AUD, Auditing and Attestation

Sources for Specific Areas of Engagement Risk

Last reviewed 2026-09-14

The standards and authorities behind PocketCPA's AUD lessons on Specific Areas of Engagement Risk. The topic rests on AU-C 250.

About this topic

Some risks do not belong to any one account. They cut across the whole engagement, and one missed at planning is expensive to find later.

Identifying these early shapes the audit strategy and the required communications.

Key points

Management override of controls is always a significant fraud risk that cannot be reduced to an acceptably low level by controls alone.
The three required procedures for management override: journal entry testing, review of estimates for bias, and evaluation of the business rationale for unusual transactions.
Related party transactions require specific procedures because they are inherently higher risk.
Going concern assessment covers a reasonable period (12 months from the financial statement date for nonissuers).

What the lessons cover

Laws and regulations
Going concern (AU-C 570)
Fraud and bias as engagement-wide risks (AU-C 240)
Related parties (AU-C 550)
Accounting estimates and management bias (AU-C 540)
Litigation, claims, and assessments (AU-C 501)
The same risk areas under PCAOB standards

Authoritative references

Where these requirements sit in the literature. AU-C 540 and AU-C 501 deliberately appear at standard level because no grounded source here supplies a paragraph for them.

AU-C 250.13: laws generally recognized to have a direct effect on the determination of material amounts and disclosures (income tax, payroll tax, pension law). Obtain sufficient appropriate audit evidence regarding compliance.
AU-C 250.14: the other category (environmental emission limits, discharge permits, operating-license terms, workplace safety, data privacy). Two specified procedures only: inquire of management and, when appropriate, those charged with governance about compliance, and inspect any correspondence with the relevant licensing or regulatory authorities.
- Remain alert.
- Reporting to outside regulators is generally not required, subject to legal and ethical responsibilities.
- Once possible noncompliance surfaces, obtain a further understanding of the matter and its financial statement effects and communicate to those charged with governance even for indirect-effect laws.
AU-C 250.27: management prevents evidence about suspected noncompliance that may be material, so qualified opinion or disclaimer by pervasiveness.
AU-C 570.14b: evaluate management's assessment over the same period management used as the framework requires.
- Under ASC 205-40-50-1 that period runs within one year after the date the statements are issued or are available to be issued (AU-C 570.11).
- Request an extension if management's period is shorter (AU-C 570.27).
AU-C 570.16: additional procedures, including whether management's plans are likely to be effectively implemented, the reliability of underlying data and support for significant assumptions where prospective financial information is significant, and written representations about the plans.
AU-C 570.24: substantial doubt plus an appropriate basis plus adequate disclosure gives an unmodified opinion and a separate section headed "Substantial Doubt About the Entity's Ability to Continue as a Going Concern." Inadequate disclosure is a GAAP departure yielding qualified or adverse.
AU-C 570.A3: example conditions and events grouped as financial, operating and other, weighed in the aggregate.
AU-C 240.15: the brainstorming discussion among key engagement team members on how and where the statements could be susceptible to fraud, with prior beliefs about honesty and integrity set aside.
AU-C 240.26 and AU-C 240.46: the rebuttable presumption of a fraud risk in improper revenue recognition, and the requirement to document the reasons when it is concluded not to apply.
AU-C 240.32: the three management-override procedures required on every audit regardless of assessed risk, being journal entries and other adjustments, estimate bias including a retrospective review, and the business rationale of significant unusual transactions. Those transactions are flagged by unusual size, nature, complexity or timing and the absence of a clear business rationale discussed with those charged with governance.
AU-C 240.40: fraud or suspected fraud involving senior management, or resulting in a material misstatement, communicated to those charged with governance timely, even before a final materiality conclusion.
AU-C 240.A1: the exhibit of fraud risk factors, organized as incentive or pressure, opportunity, and attitude or rationalization.
AU-C 550.13: inquiry about related-party identity including changes from the prior period, the nature of the relationships, and whether transactions were entered into, with their type and purpose.
AU-C 550.15: alertness to undisclosed related parties, and the profile of abnormal terms, no apparent business rationale, or unusual processing. Ordinary dealings on market terms are not red flags.
AU-C 550.22: a significant related party transaction outside the normal course of business is a significant risk, so inspect the underlying contracts and evaluate the rationale (or its absence) for signs of fraudulent financial reporting, the consistency of the terms with management's explanations, and the accounting and disclosure.
AU-C 550.23: an in-statement arm's-length assertion requires sufficient appropriate audit evidence about that assertion, not management's representation. Reasonable assurance is the standard, and failure to substantiate sends the auditor to the effect on the report.
AU-C 540 (standard level).
- One or more of three approaches, being events up to the report date, testing how management made the estimate, and the auditor's own point estimate or range.
- Assessment of the degree of estimation uncertainty and whether it creates a significant risk.
- Alertness to management bias.
- The retrospective review is a risk-assessment procedure that does not call into question prior estimates reasonable when made.
- An estimate cannot be reduced to a precise known amount or validated by confirming with customers, and unobservable, model-based inputs carry higher uncertainty than a quoted price for an identical asset.
AU-C 501 (standard level).
- The letter of audit inquiry is the principal means of corroborating management's identification, evaluation and disclosure of litigation, claims and assessments.
- Responsibility for the estimate stays with management.
- A lawyer's refusal on a material matter is a limitation on the scope of the audit.
AS 2405.05 through .10 carry the PCAOB architecture for illegal acts.
- Direct-and-material-effect laws viewed through audit objectives rather than legality per se (.05).
- Other laws reaching the statements through the need to disclose a contingent liability (.06).
- No procedures designed to detect illegal acts, but required inquiries of management and the audit committee and written representations, with nothing further absent specific information (.08).
- Procedures specifically directed once specific information arrives (.07).
- Inquiry of management at a level above those involved, then the client's legal counsel with arrangements made by the client (.10).
AS 2405.13, .17 through .20, .22 and .23 carry the consequences.
- Quantitative and qualitative materiality (.13).
- Audit committee communication as soon as practicable and before the report issues, clearly inconsequential matters excepted and direct communication where senior management is involved (.17).
- Qualified or adverse for a material act not properly accounted for or disclosed (.18).
- Generally disclaim where the client precludes the evidence (.19).
- Withdraw if the client refuses the modified report (.20).
- Possible withdrawal even for an immaterial act where remedial action is not taken (.22).
- Four circumstances in which a duty to notify outside parties may exist (.23): a Form 8-K auditor change, a successor auditor's inquiries, a subpoena, and a funding agency requirement. The Form 8-K item is what makes this four where AS 2401.82 is three.
AS 2415.02, .05, .08, .09, .11 through .17 carry the PCAOB going-concern rules.
- A reasonable period not to exceed one year beyond the date of the financial statements being audited (.02).
- No need to design procedures solely to identify the conditions (.05).
- Identification of the elements of management's plans particularly significant to overcoming the adverse effects, with evidence obtained about them (.08).
- Consideration of support for significant assumptions in prospective information (.09).
- Disclosure considerations where doubt is alleviated (.11).
- An explanatory paragraph, including an appropriate title, immediately following the opinion paragraph, whose footnote forbids conditional language (.12, illustrated at .13).
- Qualified or adverse for inadequate disclosure (.14).
- Current-period doubt not implying prior-period doubt (.15), and no repetition once doubt is removed (.16).
- Five documentation items (.17).
AS 2401.05 through .07, .57 through .67A, .79, .82 and .83, with AS 2110.49, .52, .66, .68 and .71, carry the PCAOB fraud rules.
- Intent as the primary distinguishing factor (AS 2401.05), the two types of misstatement (.06) and the three conditions (.07), of which all three need not be present (AS 2110.66).
- The required discussion (AS 2110.49) held with a questioning mind and with prior beliefs set aside, covering related party transactions, omitted or inaccurate disclosures and management bias in estimates (AS 2110.52).
- The presumption of a fraud risk in improper revenue recognition (AS 2110.68) with documentation of the reasons if it is not identified (AS 2401.83).
- A fraud risk is a significant risk (AS 2110.71).
- Management-override procedures covering journal entries (.58), period-end focus (.62), the retrospective review that does not reopen prior-year judgments (.64) and the business purpose of significant unusual transactions (.66A and .67).
- Communications to management even where inconsequential, with senior-management and material-misstatement fraud going directly to the audit committee before the report issues (.79), plus three outside circumstances (.82).
AS 2410.05 through .19 carry the PCAOB related-party requirements.
- Inquiries of management including changes from the prior period (.05), of others within the company (.06) and of the audit committee or its chair (.07).
- For each transaction required to be disclosed or determined a significant risk, reading the documentation, determining authorization and approval and whether exceptions were granted, and evaluating the related party's financial capability (.12).
- Intercompany balances tested as of concurrent dates even where fiscal years differ (.13).
- Reading the minutes (.14).
- Procedures beyond inquiry of management where undisclosed relationships might exist (.15), with six steps once one is found including why it was undisclosed and whether that indicates fraud or an illegal act (.16).
- The arm's-length assertion rule that failure to substantiate plus management's refusal to modify the disclosure yields a qualified or adverse opinion, with "management believes that" changing nothing (.18).
AS 2501.07, .15 through .17, .29, .31 and Appendix A .A1 carry the PCAOB estimate rules.
- The three approaches, being testing the company's process, developing an independent expectation and evaluating post-measurement-date events, usable individually or in combination (.07).
- Identifying the significant assumptions, including those sensitive to variation, susceptible to manipulation or bias, resting on unobservable data, or depending on intent and ability (.15), and evaluating their reasonableness individually and in combination (.16).
- The four factors for an intent-and-ability assumption (.17).
- Attention to changes in circumstances between a post-measurement-date event and the measurement date (.29).
- Bias evaluated individually and in aggregate and for the cumulative effect of changes (.31).
- The ranking that fair values from trades of identical instruments in an active market carry lower risk than those from similar instruments or unobservable inputs (.A1).
AS 2810.13, .17, .24, .25 and .27 carry the PCAOB evaluation rules used here.
- A recorded estimate outside a supported range is a misstatement measured to the closest reasonable estimate (.13).
- A quantitatively small item can be material for qualitative reasons, an illegal payment that could lead to a material contingent liability or loss of revenue being the standard illustration (.17).
- The auditor evaluates the qualitative aspects of accounting practices including potential bias (.24).
- Named forms of bias include selective correction of misstatements and management's offsetting adjusting entries (.25).
- Estimates grouped at one end of the reasonable range one year and the other end the next are evaluated as possible swings to achieve a desired outcome (.27).
AS 2505.06, .08, .12 and .13 carry the PCAOB lawyer-inquiry rules.
- The auditor requests that management send the letter (.06).
- The letter is the primary means of corroboration, and inside counsel is not a substitute for what outside counsel refuses to furnish (.08).
- Limits for substantive attention and for materiality under an agreed understanding are not scope limitations (.12).
- A refusal to furnish the requested information, in writing or orally, is a scope limitation sufficient to preclude an unqualified opinion (.13).

How PocketCPA uses these sources

Every lesson is written in original words and cites the paragraph each rule comes from. No standard's text is reproduced. How lessons and questions are written and checked is set out in our methodology.