify the people, interests, or services described. Then determine which professional framework applies and whether a safeguard is permitted or the circumstance is prohibited. Do not assume every threat can be solved by adding a second reviewer or disclosing the relationship.

Acceptance and continuance scenarios often turn on whether the firm can perform the engagement competently, maintain independence, obtain access to evidence, and work with management that understands its responsibilities. If management imposes a severe scope restriction before the engagement begins, the issue is not simply which procedure to use. The firm considers whether accepting or continuing the engagement is appropriate and what reporting consequences could follow.

A useful distinction is responsibility. Management prepares the financial statements and maintains responsibility for them. The auditor obtains reasonable assurance and expresses an opinion. The auditor does not take over management’s decisions or guarantee that every misstatement will be detected. When a scenario suggests that the auditor is being asked to make a management decision, pause and identify the independence or responsibility issue before choosing a technical procedure.

Area II: Assessing Risk and Developing a Planned Response

Area II moves from understanding the entity to deciding where the audit needs attention. The auditor learns about the business, its environment, its financial reporting, and relevant internal control. The auditor considers materiality, identifies risks of material misstatement at the financial statement and assertion levels, and plans an overall response and further procedures.

A risk statement should connect a possible misstatement to an account, disclosure, or assertion. “The company has a new system” is background. “A conversion may have omitted customer credits from the year-end receivables data, overstating receivables and revenue” identifies a plausible direction and affected assertions. That formulation makes it easier to choose evidence.

Materiality is a judgment about whether a misstatement could influence users. Performance materiality is set below overall materiality to help manage the possibility that uncorrected and undetected misstatements together exceed the overall amount. Qualitative considerations may make a smaller item important. The blueprint tests judgment and application, not a universal threshold that can be used for every entity.

Risk terms become clearer when you keep their location in the audit model straight. Inherent risk concerns susceptibility to misstatement before considering controls. Control risk concerns whether controls fail to prevent, detect, or correct a misstatement. Detection risk concerns whether the auditor’s procedures fail to find a misstatement that exists. The auditor responds through the nature, timing, and extent of work.

Understanding a control does not show that it operated effectively all year. A walkthrough can help the auditor understand the process and determine whether a control is designed and implemented. If the audit plan relies on a control, the auditor tests its operation under the relevant conditions. If the control test does not support reliance, the auditor revises the planned response and performs appropriate substantive work.

Fraud considerations are also part of risk assessment. Look for incentives or pressure, opportunity, and attitudes or rationalizations in the facts. Revenue recognition is presumed to include a fraud risk unless that presumption is rebutted for a specific revenue stream. A scenario may also point toward management override. Match procedures to the identified risk rather than selecting a general fraud checklist without considering the case.

Area III: Performing Further Procedures and Obtaining Evidence

Area III is where the planned response becomes audit work. The blueprint covers evidence, tests of controls, substantive procedures, analytical procedures, sampling, and procedures for specific accounts, transaction cycles, and disclosures. It also includes evaluating the reliability of information and addressing estimates or other matters that need particular attention.

Every procedure should answer a question. A confirmation sent to a customer can provide evidence about a recorded receivable, but the auditor still considers nonresponses, exceptions, and alternative procedures. To test whether recorded revenue occurred, trace recorded transactions to supporting evidence. To search for unrecorded liabilities, begin with later payments or receiving records and trace toward the ledger. The direction follows the assertion.

Sufficiency and appropriateness are related but distinct. Sufficiency concerns how much evidence has been obtained. Appropriateness concerns its relevance and reliability. More copies of the same internally prepared report do not necessarily make weak evidence strong. Consider the source, how the information was produced, and whether it addresses the assertion at issue.

Substantive analytical procedures use plausible relationships to develop an expectation and investigate meaningful differences. If payroll expense falls while headcount and salary rates rise, the auditor should not accept a broad explanation without support. A useful expectation is precise enough to reveal a difference that matters. Tests of details can then address the specific transactions, balances, or estimates that need more evidence.

Sampling is not a shortcut that makes exceptions disappear. Define the population and objective, choose an appropriate sampling approach, assess the result, and consider whether a deviation or misstatement is isolated or points to a broader problem. An unusual item can call for direct follow-up even if it is not typical of the rest of the sample.

Estimates require attention to the method, data, assumptions, uncertainty, and potential management bias. Recalculating management’s spreadsheet tests arithmetic but may not show that the assumptions are reasonable or that the data are complete. The auditor may test management’s process, develop an independent estimate or range, or evaluate relevant subsequent evidence, depending on the facts and applicable standards.

Area IV: Forming Conclusions and Reporting

Area IV connects evidence to the report. The auditor evaluates identified misstatements, considers whether the evidence is sufficient, obtains written representations, addresses subsequent events and other information, and determines the reporting consequences. The blueprint includes audit reports as well as reporting for attestation, accounting and review services, compliance, and other circumstances.

Opinion selection depends on what is wrong or what evidence is missing, whether the possible effect is material, and whether the effect is pervasive. A material but not pervasive misstatement or possible effect may lead to a qualified opinion. A material and pervasive misstatement can require an adverse opinion. A material and pervasive possible effect from an inability to obtain evidence can lead to a disclaimer. An emphasis-of-matter paragraph draws attention to a properly presented or disclosed matter; it does not itself modify the opinion.

Do not stop once you find an error. Accumulate misstatements, ask management to correct them, evaluate uncorrected amounts individually and in aggregate, and consider qualitative context. Then determine whether the statements and report need to change. A control deficiency may increase the risk of misstatement, but it does not prove that the statements are wrong. Evidence about the actual effect is still required.

The other engagement types have different assurance outcomes. A review provides limited assurance and relies primarily on inquiry and analytical procedures. A compilation does not express assurance. A preparation engagement assists management without assurance. Agreed-upon procedures report findings from specified procedures rather than an opinion on the subject matter as a whole. An examination engagement provides reasonable assurance under the relevant attestation standards.

How the skill levels fit the content

The blueprint assigns skill levels as well as topics. The cognitive labels move from remembering and understanding through application, analysis, and evaluation. They describe the kind of work expected, not four separate subjects. You might recall what a confirmation is, apply it to a receivable, analyze an exception, and evaluate whether the remaining evidence supports a conclusion.

The same topic can appear at more than one level. For example, a question on internal control might ask you to recognize what a walkthrough establishes. A more demanding case could give you a process narrative and ask whether a control is designed appropriately, what evidence would show that it operated, or how a failed test should change the audit plan. Learning the definition is the start; practising the decision is the transfer.

A task statement combines content with an action. Words such as identify, evaluate, determine, or perform signal different work. Do not read the verb as a promise about the exact question format. A multiple-choice item can require analysis, while a simulation can test a straightforward calculation. Prepare the knowledge and reasoning, not an assumed mapping between one skill level and one item type.

Follow a scenario across the four Areas

Consider a fictional retailer that began offering large year-end discounts. Some goods were shipped before year end but delivered afterward, and management recorded sales when invoices were issued. The auditor must first consider independence and engagement responsibilities. Then the auditor learns how orders, shipping, acceptance, and revenue entries move through the system, assesses cutoff risk, and plans procedures.

The next step may be to select sales recorded near year end and compare contract terms, carrier records, and customer acceptance. If a sale was recorded before the contract’s transfer condition was met, the auditor evaluates the amount and the related inventory and cost entries. The auditor checks for other exceptions and accumulates any misstatement. Finally, the auditor considers management’s response, the total effect, and whether the statements or report need revision.

One fact pattern has touched all four Areas. That is why a study plan organized only by isolated definitions can feel fragmented. After learning each area, practise a chain of decisions: what engagement is this, what could be wrong, what evidence addresses it, what did the evidence show, and what should happen next? The answer to one question often determines the next.

Turn the blueprint into a study map

Start by laying out the four Areas and ranges. Give each area planned time in proportion to its range, while preserving review for the full outline. Do not allocate time by counting rows in the blueprint or by assuming that every topic in a large area is equally likely. Use the detailed topics to identify gaps in your knowledge and the task statements to choose practice.

For each topic, write one explanation from memory and one decision you should be able to make. For example, for evidence, explain sufficiency and appropriateness, then decide whether a specific document supports an assertion. For reporting, explain qualified versus adverse opinions, then classify a scenario based on materiality, pervasiveness, and evidence limitations.

Keep an error log tied to the blueprint. Record the Area, topic, skill, and exact reasoning miss. “Forgot a rule” needs a different remedy from “chose evidence that did not address completeness.” Review the topic, then solve a new question with different facts. The test of learning is whether you can transfer the principle, not whether you remember an answer key.

Mix multiple-choice questions and simulations. The exam weights the two portions equally, and a real audit problem can cross areas. AICPA’s official sample test helps you learn the software; it is not scored and does not determine readiness. Use original practice and the current blueprint for content study.