CPA Exam Performing Further Procedures and Obtaining Evidence

Last updated: May 2, 2026

Performing Further Procedures and Obtaining Evidence questions are one of the highest-leverage areas to study for the CPA Exam. This guide breaks down the rule, the elements you need to recognize, the named traps that catch most students, and a memory aid that scales to test day. Read it once, then practice the same sub-topic adaptively in the app.

The rule

Under AU-C §330, after you assess the risk of material misstatement (RMM) at the relevant assertion level, you must design and perform further audit procedures whose nature, timing, and extent are responsive to those assessed risks. Further procedures consist of (1) tests of controls — required only when your risk assessment includes an expectation that controls operate effectively, or when substantive procedures alone cannot provide sufficient appropriate evidence — and (2) substantive procedures, which are required for all relevant assertions related to each material class of transactions, account balance, and disclosure, regardless of the assessed RMM. For every significant risk, you must perform substantive procedures that are specifically responsive to that risk, and if you intend to rely on controls that mitigate a significant risk, you must test those controls in the current period.

Elements breakdown

Overall Responses (AU-C §330.05)

Firm-wide or engagement-wide responses to risks of material misstatement at the financial-statement level.

  • Emphasize professional skepticism with the team
  • Assign more experienced staff or specialists
  • Provide more supervision
  • Incorporate unpredictability in procedure selection
  • Make general changes to nature, timing, or extent

Tests of Controls

Procedures designed to evaluate the operating effectiveness of controls in preventing or detecting material misstatements at the assertion level.

  • Required when risk assessment assumes controls operate effectively
  • Required when substantive procedures alone are insufficient
  • Mandatory each year for controls over significant risks if relied upon
  • Test by inquiry plus inspection, observation, or reperformance
  • Inquiry alone is never sufficient

Common examples:

  • Reperforming a three-way match for a sample of disbursements
  • Observing the segregation of cash receipt and posting duties

Substantive Procedures

Procedures designed to detect material misstatements at the assertion level; include tests of details and substantive analytical procedures.

  • Required for all relevant assertions of each material balance, class, or disclosure
  • Must include agreeing financial statements to underlying records
  • Must include examining material journal entries and other adjustments
  • Must respond specifically to each significant risk
  • Cannot be eliminated by strong controls

Significant Risks

Identified and assessed RMMs that, in the auditor's judgment, require special audit consideration (e.g., fraud risks, complex non-routine transactions, related-party transactions).

  • Require substantive procedures specifically responsive to the risk
  • If relying on related controls, test them in the current period
  • Often involve management estimates or judgment
  • Cannot be addressed by substantive analytics alone

Nature, Timing, and Extent (NTE)

The three dimensions you adjust as RMM rises or falls.

  • Nature: shift to more reliable evidence (e.g., external confirmation over inquiry)
  • Timing: move from interim to year-end as risk increases
  • Extent: increase sample sizes or coverage as risk increases
  • Add unpredictable procedures for fraud-risk responsiveness

Evidence Hierarchy (AU-C §500)

Reliability of audit evidence depends on its source and nature.

  • External evidence more reliable than internal
  • Auditor-obtained evidence more reliable than entity-provided
  • Documentary evidence more reliable than oral
  • Originals more reliable than copies
  • Evidence obtained when controls are effective is more reliable

Common patterns and traps

The Controls-Replace-Substantive Trap

A wrong choice asserts that because the auditor concluded controls are highly effective, no substantive procedures are needed for a material account. AU-C §330.18 requires substantive procedures for every relevant assertion of every material class of transactions, account balance, and disclosure regardless of assessed RMM. The most an auditor can do with strong controls is reduce the extent of substantive testing — never eliminate it.

A choice that says the auditor 'may rely solely on tests of controls' or 'is not required to perform substantive procedures because internal control is effective.'

The Inquiry-Only Test

Candidates select choices that propose 'inquiry of management' or 'discussion with the controller' as the test of controls. AU-C §330.10 makes clear that inquiry by itself is never sufficient to test operating effectiveness; it must be combined with inspection, observation, recalculation, or reperformance.

A choice describing the auditor 'inquiring of the IT manager whether system access reviews were performed' as the only step taken to test the control.

The Significant-Risk Shortcut

For significant risks, AU-C §330.22 requires substantive procedures specifically responsive to that risk, and if controls are being relied upon, those controls must be tested in the current period (not rolled forward from a prior year). Wrong choices propose using only substantive analytics, or rolling forward control testing for a fraud risk.

A choice that addresses a presumed fraud risk in revenue with only 'preliminary analytical review' or that relies on 'prior-year control test results' for the significant risk.

The Wrong Direction NTE Adjustment

As assessed RMM rises, the appropriate response is to move evidence to be more persuasive: closer to year-end (timing), more reliable in source (nature), and broader in coverage (extent). Trap choices invert one of these — performing more interim work, accepting internal evidence, or reducing sample size when risk is high.

A choice that responds to high inherent risk by 'performing more procedures at the interim date to allow for efficient scheduling.'

The Roll-Forward Confidence Trap

When substantive procedures are performed at an interim date, the auditor must perform additional procedures covering the remaining period (roll-forward). Wrong choices treat interim testing as covering year-end with no further work, especially in higher-risk environments where roll-forward is insufficient.

A choice that confirms accounts receivable at October 31 for a calendar year-end client and performs no additional year-end procedures.

How it works

Think of further procedures as a two-track response. Track one is overall responses, which color the entire engagement — staffing, supervision, skepticism, and unpredictability. Track two is the assertion-level response, where you choose between tests of controls and substantive procedures (or both) for each material account and disclosure. Suppose Reyes Manufacturing, Inc. has an assessed high RMM for the existence assertion of accounts receivable due to revenue recognition pressure. Your response: send positive confirmations to a larger sample at year-end (substantive test of details), perform substantive analytics on receivables turnover by customer segment, and — because revenue recognition is a presumed significant fraud risk under AU-C §240 — examine non-standard journal entries posted to revenue near period-end. You may also test the credit-approval and shipping controls if you intend to rely on them, but you cannot substitute control testing for the required substantive work over a material account.

Worked examples

Worked Example 1

Which of the following is the most appropriate response under AU-C §330?

  • A Test the operating effectiveness of the order-entry, credit, and shipping controls and, because those controls are well designed, omit substantive testing of fourth-quarter revenue.
  • B Perform substantive analytical procedures comparing monthly revenue to the prior year as the sole substantive response, since strong controls reduce the need for tests of details.
  • C Perform substantive procedures specifically responsive to the significant fraud risk, including examining shipping documentation and customer acceptance evidence for a sample of Q4 transactions, and test controls relied upon during the current period. ✓ Correct
  • D Rely on the prior-year tests of revenue controls, since they were found effective, and limit current-year work to inquiry of the controller about any changes in shipping arrangements.

Why C is correct: AU-C §330.22 requires that for any significant risk, the auditor perform substantive procedures specifically responsive to that risk, and that any controls being relied upon over that significant risk be tested in the current period. Because revenue recognition is a presumed fraud risk under AU-C §240, the engagement must include targeted substantive procedures (such as inspecting shipping documents and customer acceptance evidence) and current-year control testing if reliance is planned.

Why each wrong choice fails:

  • A: Substantive procedures cannot be omitted for a material assertion regardless of how effective the controls are; AU-C §330.18 requires them for every relevant assertion of every material class, balance, and disclosure. (The Controls-Replace-Substantive Trap)
  • B: For a significant risk, substantive analytics alone are not sufficient — the standard requires procedures specifically responsive to the risk, typically including tests of details. (The Significant-Risk Shortcut)
  • D: Controls relied upon to address a significant risk must be tested in the current period; prior-year results cannot be carried forward, and inquiry alone is never sufficient as a test of operating effectiveness. (The Inquiry-Only Test)
Worked Example 2

Which of the following procedures is most appropriate to address the period from November 1 through December 31?

  • A No additional procedures are required because the interim testing covered a representative sample of the population.
  • B Reperform the October 31 confirmation procedures using customer balances at December 31 to obtain a complete year-end sample.
  • C Compare the November and December receivables roll-forward to the prior year, perform substantive analytical procedures on the activity in the intervening period, and test material reconciling items between the interim and year-end balances. ✓ Correct
  • D Inquire of the credit manager whether any unusual transactions occurred during November and December and document the response in the workpapers.

Why C is correct: AU-C §330.23 requires that when substantive procedures are performed at an interim date, the auditor must perform further substantive procedures (alone or combined with tests of controls) to cover the remaining period and provide a reasonable basis for extending the audit conclusions to year-end. Substantive analytics on the roll-forward period combined with testing of material reconciling items is the standard, efficient response when there is no significant risk in the account.

Why each wrong choice fails:

  • A: Interim testing does not, by itself, provide evidence about the period from the interim date through year-end; roll-forward procedures are required. (The Roll-Forward Confidence Trap)
  • B: Reperforming the entire confirmation at year-end would be inefficient and unnecessary; the standard contemplates targeted roll-forward procedures rather than complete re-execution of interim work.
  • D: Inquiry alone is never sufficient as a substantive procedure to cover the roll-forward period; corroborating evidence such as analytics and tests of details is required. (The Inquiry-Only Test)
Worked Example 3

Which of the following statements about the planned response is most accurate?

  • A Because the assessed RMM is low and controls are effective, the auditor may conclude that no substantive procedures over payroll are required.
  • B Substantive procedures are still required for the payroll account, but their nature, timing, or extent may be reduced based on the planned reliance on controls — provided the related controls are tested in the current or, in some cases, a prior period subject to AU-C §330.14 conditions. ✓ Correct
  • C The auditor may rely on the third-party processor's SOC 1 Type 2 report as the entire substantive evidence for payroll, eliminating the need for any auditor-performed substantive procedures.
  • D Because the third party processes payroll, the auditor's responsibility is limited to confirming the year-end payable balance with the service organization.

Why B is correct: AU-C §330.18 requires substantive procedures for every relevant assertion of each material class, balance, or disclosure, regardless of assessed RMM. Reliance on effective controls (including controls at a service organization, as informed by an SOC 1 Type 2 report under AU-C §402) can reduce the nature, timing, or extent of substantive work, but cannot eliminate it. Per AU-C §330.14, controls may be tested less frequently than annually only for non-significant risks meeting specified conditions.

Why each wrong choice fails:

  • A: Strong controls and low RMM never eliminate the requirement to perform substantive procedures on a material account; they only allow the auditor to reduce extent or shift timing. (The Controls-Replace-Substantive Trap)
  • C: A SOC 1 Type 2 report provides evidence about the design and operating effectiveness of controls at the service organization, not direct substantive evidence about the user entity's account balance; the user auditor must still perform substantive procedures. (The Controls-Replace-Substantive Trap)
  • D: Use of a service organization does not reduce the user auditor's responsibility for obtaining sufficient appropriate audit evidence; the user auditor remains responsible for the audit opinion and must perform appropriate further procedures.

Memory aid

Two-track NTE: every material account gets a SUBSTANTIVE response; controls testing is OPTIONAL unless you plan to rely on the control or substantive procedures alone won't suffice. For every Significant Risk → Specific Substantive procedure (the 'SR-SS' rule).

Key distinction

Tests of controls are sometimes required (when you rely on controls or when substantive evidence alone is insufficient); substantive procedures are always required for material classes, balances, and disclosures — there is no 'controls-only' audit of a material account.

Summary

Further audit procedures must respond to assessed risks at the assertion level: substantive procedures are mandatory for every material area, tests of controls are conditional on reliance, and significant risks always demand a specifically tailored substantive response.

Practice performing further procedures and obtaining evidence adaptively

Reading the rule is the start. Working CPA Exam-format questions on this sub-topic with adaptive selection, watching your mastery score climb in real time, and seeing the items you missed return on a spaced-repetition schedule — that's where score lift actually happens. Free for seven days. No credit card required.

Start your free 7-day trial

Frequently asked questions

What is performing further procedures and obtaining evidence on the CPA Exam?

Under AU-C §330, after you assess the risk of material misstatement (RMM) at the relevant assertion level, you must design and perform further audit procedures whose nature, timing, and extent are responsive to those assessed risks. Further procedures consist of (1) tests of controls — required only when your risk assessment includes an expectation that controls operate effectively, or when substantive procedures alone cannot provide sufficient appropriate evidence — and (2) substantive procedures, which are required for all relevant assertions related to each material class of transactions, account balance, and disclosure, regardless of the assessed RMM. For every significant risk, you must perform substantive procedures that are specifically responsive to that risk, and if you intend to rely on controls that mitigate a significant risk, you must test those controls in the current period.

How do I practice performing further procedures and obtaining evidence questions?

The fastest way to improve on performing further procedures and obtaining evidence is targeted, adaptive practice — working questions that focus on your specific weak spots within this sub-topic, getting immediate feedback, and revisiting items you missed on a spaced-repetition schedule. Neureto's adaptive engine does this automatically across the CPA Exam; start a free 7-day trial to see your sub-topic mastery climb in real time.

What's the most important distinction to remember for performing further procedures and obtaining evidence?

Tests of controls are sometimes required (when you rely on controls or when substantive evidence alone is insufficient); substantive procedures are always required for material classes, balances, and disclosures — there is no 'controls-only' audit of a material account.

Is there a memory aid for performing further procedures and obtaining evidence questions?

Two-track NTE: every material account gets a SUBSTANTIVE response; controls testing is OPTIONAL unless you plan to rely on the control or substantive procedures alone won't suffice. For every Significant Risk → Specific Substantive procedure (the 'SR-SS' rule).

What's a common trap on performing further procedures and obtaining evidence questions?

Believing strong controls eliminate substantive procedures

What's a common trap on performing further procedures and obtaining evidence questions?

Treating inquiry alone as a test of controls

Related CPA Exam sub-topics

Ready to drill these patterns?

Take a free CPA Exam assessment — about 25 minutes and Neureto will route more performing further procedures and obtaining evidence questions your way until your sub-topic mastery score reflects real improvement, not luck. Free for seven days. No credit card required.

Start your free 7-day trial