Study guide
3.4 Audit Risk Foundations
Uniform CPA Examination Exam
Track your progress as you read
Finished sections get a check mark.
1 Chapter 1: CPA Exam Structure and Licensure Rules
1.1 CPA Evolution Model 1.2 Eligibility, Credit Window, and Scheduling Rules 1.3 Scoring, Pass Rates, and Blueprints
2 Chapter 2: CPA Scoring, Interface, and Exam Strategy
Score Scale and Testlets MCQ/TBS Weighting by Section Sample Test Interface Tools Exam-Day Time Management
3 Chapter 3: AUD Ethics, Independence, and Engagement Acceptance
3.1 Professional Responsibilities and Independence 3.2 Engagement Acceptance and Continuance 3.3 Audit Documentation and Quality Management 3.4 Audit Risk Foundations
4 Chapter 4: AUD Risk Assessment, Controls, and Evidence
4.1 Assertions and Risk Assessment 4.2 Internal Control Design and Operating Effectiveness 4.3 Substantive Procedures and Audit Evidence 4.4 Sampling, Analytics, and Estimates
5 Chapter 21: AUD Sampling, Analytics, and Accounting Estimates
21.1 Audit Sampling Risk and Sample Design 21.2 Substantive Analytical Procedures 21.3 Estimates, Fair Value, and Specialists 21.4 Data Analytics, Exceptions, and Follow-Up
6 Chapter 22: AUD Integrated Audits, IT Controls, and SOC Reliance
22.1 ICFR Integrated Audit Framework 22.2 IT General Controls and Application Controls 22.3 Service Organizations, SOC Reports, and CUECs 22.4 Control Deficiencies and Material Weaknesses
7 Chapter 5: AUD Reporting, Attestation, and Review Engagements
5.1 Audit Opinions and Modifications 5.2 Emphasis, Other Matter, and Going Concern 5.3 Review, Compilation, and Preparation Engagements 5.4 Attestation and Government Auditing Signals
8 Chapter 36: AUD Workbook - From Risk to Report
36.1 Risk-Assertion-Procedure Drill 36.2 Evidence Reliability Drill 36.3 Control Deficiency Classification Drill 36.4 Report Modification Decision Drill
9 Chapter 6: FAR Financial Statements and Reporting Framework
6.1 Conceptual Framework and Standard Setting 6.2 Financial Statement Presentation 6.3 Cash Flow Statement and Disclosures 6.4 Not-for-Profit Reporting Basics
10 Chapter 7: FAR Balance Sheet Accounts and Rollforwards
7.1 Cash, Receivables, and Reconciliations 7.2 Inventory and Cost Flow Errors 7.3 Property, Equipment, and Intangibles 7.4 Debt, Equity, and Contingencies
11 Chapter 8: FAR Selected Transactions and Measurement Models
8.1 Revenue Recognition: Five-Step Model 8.2 Leases, Income Taxes, and Impairment 8.3 Business Combinations and Consolidations 8.4 Accounting Changes, Errors, and Subsequent Events
12 Chapter 32: FAR Revenue, Leases, and Income Taxes Deep Dive
32.1 Revenue Contract Modifications and Variable Consideration 32.2 Lease Classification and Lessee Accounting 32.3 Deferred Tax Assets, Liabilities, and Valuation Allowances 32.4 Simulation Workflows for Revenue, Lease, and Tax Exhibits
13 Chapter 31: FAR Financial Instruments, Fair Value, and Derivatives
31.1 Financial Asset Classification and Measurement 31.2 Fair Value Hierarchy and Disclosures 31.3 Derivatives, Hedge Accounting, and Embedded Features 31.4 Foreign Currency and Comprehensive Income Signals
14 Chapter 24: FAR Consolidations, Equity Method, and Intercompany Workpapers
24.1 Consolidation Decision and Noncontrolling Interest 24.2 Acquisition-Date Measurement and Goodwill 24.3 Equity Method Income, Dividends, and Impairment 24.4 Intercompany Inventory, Debt, and Fixed Asset Eliminations
15 Chapter 9: FAR Governmental Accounting and Fund Reporting
9.1 Governmental Fund Types and Basis 9.2 Government-Wide Statements and Reconciliations 9.3 Budgetary Accounting and Encumbrances 9.4 Governmental and NFP Comparison Traps
16 Chapter 23: FAR Not-for-Profit and Special Reporting Topics
23.1 Not-for-Profit Net Assets and Restrictions 23.2 Contributions, Conditional Gifts, and Agency Transactions 23.3 Functional Expenses and Statement Presentation 23.4 Interim, Segment, and EPS Reporting Traps
17 Chapter 37: FAR Workbook - Journal Entries, Rollforwards, and Reconciliations
Adjusting Entry Workflow Account Rollforward Workflow Reconciliation and Error Correction Drill Statement Presentation Workpaper Drill
18 Chapter 10: REG Tax Procedure, Ethics, and Business Law
10.1 Tax Practice Ethics and Preparer Responsibilities 10.2 IRS Procedure, Statutes, and Penalties 10.3 Contracts, Agency, and Business Entities 10.4 Secured Transactions, Bankruptcy, and Priority
19 Chapter 11: REG Individual Federal Tax Workflows
11.1 Gross Income, Exclusions, and Adjustments 11.2 Filing Status, Dependents, and Deductions 11.3 Credits, Payments, and AMT Concepts 11.4 Retirement, Passive Activity, and Loss Limitations
20 Chapter 12: REG Property Transactions and Entity Taxation
12.1 Basis, Realized Gain, Recognized Gain, and Character 12.2 C Corporations and Shareholder Transactions 12.3 S Corporations, Partnerships, and Basis 12.4 Entity Tax Simulations and K-1 Workflows
21 Chapter 25: REG Entity Choice, Basis, and Owner Tax Consequences
25.1 C Corporation, S Corporation, and Partnership Comparison 25.2 Formation Contributions and Built-In Gain 25.3 Distributions, Redemptions, and Liquidations 25.4 Loss Limits: Basis, At-Risk, and Passive Rules
22 Chapter 26: REG Property Tax, Character, and Deferral Transactions
26.1 Capital, Ordinary, and Section 1231 Character 26.2 Depreciation Recapture and Unrecaptured Gain 26.3 Like-Kind Exchanges, Involuntary Conversions, and Installment Sales 26.4 Related-Party, Wash-Sale, and Imputed-Interest Traps
23 Chapter 33: REG Trusts, Estates, Gifts, and Exempt Organizations
33.1 Trust and Estate Income Tax Basics 33.2 Gift, Estate, and Beneficiary Planning Concepts 33.3 Tax-Exempt Organizations and Unrelated Business Income 33.4 Fiduciary K-1 and Distribution Simulation Workflows
24 Chapter 38: REG Workbook - Tax Return Schedules and Basis Workpapers
38.1 Individual Return Classification Drill 38.2 Property Basis and Character Workpaper 38.3 Pass-through K-1 and Owner Basis Workpaper 38.4 Business Law Issue Spotting Drill
25 Chapter 13: BAR Business Analysis, Economics, and Forecasting
13.1 Financial Statement Analysis and Ratios 13.2 Variance, Forecasting, and Budgeting 13.3 Cost Accounting and Performance Management 13.4 Economics, Finance, and Decision Models
26 Chapter 14: BAR Technical Accounting and Advanced Reporting
14.1 Revenue, Leases, and Complex Arrangements 14.2 Derivatives, Hedges, and Fair Value 14.3 Business Combinations and Consolidations 14.4 SEC Reporting and Public Company Context
27 Chapter 15: BAR State and Local Government Analysis
15.1 Governmental Fund Analysis 15.2 Government-Wide Conversion Workflows 15.3 Budgetary Reconciliation and CAFR/ACFR Reading 15.4 Government Simulation Strategy
28 Chapter 16: ISC Information Systems and Data Management
16.1 Systems Architecture and Data Flow 16.2 ERP, Accounting Systems, and Change Management 16.3 Data Governance, SQL, and Analytics 16.4 Availability, Backup, and Recovery Controls
29 Chapter 17: ISC Security, Privacy, and SOC Engagements
17.1 Security Threats and Control Selection 17.2 Privacy, Confidentiality, and Compliance Frameworks 17.3 SOC 1, SOC 2, SOC 3, and Cybersecurity Reports 17.4 Service Organization Exceptions and User Controls
30 Chapter 18: TCP Individual Tax Planning and Personal Financial Issues
18.1 Nonroutine Individual Income and Estimated Tax 18.2 Passive, At-Risk, and Investment Planning 18.3 Retirement, Education, and Insurance Planning 18.4 Gift, Estate, and Beneficiary Concepts
31 Chapter 19: TCP Entity Compliance and Planning
19.1 C Corporation Tax Planning 19.2 S Corporation Basis and Distributions 19.3 Partnership Tax Planning and Allocations 19.4 Trusts, Tax-Exempt, and International Signals
32 Chapter 34: TCP International and Advanced Entity Tax Topics
34.1 International Tax Signals and Source of Income 34.2 CFC, Foreign Tax Credit, and Permanent Establishment Concepts 34.3 Consolidated Returns and Affiliated Corporations 34.4 Advanced Partnership and S Corp Planning Scenarios
33 Chapter 35: Choosing and Preparing for BAR, ISC, or TCP
35.1 Discipline Fit Matrix by Background 35.2 BAR, ISC, and TCP Blueprint and Skill Comparison 35.3 Discipline Study Plans and Practice Balance 35.4 Switching Disciplines, Retake, and Score Interpretation
34 Chapter 39: CPA TBS Research, Authoritative Literature, and Document Review
39.1 Document Review Simulation Method 39.2 Research and Authoritative Literature Workflow 39.3 Exhibit Overload and Relevant Data Selection 39.4 Written Explanation and Professional Judgment Drills
35 Chapter 20: CPA Simulations, Retakes, and Final Review
20.1 TBS Exhibit Triage and Workpaper Method 20.2 Section-Specific Final Review Plans 20.3 Score Release, Retake, and Credit Window Decisions 20.4 Four-Section Study Roadmaps
36 Chapter 40: Discipline Workbook Drills for BAR, ISC, and TCP
40.1 BAR Ratio, Variance, and Government Drill 40.2 ISC Control Evidence and SOC Drill 40.3 TCP Basis Planning and Entity Drill 40.4 Discipline Final Mock and Review Log
3.4 Audit Risk Foundations
Key Takeaways Explain This Topic AI
AUD Area II (Assessing Risk and Developing a Planned Response) is weighted 25-35% and moves from principles into planning judgments: understand the entity, identify risk, set materiality, evaluate controls, and design responses.
Audit risk = Risk of material misstatement (inherent risk x control risk) x detection risk; the auditor cannot change inherent or control risk but manages detection risk through the nature, timing, and extent of procedures.
Risk of material misstatement is assessed at both the financial-statement level (pervasive) and the relevant-assertion level (specific accounts, transactions, disclosures).
The 2026 blueprint emphasizes entity-level controls, IT general controls, business-process controls, walkthroughs, and service organizations evidenced by SOC 1 Type 2 reports.
Materiality for the statements as a whole drives performance materiality (tolerable misstatement), and audit data analytics outputs help isolate higher-risk transactions and shape planned procedures.
Last updated: June 2026
Audit Risk Foundations
AUD Area II, Assessing Risk and Developing a Planned Response , is weighted 25-35% in the 2026 blueprint and is the bridge from general principles to planning. The work is sequential: understand the entity, identify and assess risks, set materiality, evaluate controls, and design procedures that respond to the assessed risks (AU-C 315, 320, and 330).
The Audit Risk Model
Audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated. The model is:
Audit risk = Risk of Material Misstatement (RMM) x Detection Risk
and RMM itself decomposes:
RMM = Inherent Risk x Control Risk
Inherent risk (IR): the susceptibility of an assertion to material misstatement before considering controls (complexity, estimates, related-party deals, fraud incentives).
Control risk (CR): the risk that the entity's controls will not prevent, or detect and correct , a material misstatement on a timely basis.
Detection risk (DR): the risk that the auditor's procedures will not detect a material misstatement that exists.
The key planning insight: the auditor cannot change IR or CR (those belong to the entity); the auditor sets DR by adjusting the nature, timing, and extent of procedures. Because audit risk is held to a low acceptable level, higher RMM forces lower planned DR , which means more persuasive, more extensive, or more year-end-focused procedures.
Risk component Who primarily affects it Planning implication
Inherent risk Entity facts, complexity, estimates, fraud incentives Higher IR demands more persuasive evidence.
Control risk Entity control design and operating effectiveness Weak or untested controls push toward substantive procedures.
Detection risk The auditor's own procedures Lowered by changing nature, timing, or extent.
If assessed RMM is high, the auditor must drive detection risk low: larger samples, more reliable evidence (e.g., external confirmations over internal documents), and testing at rather than before year-end.
Financial-Statement Level vs. Assertion Level
The blueprint requires assessing RMM at two levels :
Financial-statement level: pervasive risks that affect many assertions, such as weak tone at the top , going-concern doubt, covenant pressure, or pervasive IT access weaknesses. These trigger an overall response : more experienced staff, heightened supervision, increased professional skepticism, and unpredictability in procedures.
Relevant-assertion level: risks tied to a specific class of transactions, account, or disclosure, framed by assertions such as existence/occurrence, completeness, valuation/allocation, rights and obligations, and presentation/disclosure (e.g., revenue cutoff , inventory existence , allowance valuation , completeness of liabilities).
Understanding the Entity and Its Controls
Risk assessment begins with understanding external factors (industry, regulation, economy, supply chain, technology, and the reporting framework) and internal factors (ownership, governance, operations, financing, accounting policies, and technology use including artificial intelligence). The 2026 blueprint emphasizes:
Entity-level controls (control environment, risk assessment process, monitoring).
IT general controls (ITGCs): access, change management, and operations that underpin automated controls.
Business-process / transaction-level controls , both automated and manual.
Walkthroughs that trace a transaction from initiation through the records, documenting the flow of transactions and data .
Service organizations: when a client outsources a process (e.g., payroll), a SOC 1 Type 2 report (a System and Organization Controls report on controls relevant to financial reporting, covering both design and operating effectiveness over a period ) helps the user auditor understand the service organization's controls and determine the nature and extent of additional testing. A SOC 1 Type 1 covers design at a point in time only; a SOC 2 addresses trust-services criteria (security, availability, processing integrity, confidentiality, privacy) and is not the financial-statement report.
A SOC 1 report never eliminates the need to understand the user entity's own process or to perform user-side procedures.
Materiality and Planned Response
Materiality links risk to evidence. Overall (planning) materiality for the statements as a whole reflects the magnitude of misstatement that would influence users' decisions. Performance materiality (the engagement equivalent of tolerable misstatement ) is set below overall materiality to reduce the chance that the aggregate of uncorrected and undetected misstatements exceeds materiality. The auditor may also set lower materiality for particular accounts or disclosures.
When risk increases, the auditor responds : tests of controls (only if it intends to rely on them, or substantive procedures alone are insufficient), substantive procedures shifted toward year-end, larger samples, specialists, and procedures targeting fraud risks. The blueprint expressly includes using audit data analytics outputs (reports, visualizations, full-population analyses) to identify higher-risk transactions and to develop and refine planned procedures.
The Risk Model in Numbers
The model is conceptual, not a precise calculation, but the exam tests the direction of change. If the auditor targets audit risk of 5% , assesses inherent risk at 80% and control risk at 50% , then RMM is roughly 0.80 x 0.50 = 40% , and the planned detection risk is about 0.05 / 0.40 = 12.5% . A low allowable detection risk means more substantive evidence. The relationships to memorize:
- If RMM is... Then detection risk is set... Effect on procedures
- Higher Lower More extent, more persuasive evidence, year-end timing
- Lower Higher Less extent, interim timing acceptable
- Tests of Controls vs. Substantive Procedures
Control risk below maximum may be assessed only if the auditor plans to test the operating effectiveness of those controls; an expectation of effectiveness alone is not enough. If controls are not tested or are ineffective , control risk is at the maximum and the auditor relies on substantive procedures (tests of details plus substantive analytical procedures). For significant risks and for any assertion where substantive procedures alone cannot provide sufficient appropriate evidence (common with highly automated, paperless processes), the auditor must test relevant controls.
This is why ITGCs matter: if access and change-management controls are weak, the auditor cannot rely on the automated application controls that depend on them, pushing the engagement toward heavier substantive testing. The planning chain, understand the entity, assess RMM at both levels, set materiality, decide whether to test controls, and design responsive procedures, is the spine of Area II and the foundation for everything in Areas III and IV.