CPA Quiz: Compliance Reporting
20 questions · exam conditions
0:00
Compliance ReportingQuestion 1 of 20

An issuer manufacturing company is audited under PCAOB standards, including an audit of internal control over financial reporting. The auditor identifies a control deficiency where management's compliance monitoring over environmental regulations is not designed to identify violations that could lead to material remediation liabilities, and a recent violation has occurred. Management argues the control is "operational" and not relevant to internal control over financial reporting. Which compliance reporting action should the auditor take?

Evaluate whether the deficiency represents a material weakness in internal control over financial reporting and report accordingly if it could result in a material misstatement
Ignore the deficiency because environmental compliance controls are never relevant to internal control over financial reporting
Report the deficiency only in a separate compliance report because PCAOB standards prohibit including control findings in internal control reporting
Test only substantive environmental expenditures and issue an unmodified internal control opinion if year-end balances agree to the ledger
← Back to quizzes

CPA Quiz

CPA Quiz: Compliance Reporting

Practice Compliance Reporting in CPA with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Compliance Reporting, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

An issuer manufacturing company is audited under PCAOB standards, including an audit of internal control over financial reporting. The auditor identifies a control deficiency where management's compliance monitoring over environmental regulations is not designed to identify violations that could lead to material remediation liabilities, and a recent violation has occurred. Management argues the control is "operational" and not relevant to internal control over financial reporting. Which compliance reporting action should the auditor take?

  1. Evaluate whether the deficiency represents a material weakness in internal control over financial reporting and report accordingly if it could result in a material misstatement (correct answer)
  2. Ignore the deficiency because environmental compliance controls are never relevant to internal control over financial reporting
  3. Report the deficiency only in a separate compliance report because PCAOB standards prohibit including control findings in internal control reporting
  4. Test only substantive environmental expenditures and issue an unmodified internal control opinion if year-end balances agree to the ledger
Explanation: This question tests PCAOB AS 2201 on internal control over financial reporting (ICFR), including controls over compliance that affect financial reporting. The key facts are the deficient monitoring of environmental regulations, potential material liabilities, and a recent violation, despite management's claim it's operational. Choice A is correct as AS 2201 requires evaluating deficiencies for material weakness if they could lead to material misstatements, including compliance-related controls. Choice B is incorrect because compliance controls can be relevant to ICFR if they impact liabilities per AS 2201; choice C is wrong as control findings are included in ICFR reporting under AS 2201; choice D is incorrect because substantive testing does not substitute for control evaluations per AS 2201. A judgment framework is to assess if deficiencies prevent detection of material misstatements, classifying severity accordingly. Auditors should integrate compliance risks into ICFR assessments for comprehensive reporting.

Question 2

A nonissuer manufacturing company is undergoing a financial statement audit under AICPA auditing standards. During the audit, the auditor identifies that the company failed to file required quarterly payroll tax returns and has received a notice of assessment from the taxing authority; management has recorded no liability and has not disclosed the matter, asserting it is "not probable." The potential penalties could be material, and the auditor has obtained the notice and correspondence indicating the assessment is enforceable. Which compliance reporting action should the auditor take?

  1. Issue an adverse opinion because any regulatory noncompliance requires an adverse opinion on the financial statements
  2. Communicate the matter to those charged with governance and, if the financial statements are materially misstated due to lack of accrual/disclosure, modify the audit opinion accordingly (correct answer)
  3. Perform tests of controls over payroll processing and, if controls are effective, take no further action regarding the assessment
  4. Report the noncompliance directly to the taxing authority because the auditor has a duty to inform regulators of known violations
Explanation: This question tests the auditor's responsibilities under AU-C Section 250 for consideration of laws and regulations in an audit of financial statements, specifically noncompliance that may materially affect the financial statements. The key facts are the failure to file payroll tax returns, receipt of an enforceable assessment notice with potentially material penalties, and management's refusal to accrue or disclose the matter despite it being probable and estimable. Choice B aligns with AU-C 250, which requires the auditor to communicate noncompliance to those charged with governance and modify the opinion under AU-C 705 if the financial statements are materially misstated due to inadequate accrual or disclosure. Choice A is incorrect because AU-C 705 does not mandate an adverse opinion for any noncompliance, only if the statements are materially misstated in a pervasive manner; choice C is wrong as effective controls do not negate the need to address known material noncompliance under AU-C 250; choice D is incorrect because auditors have no duty under AICPA standards to report directly to regulators unless specific laws require it. A transferable framework is to evaluate noncompliance for financial statement impact, considering probability and magnitude, and ensure appropriate disclosure or accrual per the framework. Auditors should always communicate such matters to governance and assess opinion modifications based on misstatement materiality and pervasiveness.

Question 3

An issuer company is audited under PCAOB standards. Management includes in Management's Discussion and Analysis a statement that the company "is fully compliant with all material laws and regulations," but the auditor has evidence of a material regulatory settlement reached after year-end relating to violations occurring during the year, and the settlement is disclosed in the financial statement notes. The auditor is considering responsibilities related to the other information in the annual report. Which compliance reporting action should the auditor take?

  1. Evaluate whether the statement in the other information is materially inconsistent with the audited financial statements or the auditor's knowledge obtained in the audit and respond in accordance with PCAOB other information requirements (correct answer)
  2. Ignore the statement because PCAOB standards do not address other information accompanying audited financial statements
  3. Reissue the audit report with an adverse opinion because any inaccurate compliance statement in Management's Discussion and Analysis requires an adverse opinion
  4. Communicate only to management and take no further action because other information issues are never communicated to those charged with governance
Explanation: This question tests PCAOB AS 2710 on other information in documents containing audited financial statements, like MD&A. The key facts are the inaccurate compliance statement in MD&A, contrasting with note disclosures and auditor's knowledge of the settlement. Choice A is correct as AS 2710 requires evaluating inconsistencies with statements or audit knowledge and responding accordingly. Choice B is incorrect because AS 2710 does address other information; choice C is wrong as inaccuracies do not require reissuing with adverse; choice D is incorrect because governance communication may be needed per AS 1301. A framework is to read other information for material inconsistencies and request revisions if found. Auditors should document evaluations and consider report additions if unresolved.

Question 4

A nonissuer private equity fund is audited under AICPA auditing standards. The auditor identifies that the fund failed to comply with certain limitations in its partnership agreement regarding concentration in a single investment, and the financial statements include a note stating the fund complied with all partnership agreement provisions. Management asserts the agreement is "not a regulation," so no change is needed. Which factor would most likely affect the auditor's compliance assessment?

  1. Whether the partnership agreement provisions are relevant to financial statement disclosures and whether the asserted compliance claim is materially misstated (correct answer)
  2. Whether the auditor is required to report the violation to the Securities and Exchange Commission because all funds are regulated issuers
  3. Whether the auditor can ignore the note because contractual compliance is never relevant to the audit opinion
  4. Whether control risk is always set to maximum when any contractual provision is violated, requiring a disclaimer
Explanation: This question tests AU-C Section 250 on laws and regulations, extended to contractual agreements and their financial statement implications. The key fact is the violation of partnership agreement limits, with a false compliance note, and management's claim it's not regulatory. Choice A is correct as AU-C 250 requires evaluating if violations affect disclosures and if assertions are misstated, considering materiality. Choice B is incorrect because nonissuers are not required to report to SEC unless specified; choice C is wrong as contractual compliance can be relevant if it impacts statements per AU-C 250; choice D is incorrect because violations do not automatically maximize control risk or require disclaimers. A framework is to treat significant contracts like regulations if they affect assertions. Auditors should verify notes against evidence and assess misstatement impacts.

Question 5

A nonissuer retailer is audited under AICPA auditing standards. The auditor suspects management intentionally failed to remit collected sales taxes in multiple jurisdictions, and the amounts could be material; management refuses to provide access to tax filings and related correspondence. The auditor believes the refusal is intended to conceal noncompliance. Which compliance reporting action should the auditor take?

  1. Treat the refusal as a scope limitation and consider the effect on the audit opinion; also communicate the matter to those charged with governance (correct answer)
  2. Issue an unmodified opinion because sales taxes are collected on behalf of states and do not affect financial statements
  3. Wait until after issuing the audit report to request access to the filings because timing does not affect audit evidence sufficiency
  4. Report the suspected noncompliance directly to each state tax authority as part of the auditor's standard reporting responsibilities
Explanation: This question tests AU-C Section 250 on noncompliance and AU-C 705 on scope limitations from management's restrictions. The key facts are suspected material unremitted sales taxes, refused access to evidence, and intent to conceal. Choice A is correct as AU-C 250 and 705 require treating refusals as scope limitations, evaluating opinion impact, and communicating to governance. Choice B is incorrect because taxes affect liabilities per AU-C 250; choice C is wrong as evidence is needed before reporting; choice D is incorrect because auditors do not report directly to authorities unless required. A rule is to assess restrictions for scope effects and attempt alternatives. Auditors should document and communicate to governance before modifications.

Question 6

A nonissuer health services organization engages a practitioner for an examination engagement under Statements on Standards for Attestation Engagements over management's assertion that the entity complies with a state-specific patient billing regulation. During testing, the practitioner finds exceptions indicating noncompliance that management claims are "isolated," but the practitioner cannot obtain sufficient evidence about the population affected due to incomplete records. Based on the circumstances, which compliance report modification is most appropriate?

  1. Issue an unmodified opinion because exceptions in an attestation engagement are treated as internal control deficiencies only
  2. Issue a qualified opinion or disclaim an opinion depending on whether the scope limitation and/or noncompliance is material and pervasive to the subject matter (correct answer)
  3. Issue an adverse opinion because any exception in compliance requires an adverse conclusion
  4. Convert the engagement to agreed-upon procedures and issue a findings report without management's agreement
Explanation: This question tests AT-C Section 205 on examination engagements, specifically scope limitations and material noncompliance in compliance attestations. The key facts are exceptions indicating noncompliance, inability to obtain evidence due to incomplete records, and uncertainty about pervasiveness. Choice B is correct as AT-C 205 requires a qualified or disclaimer opinion for material scope limitations or noncompliance, depending on effects. Choice A is incorrect because unmodified opinions are not issued with material exceptions per AT-C 205; choice C is wrong as adverse is for when subject matter is materially noncompliant, not any exception; choice D is incorrect because converting to agreed-upon procedures requires agreement and does not resolve issues per AT-C 215. A framework is to assess limitations and noncompliance for materiality and pervasiveness to determine opinion type. Practitioners should document evidence gaps and communicate impacts clearly in the report.

Question 7

A nonissuer hospital receives significant federal awards and engages a practitioner to perform a Single Audit under Uniform Guidance (2 CFR 200) in conjunction with an audit of the financial statements under AICPA auditing standards. During compliance testing over allowable costs for a major program, the auditor identifies unsupported costs that appear material to the program but not material to the financial statements. Management refuses to prepare a corrective action plan. What disclosure is required for this compliance issue?

  1. No reporting is required because the questioned costs are not material to the financial statements
  2. Report the finding in the Schedule of Findings and Questioned Costs and include the auditee's corrective action plan or note that it was not provided (correct answer)
  3. Modify the financial statement audit opinion to adverse because any material questioned costs require an adverse opinion on the financial statements
  4. Include the finding only in a management letter because compliance matters are not included in Single Audit reporting
Explanation: This question tests compliance auditing requirements under Uniform Guidance (2 CFR 200 Subpart F) in a Single Audit, specifically reporting findings and questioned costs. The key facts are unsupported costs material to a major program but not to the financial statements, and management's refusal to provide a corrective action plan. Choice B is correct as 2 CFR 200.516 requires reporting such findings in the Schedule of Findings and Questioned Costs, including the auditee's corrective action plan or noting its absence. Choice A is incorrect because materiality to the program requires reporting even if not material to financial statements per Uniform Guidance; choice C is wrong as questioned costs affect compliance opinions, not necessarily financial statement opinions under AU-C 935; choice D is incorrect because Single Audit standards mandate inclusion in the formal report, not just a management letter. A decision rule is to assess findings for materiality to the program and ensure all required elements, like corrective plans, are included or noted as missing. Auditors should verify findings independently and not omit them based on financial statement immateriality.

Question 8

A nonissuer nonprofit engages a practitioner to perform agreed-upon procedures under AICPA attestation standards over compliance with a grant requirement to maintain documentation for eligible participants. The practitioner identifies numerous missing participant files and management asks the practitioner to state in the report that the organization "was in compliance overall." Which compliance reporting action should the practitioner take?

  1. Provide an opinion that the organization complied overall because agreed-upon procedures reports can include overall conclusions if requested by management
  2. Describe the procedures performed and findings without providing an opinion or overall conclusion about compliance (correct answer)
  3. Convert the engagement to an examination and issue an unmodified opinion without obtaining additional evidence
  4. Withdraw and report the missing files directly to the grantor because agreed-upon procedures require external reporting of exceptions
Explanation: This question tests AT-C Section 215 on agreed-upon procedures engagements, specifically reporting requirements for compliance matters. The key facts are missing documentation exceptions and management's request for an overall compliance conclusion. Choice B is correct as AT-C 215 requires reporting procedures and findings without opinions or conclusions unless specified. Choice A is incorrect because AUP reports do not provide assurance or conclusions per AT-C 215; choice C is wrong as converting to examination requires more evidence; choice D is incorrect because AUP does not require external reporting of findings. A transferable rule is to limit reports to agreed procedures and actual findings. Practitioners should resist adding unauthorized conclusions to maintain objectivity.

Question 9

A nonissuer broker-dealer engages an auditor to perform an audit under PCAOB standards because it files reports with the Securities and Exchange Commission. During the audit, the auditor identifies that the broker-dealer did not maintain required net capital under Securities and Exchange Commission Rule 15c3-1 for several days near year-end, and management has not disclosed the deficiency. The auditor concludes the deficiency is material to regulatory reporting and may indicate a material weakness in controls. Which compliance reporting action should the auditor take?

  1. Apply AICPA auditing standards for nonissuers and issue an unmodified opinion because the entity is not an issuer
  2. Communicate the noncompliance to those charged with governance and consider implications for the auditor's report(s), including required reporting in the broker-dealer compliance report context (correct answer)
  3. Limit work to substantive testing of year-end balances because net capital is a regulatory metric and not relevant to the audit
  4. Report the deficiency only to management because governance communication is not required for regulatory noncompliance
Explanation: This question tests PCAOB Auditing Standard (AS) 6115 on reporting for broker-dealers, including compliance with net capital requirements under SEC Rule 15c3-1. The key facts are the temporary net capital deficiency, material to regulatory reporting, potential material weakness, and lack of disclosure. Choice B is correct as AS 6115 requires communicating noncompliance to governance and considering implications for the compliance report, including material weaknesses. Choice A is incorrect because PCAOB standards apply as the entity files with SEC, not AICPA for nonissuers per AS 1001; choice C is wrong as net capital is relevant and requires testing beyond substantives under AS 6115; choice D is incorrect because AS 2401 mandates governance communication for significant deficiencies. A transferable framework is to evaluate regulatory noncompliance for financial and control impacts, ensuring disclosure in relevant reports. Auditors should integrate findings into both financial and compliance opinions based on materiality.

Question 10

An issuer pharmaceutical company is audited under PCAOB standards. The auditor identifies that management recorded revenue from sales in a foreign jurisdiction without required regulatory approval to market the product, and the company may be required to refund customers. Management argues the issue is "regulatory" and therefore not relevant to revenue recognition. Which compliance reporting action should the auditor take?

  1. Evaluate whether the lack of approval affects the existence of an enforceable contract and collectability, and require adjustment/disclosure if the financial statements are materially misstated (correct answer)
  2. Treat the matter solely as a control deficiency and avoid proposing financial statement adjustments
  3. Issue a separate compliance opinion on regulatory approval as part of the standard PCAOB financial statement audit report
  4. Rely on management's representation alone because regulatory approval is outside the scope of PCAOB audits
Explanation: This question tests PCAOB AS 2405 on illegal acts and AS 2301 on revenue recognition, considering regulatory approvals. The key facts are revenue recorded without required approval, potential refunds, and management's claim it's not relevant. Choice A is correct as AS 2405 requires evaluating if noncompliance affects enforceability and collectability, requiring adjustments if misstated. Choice B is incorrect because effects extend beyond controls to statements per AS 2810; choice C is wrong as PCAOB audits do not include separate compliance opinions; choice D is incorrect because approvals are within scope if impacting revenue per AS 2301. A framework is to link compliance to assertion validity, like existence and collectability. Auditors should propose adjustments and assess materiality for opinion impacts.

Question 11

An issuer retail company is audited under PCAOB standards. A new state privacy law becomes effective during the year and requires disclosure of certain data breaches to customers and regulators within a specified timeframe; the company experienced a breach but delayed notification beyond the legal deadline. Management has accrued estimated costs but has not disclosed the noncompliance, asserting disclosure could harm the company's reputation. Which factor would most likely affect the auditor's compliance assessment?

  1. Whether the noncompliance is clearly inconsequential to the financial statements, including whether it could result in material penalties or litigation exposure (correct answer)
  2. Whether management's refusal to disclose is acceptable because reputational harm overrides disclosure requirements
  3. Whether the auditor can rely solely on internal audit's conclusion without additional procedures under PCAOB standards
  4. Whether the auditor is required to report the breach directly to the state regulator as part of the audit report
Explanation: This question tests PCAOB AS 2405 on illegal acts and AS 2810 on evaluating contingencies, focusing on noncompliance with privacy laws and disclosure requirements. The key fact is the delayed breach notification under state law, with accrual but no disclosure, despite potential material penalties or litigation. Choice A is correct as AS 2405 requires assessing if noncompliance is inconsequential, considering penalties and exposure, which affects disclosure under ASC 450. Choice B is incorrect because reputational harm does not override disclosure per ASC 450 and AS 2810; choice C is wrong as auditors cannot rely solely on internal audit without procedures per AS 2605; choice D is incorrect because PCAOB does not require direct reporting to regulators in audit reports. A framework is to evaluate noncompliance for financial impact, including contingent liabilities, regardless of management's assertions. Auditors should consider all evidence to determine if disclosures are necessary to avoid material misstatements.

Question 12

When reporting on a financial statement audit of a nonissuer conducted in accordance with Government Auditing Standards (GAGAS), the auditor's report on internal control and compliance must include which of the following?

  1. An opinion on the effectiveness of the entity's internal control over financial reporting.
  2. A description of the scope of the auditor's testing of internal control and compliance and the results of those tests. (correct answer)
  3. A statement providing positive assurance that no instances of noncompliance were identified.
  4. An assertion that the primary objective of the audit was to report on compliance matters.
Explanation: The GAGAS report on internal control over financial reporting and on compliance requires the auditor to describe the scope of their testing of internal control and compliance. It does not require an opinion on internal control (unlike an integrated audit for an issuer). The report describes findings but does not provide positive assurance on the absence of noncompliance. The primary objective of the audit is the financial statements, not compliance.

Question 13

An auditor is engaged to audit the financial statements of a nonissuer. In connection with this audit, the client requests a separate report on its compliance with certain contractual agreements. Under which of the following conditions is it appropriate for the auditor to provide negative assurance on compliance?

  1. The compliance report is intended for general distribution to the public.
  2. The auditor has issued an unmodified or qualified opinion on the financial statements. (correct answer)
  3. The auditor has identified several material instances of noncompliance.
  4. The contractual agreements have no direct relationship to the audited financial statements.
Explanation: According to AU-C 935, an auditor may provide negative assurance on compliance with specified requirements in connection with a financial statement audit only if the auditor has audited the financial statements and issued an unmodified or qualified opinion. The report is for restricted use, and negative assurance is not appropriate if material noncompliance is found.

Question 14

During a financial statement audit conducted under Government Auditing Standards, an auditor identifies a significant deficiency in internal control over compliance with provisions of a grant agreement. The auditor is required to communicate this finding in which of the following reports?

  1. The auditor's opinion on the financial statements.
  2. The written report on internal control over financial reporting and on compliance. (correct answer)
  3. A separate letter communicated only to the granting agency.
  4. The management representation letter obtained at the conclusion of the audit.
Explanation: GAGAS requires the auditor to issue a written report on internal control over financial reporting and on compliance. This report must describe the scope of testing and include any identified significant deficiencies and material weaknesses in internal control, as well as instances of fraud, noncompliance, waste, or abuse.

Question 15

Which of the following statements is unique to a report on a financial statement audit of a nonissuer performed in accordance with Government Auditing Standards and is not typically included in a standard audit report under AICPA auditing standards?

  1. A description of management's responsibility for the preparation and fair presentation of the financial statements.
  2. A reference to the separate report issued on internal control over financial reporting and on compliance. (correct answer)
  3. A section titled 'Basis for Opinion' that describes the nature of an audit.
  4. A statement that the audit was conducted in accordance with auditing standards generally accepted in the United States of America.
Explanation: When the GAGAS report on internal control and compliance is issued separately from the financial statement audit report, the financial statement audit report must include an other-matter paragraph referencing the separate GAGAS report. This reference is unique to a GAGAS audit.

Question 16

In an examination of a company's compliance with debt covenants, the practitioner was unable to obtain sufficient appropriate evidence regarding compliance with a key covenant due to restrictions imposed by the client. The potential effects are considered material and pervasive. The practitioner should issue which type of report?

  1. An unmodified opinion with a description of the scope limitation.
  2. An adverse opinion on compliance.
  3. A report disclaiming an opinion on compliance. (correct answer)
  4. A standard report, as the restriction was client-imposed.
Explanation: A client-imposed scope limitation that has a material and pervasive effect on a compliance examination prevents the practitioner from forming an opinion. The appropriate response is to disclaim an opinion on compliance. An adverse opinion is issued when material noncompliance is found, not for a scope limitation.

Question 17

An auditor's report on internal control over financial reporting and on compliance, issued for a financial statement audit under Government Auditing Standards, must contain which of the following elements?

  1. An opinion on the operating effectiveness of internal control.
  2. A statement that the auditor tested all internal controls.
  3. The definitions of material weakness and significant deficiency. (correct answer)
  4. A conclusion that the entity's system of internal control is adequate.
Explanation: To ensure that users of the report understand the terminology, GAGAS requires that the auditor's report on internal control include the definitions of a material weakness and a significant deficiency. The report does not include an opinion on internal control unless a separate examination of internal control was performed.

Question 18

In a financial statement audit of a nonissuer that is not subject to GAGAS or Single Audit requirements, what is the auditor's primary responsibility for reporting on the entity's compliance with laws and regulations?

  1. To issue a separate report providing negative assurance on compliance with all laws and regulations.
  2. To report on instances of noncompliance only if they have a direct and material effect on the amounts in the financial statements. (correct answer)
  3. To issue a qualified opinion if the entity's internal control over compliance is weak.
  4. The auditor has no responsibility for reporting on compliance in a standard financial statement audit.
Explanation: In a standard financial statement audit under AU-C, the auditor considers laws and regulations that have a direct and material effect on financial statement amounts. The auditor's responsibility is to evaluate and report on noncompliance when it materially affects the financial statements. Unlike GAGAS audits, there is no separate compliance reporting requirement, and the focus is on the financial statement impact rather than comprehensive compliance assessment.

Question 19

An auditor is reporting on financial statements prepared on a regulatory basis of accounting to meet the requirements of a government agency. The auditor concludes that the financial statements are fairly presented in accordance with that basis. The auditor's report should include an other-matter paragraph that does which of the following?

  1. Expresses a second opinion based on generally accepted accounting principles (GAAP).
  2. Disclaims an opinion on the financial statements because they do not conform to GAAP.
  3. Restricts the use of the report to the entity and the specified regulatory agency. (correct answer)
  4. Describes the regulatory basis of accounting in the Basis for Opinion section.
Explanation: When an auditor reports on financial statements prepared using a special purpose framework (such as a regulatory or contractual basis), and the framework is not suitable for general use, the auditor's report should include an other-matter paragraph restricting the use of the report to specified parties (in this case, the entity and the regulator). The description of the framework itself is in the Basis for Opinion section and an emphasis-of-matter paragraph.

Question 20

An auditor is performing a single audit on a major program. During testing, the auditor identified material noncompliance related to an eligibility requirement, which resulted in a significant number of ineligible participants receiving benefits. Management agrees with the finding but has not taken corrective action.

Based on the passage, the auditor should express which type of opinion on compliance for this major program?

  1. An unmodified opinion with an other-matter paragraph describing the noncompliance.
  2. A disclaimer of opinion.
  3. A qualified or adverse opinion. (correct answer)
  4. An unmodified opinion, as management has acknowledged the finding.
Explanation: When an auditor identifies instances of noncompliance that are material in relation to the major program being audited, the auditor must modify the opinion on compliance. Depending on the pervasiveness of the noncompliance, a qualified or adverse opinion would be appropriate. A disclaimer is for a scope limitation, and an unmodified opinion is inappropriate given the material noncompliance.