You’re on a roll
Create a free account to save your ACCA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › ACCA › Advanced Audit and Assurance
Free ACCA Advanced Audit and Assurance Practice Questions & Answers
300 exam-style Advanced Audit and Assurance questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 31
What is 'audit sampling' and what are the two main approaches?
Select an option first.
Correct answer: B — The application of audit procedures to less than 100% of items within an account balance or class of transactions — the two main approaches are statistical sampling (using probability theory to project results) and non-statistical (judgement-based) sampling. Both aim to give all items a chance of selection
Explanation: B is correct. Audit sampling (ISA 530): enables efficient testing — auditors cannot test every transaction. Statistical sampling: random selection + statistical projection of results (e.g., monetary unit sampling). Non-statistical: judgement-based selection — uses expertise but results cannot be statistically projected. C: testing only high-value items is not sampling — it is a 'targeted' or 'specific items' approach. D is wrong.
Question 32
What is 'sampling risk' and how does it differ from 'non-sampling risk'?
Select an option first.
Correct answer: B — Sampling risk: the risk that the conclusion drawn from the sample differs from the conclusion that would have been reached if the entire population was tested — it arises because only a subset is examined. Non-sampling risk: other risks of reaching a wrong conclusion (e.g., applying an inappropriate procedure, misinterpreting results)
Explanation: B is correct. Sampling risk: unavoidable when not testing 100% of items. Managed by increasing sample size (larger samples reduce sampling risk). Non-sampling risk: eliminated by proper planning, training, and supervision. A is not a correct definition. C: statistical sampling reduces and quantifies sampling risk but does not eliminate it. D: sampling risk applies to both tests of controls and substantive tests.
Question 33
What is a 'walk-through' test in the context of internal control evaluation?
Select an option first.
Correct answer: B — Following one or more transactions through the entire information system from initiation to reflection in the financial statements — used to verify the auditor's understanding of the control system and confirm that controls are designed as the auditor has described them
Explanation: B is correct. Walk-through: the auditor selects one or a few transactions and traces them step by step: from the triggering event (e.g., sales order), through processing (invoice raised, shipped, goods received), to recording (journal entries, ledger postings), and finally to the financial statements. It confirms understanding of the system and identifies where controls are applied. A is a physical inspection. C and D are other procedures.
Question 34
What is 'the risk of material misstatement' (RoMM) and how does the auditor address it?
Select an option first.
Correct answer: B — The combined risk at the financial statement and assertion levels that the financial statements contain a material misstatement — it is the product of inherent risk and control risk. The auditor responds by designing audit procedures to bring overall audit risk to an acceptably low level
Explanation: B is correct. RoMM = Inherent risk × Control risk (the risk that exists before audit procedures are applied). At the financial statement level: pervasive risks like going concern, management override. At assertion level: specific risks for each balance and disclosure. The auditor reduces audit risk to low by performing procedures that lower detection risk. A is audit risk. C is partly right but incomplete. D is wrong.
Question 35
What is 'group audit' and who is the 'group auditor' (principal auditor)?
Select an option first.
Correct answer: B — An audit of consolidated financial statements covering a parent company and its subsidiaries or components — the group auditor (principal auditor) takes responsibility for the group opinion and must direct the work of component auditors, reviewing their work and conclusions
Explanation: B is correct. Group audit (ISA 600): the group engagement partner (group auditor) is responsible for the overall audit opinion on the consolidated financial statements. Component auditors (who audit subsidiaries) provide their findings to the group auditor, who must evaluate the work performed and aggregate findings. A: this can be a feature but it's not the definition. C and D are wrong.
Get the full ACCA question bank — free
Drop your email and we'll send you fresh ACCA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 36
What is the role of the 'engagement partner' in an audit?
Select an option first.
Correct answer: B — To take overall responsibility for the audit — including the audit strategy, quality of work performed, significant judgements, and the final audit opinion. The engagement partner reviews the work of the team and must be satisfied that sufficient appropriate evidence has been gathered
Explanation: B is correct. Engagement partner (ISA 220): bears ultimate responsibility for every aspect of the audit — planning, risk assessment, evidence gathered, judgements made, and the audit report. They must review the significant judgements made by the team, consider the appropriateness of the audit opinion, and sign the audit report. A: the partner delegates work to the team. C and D are management/HR functions.
Question 37
What are 'laws and regulations' (NOCLAR) and what is the auditor's responsibility regarding them?
Select an option first.
Correct answer: B — Non-Compliance with Laws and Regulations (NOCLAR): the auditor must assess the risk of material non-compliance with laws that may affect the financial statements, perform procedures to identify material instances, and consider the implications for the audit report and disclosure requirements
Explanation: B is correct. NOCLAR (ISA 250): the auditor is not responsible for preventing non-compliance. However, the auditor must: be alert to circumstances indicating possible non-compliance, consider whether identified non-compliance is material to the financial statements, discuss with management, and consider implications (e.g., potential liabilities, contingencies, going concern). Some serious matters may require reporting to regulators (public interest). A imposes too high a responsibility. C is too broad. D is too narrow.
Question 38
What is 'related party' identification and why is it a risk area for auditors?
Select an option first.
Correct answer: B — Individuals or entities with the ability to control or significantly influence the reporting entity, including: parent companies, subsidiaries, associates, joint ventures, key management personnel, and their close family members. Related party transactions carry higher risk because they may not be at arm's length, and management may have an incentive to misstate or conceal them
Explanation: B is correct. Related parties (ISA 550): identification is important because transactions may not occur at fair market value, disclosures may be incomplete, and related parties could be used to manipulate earnings. The auditor must: obtain management representations, inspect entity records, review company law disclosures, and remain alert to undisclosed relationships. A and C are too narrow. D is wrong.
Question 39
What is 'fraud risk' and what are the two main types of fraud relevant to auditors?
Select an option first.
Correct answer: B — The two main types are: (1) fraudulent financial reporting — intentional misstatement in financial statements to deceive users (e.g., overstating revenue, understating liabilities); (2) misappropriation of assets — theft or misuse of the entity's assets by management or employees
Explanation: B is correct. Fraud risk (ISA 240): the auditor assesses risk of material misstatement due to fraud. Fraudulent financial reporting: manipulation of financial results for personal gain or to meet targets. Misappropriation: stealing cash, inventory, or information. The auditor looks for fraud risk factors (incentive, opportunity, rationalisation — the 'fraud triangle'). A: external auditors must assess fraud risk. C and D are wrong.
Question 40
What is the 'fraud triangle' and how does it help auditors identify fraud risk?
Select an option first.
Correct answer: B — A model identifying three conditions that, when present together, create an elevated risk of fraud: (1) incentive/pressure (motivation to commit fraud — financial pressures, bonus targets); (2) opportunity (weak controls that allow fraud to occur without detection); (3) rationalisation (the person's ability to justify the behaviour to themselves)
Explanation: B is correct. Fraud triangle: when all three conditions are present, fraud risk is elevated. Example: a finance director under pressure to meet profit targets (incentive) with sole authority over journal entries (opportunity) who believes they are only 'borrowing' from the company (rationalisation). Auditors use the fraud triangle to evaluate where fraud is most likely. A and C misuse the term. D: it is a concept used in audit risk assessment, not only forensics.
Question 41
What is 'money laundering' and what are auditors' obligations in relation to it?
Select an option first.
Correct answer: B — The process of making criminally-obtained funds appear legitimate — auditors may be required by law to report suspicious activities to relevant authorities (e.g., the National Crime Agency in the UK) and must not 'tip off' the suspected person. Auditors must implement anti-money laundering procedures (know-your-client, ongoing monitoring)
Explanation: B is correct. Anti-money laundering (AML) obligations: auditors in many jurisdictions are designated 'reporting entities'. They must: identify and verify clients (KYC), monitor ongoing transactions, file Suspicious Activity Reports (SARs) where required, and NOT tip off the suspect (tipping off is itself a criminal offence). A is a physical description. C is too narrow. D: tipping off is prohibited.
Question 42
What is 'corporate governance' and why is it relevant to the audit?
Select an option first.
Correct answer: B — The system of rules, practices, and processes by which a company is directed and controlled — strong corporate governance (independent boards, audit committees, internal audit, clear accountability) reduces the risk of material misstatement and supports a more reliable control environment, which the auditor considers in planning
Explanation: B is correct. Corporate governance: relevant to the audit because a strong governance framework (e.g., active audit committee, independent directors, effective internal audit) reduces audit risk. Poor governance (e.g., dominant CEO with no independent oversight) increases audit risk. Auditors report to those charged with governance (TCWG) — usually the audit committee. A and C are wrong. D: governance is relevant for any entity, especially public companies.
Question 43
What is the 'audit committee' and what is its relationship with the external auditor?
Select an option first.
Correct answer: B — A sub-committee of the board composed of independent non-executive directors, responsible for overseeing the financial reporting process, internal control, and the relationship with external and internal auditors — it appoints auditors, reviews the audit plan, receives audit findings, and monitors auditor independence
Explanation: B is correct. Audit committee: acts as an interface between the board and auditors. Recommends appointment/reappointment of auditors to shareholders, reviews audit scope and fees, receives the management letter, and considers whether auditors are maintaining independence. The auditor reports significant findings to the audit committee (those charged with governance). A is wrong. C describes audit management. D: while mandatory for listed companies in many jurisdictions, audit committees are recommended best practice more broadly.
Question 44
What is the purpose of 'quality management' standards in audit firms (ISQM 1)?
Select an option first.
Correct answer: B — To establish a system of quality management at the firm level that provides reasonable assurance that the firm and its personnel comply with professional standards, regulatory requirements, and that reports are appropriate in the circumstances — it replaces the old ISQC 1
Explanation: B is correct. ISQM 1 (International Standard on Quality Management 1): requires audit firms to design and implement a system of quality management with components including: leadership responsibilities, relevant ethical requirements, client acceptance and continuance, engagement performance, resources, information and communication, and monitoring. A is too restrictive. C and D are wrong.
Question 45
What is an 'engagement quality review' (EQR) and when is it required?
Select an option first.
Correct answer: B — An objective evaluation of the significant judgements made by the engagement team and the conclusions reached — performed by an engagement quality reviewer (not the engagement partner) before the audit report is signed. Required for audits of listed entities and when the firm's quality management system indicates it is needed
Explanation: B is correct. EQR (ISQM 2): the reviewer evaluates: significant risks identified and responses to them, judgements about materiality, engagement team's assessment of significant risks, audit evidence gathered for key areas, and the proposed audit opinion. The report cannot be dated before the EQR is complete. A reverses the roles. C is a rotation schedule (not EQR frequency). D is wrong.
Question 46
What is 'audit documentation' and what purpose does it serve?
Select an option first.
Correct answer: B — The record of audit procedures performed, evidence obtained, and conclusions reached — it provides: evidence that the audit was planned and performed in accordance with ISAs, support for the audit opinion, and a basis for quality control review and regulatory inspection
Explanation: B is correct. Audit documentation (ISA 230): working papers created by the auditor. They must be sufficient to enable an experienced auditor not previously connected with the audit to understand: the nature, timing, and extent of procedures performed, results and evidence obtained, and significant judgements and conclusions. A is client-provided documents (part of audit evidence but not the same as documentation). C and D are specific documents, not the complete set.
Question 47
What is the minimum retention period for audit documentation?
Select an option first.
Correct answer: B — Five years from the date of the audit report — audit files must be retained for the regulatory or legal retention period, which varies by jurisdiction. ISQM 1 and ISA 230 specify that documentation must be retained for at least five years for most audits (PCAOB requires seven years in the US)
Explanation: B is correct. Retention: generally 5 years (IAASB standards), 7 years (PCAOB). The audit file should be assembled within 60 days of the audit report date (final assembly date). After this, no significant changes should be made (except as part of a quality review or regulatory investigation). A is too short. C is far too short. D: 10 years applies only in specific circumstances.
Question 48
What is the significance of 'auditing standards' being 'principles-based' rather than 'rules-based'?
Select an option first.
Correct answer: B — Principles-based standards set out objectives and key principles, requiring auditors to apply professional judgement to achieve the objective in the circumstances — rules-based standards would prescribe exact steps, potentially allowing technical compliance without achieving the audit objective. Most ISAs are principles-based
Explanation: B is correct. Principles-based (ISAs): the auditor understands the objective and uses judgement to design appropriate procedures. Rules-based: the auditor follows specific prescribed steps — can lead to 'box-ticking' compliance without achieving the underlying audit objective. The principles-based approach is designed to produce better audit quality across diverse circumstances. A: principles-based requires more sophisticated judgement. C is wrong. D: principles-based is considered superior for complex, diverse environments.
Question 49
What is 'the regulatory framework' for audit in the UK and who are the key regulators?
Select an option first.
Correct answer: B — The UK audit regulatory framework involves: the Financial Reporting Council (FRC) — sets auditing standards (ISAs UK), oversees audit quality, and regulates audit firms of public interest entities (PIEs); the professional accountancy bodies (ICAEW, ACCA) — regulate their members; and the government — sets company law requirements for audit
Explanation: B is correct. UK framework: FRC (Audit Regulation) — responsible for audit of PIEs, sets UK auditing standards, conducts Audit Quality Review (AQR). Professional bodies (ICAEW, ACCA, ICAS, CIPFA): regulate non-PIE auditors and monitor compliance. Companies Act 2006: sets statutory requirements for audit. A and C are too narrow. D: the IAASB issues ISAs which are adopted/adapted by the FRC, but the IAASB does not directly regulate UK firms.
Question 50
What is a 'Public Interest Entity' (PIE) and why does its classification matter for audit?
Select an option first.
Correct answer: B — An entity that has public importance — in the UK: listed companies, credit institutions (banks), and insurance companies. PIEs face stricter audit requirements: mandatory audit firm rotation, restrictions on non-audit services, enhanced quality reviews, and disclosure of audit fees in annual reports
Explanation: B is correct. PIE classification matters because: increased public interest in the reliability of their financial information justifies stricter auditor independence rules, mandatory firm rotation (every 10 years in the UK, with the option to re-tender every 5 years), restrictions on what non-audit services the auditor can provide, and enhanced regulator oversight. A: PIEs include private banks and insurers, not just listed companies. C and D are wrong.
Question 51
What is 'audit firm rotation' for Public Interest Entities?
Select an option first.
Correct answer: B — The requirement to change the audit firm after a specified maximum tenure — in the UK: mandatory rotation after 20 years (with a public tender required at 10 years). In the EU: mandatory rotation after 10 years. Designed to preserve auditor independence by preventing overly long relationships
Explanation: B is correct. Audit firm rotation: different from partner rotation (which occurs every 5 years for PIEs). Firm rotation: the entire firm is replaced. Rationale: very long relationships with a client may compromise independence (familiarity threat). Some argue rotation is costly and reduces audit quality in the short term. A describes partner rotation (shorter period). C and D are wrong.
Question 52
What are 'written representations' and what is their role as audit evidence?
Select an option first.
Correct answer: B — Written statements obtained from management confirming specific matters — used to supplement other audit evidence, not replace it. They are required for: confirmation that management has fulfilled its responsibility for the financial statements, that all transactions have been recorded, and regarding specific matters where other evidence is limited
Explanation: B is correct. Written representations (ISA 580): management representations are audit evidence — but of a lower quality (they are not independent). Used for: confirming that all relevant information has been provided to the auditor, management's assessment of going concern, disclosure of all known related parties. If management refuses to provide representations: qualified or disclaim opinion. A is the financial statements. C is third-party confirmations (different). D is the audit report.
Question 53
What is the purpose of obtaining audit evidence about 'opening balances' in an initial engagement?
Select an option first.
Correct answer: B — In a first-year audit, the incoming auditor must obtain sufficient evidence about opening balances to confirm they are correctly stated and that accounting policies have been consistently applied — if prior year was audited, review predecessor's working papers. If not audited, perform additional procedures on opening balances
Explanation: B is correct. Opening balances (ISA 510): the incoming auditor must verify that: opening balances reflect appropriate accounting policies applied consistently, and that misstatements in opening balances do not materially affect current period statements. Methods: review prior auditor's report and working papers, perform current period procedures that provide evidence about opening positions, and test current period amounts for comparative information. A is wrong. C and D are too narrow.
Question 54
What is 'comparative information' in financial statements and what are the auditor's responsibilities?
Select an option first.
Correct answer: B — Prior period figures presented alongside current period figures — the auditor must determine whether the comparative information: has been correctly restated if there were prior period errors, reflects the same accounting policies as the current year, and is in agreement with the prior year audited figures
Explanation: B is correct. Comparatives (ISA 710): the auditor considers whether: comparatives agree to prior year financial statements, accounting policies have been applied consistently, prior period adjustments are properly presented and disclosed. If there are material inconsistencies in the comparative figures, the auditor considers whether the current year figures are also affected. A is too narrow. C and D are wrong.
Question 55
What is 'subsequent events' review and what is the 'active period' for the auditor?
Select an option first.
Correct answer: B — The review of events occurring after the reporting period but before the audit report is signed — the auditor has an active duty to identify and evaluate such events. Events after the audit report is signed are also relevant if the auditor becomes aware of a fact that would have caused them to modify the report
Explanation: B is correct. Subsequent events (ISA 560): two types — adjusting (provide additional evidence of conditions existing at the reporting date, e.g., settlement of a legal case confirming a year-end liability) and non-adjusting (arise after reporting date but are significant enough to require disclosure, e.g., a major acquisition, natural disaster). Active period: reporting date to audit report date. After report: no active duty but must act if material facts become known. A, C and D are wrong.
Question 56
What is 'two-stage planning' in an audit and what happens in each stage?
Select an option first.
Correct answer: B — Stage 1: preliminary engagement activities — accepting or continuing the engagement, assessing independence, assigning the team. Stage 2: developing the audit strategy and plan — understanding the entity, assessing risks, setting materiality, designing procedures. Planning is updated as the audit progresses
Explanation: B is correct. Two stages of planning: (1) Engagement acceptance: independence check, ethical requirements, competence, predecessor auditor communication. (2) Strategy and plan: understand the entity and its environment, assess risks, set materiality, design responses to risks. Both stages must be completed before fieldwork begins, and the plan must be updated if circumstances change. A: planning is updated throughout. C and D are wrong.
Question 57
What is 'risk assessment procedures' and how do they differ from audit procedures that respond to risks?
Select an option first.
Correct answer: B — Risk assessment procedures (ISA 315) are performed to understand the entity and identify risks of material misstatement — they include: inquiries, observations, inspections of documents, and analytical procedures. They do not themselves provide audit evidence to support the audit opinion. Procedures that respond to risks (tests of controls, substantive procedures) gather the actual evidence
Explanation: B is correct. ISA 315 risk assessment: the output is a list of identified and assessed risks of material misstatement. The input to: ISA 330 (responses to assessed risks) which designs tests of controls and substantive procedures to address those risks. The risk assessment procedures do not test whether balances are correct — they identify where risk lies. A conflates the two. C is wrong. D: risk assessment begins early but continues throughout.
Question 58
What is 'audit risk at the financial statement level' vs 'audit risk at the assertion level'?
Select an option first.
Correct answer: B — Financial statement level risks are pervasive risks that affect the financial statements as a whole (e.g., going concern risk, management override, fraud risk due to a poor control environment) — they require an overall response such as assigning more experienced staff. Assertion level risks relate to specific classes of transactions, balances, or disclosures and require targeted procedures for each assertion
Explanation: B is correct. ISA 315: two levels. FS level: pervasive (affects many assertions/accounts) — respond with: overall strategy, assign senior staff, increase unpredictability of procedures, communicate with management more. Assertion level: specific (affects one account/assertion) — respond with: targeted tests of controls or substantive procedures for that specific assertion. A: both levels are important. C is wrong. D is wrong.
Question 59
What is 'unpredictability' in the context of audit procedures and why does it matter?
Select an option first.
Correct answer: B — Varying the nature, timing, and extent of audit procedures so they are not predictable by management or employees — important to reduce the risk that management or employees can manipulate records specifically at times or in areas they know will be tested
Explanation: B is correct. Unpredictability (ISA 240): designed to address the risk that employees who know the audit programme might manipulate results specifically to pass audit tests. Techniques: change the timing of inventory counts, perform surprise cash counts, select different items each year, vary the accounts tested during interim visits. A is wrong. C: interim testing introduces useful unpredictability. D: ISA 240 requires unpredictability in all audits, not just where fraud is known.
Question 60
What is 'information technology risk' in the context of audit planning?
Select an option first.
Correct answer: B — The risk that the client's IT systems contain errors that affect the accuracy or completeness of financial data, or that IT systems are compromised in a way that allows manipulation of data — higher IT risk increases the auditor's focus on IT general controls and automated application controls
Explanation: B is correct. IT risk: affects the reliability of computer-generated records and reports. Key areas: completeness and accuracy of automated processing, integrity of data in databases, access controls (who can change financial data), and the reliability of IT-generated analytical reports used by management. The auditor assesses IT general controls (ITGCs) and, if satisfactory, can rely on automated application controls. A and D are wrong. C: IT risk exists regardless of the type of software.
More free ACCA topics
Management Accounting401
Financial Accounting400
Corporate and Business Law400
Performance Management400
Financial Reporting400
Financial Management400
Strategic Business Reporting400
Advanced Financial Management400
Advanced Performance Management400
Advanced Taxation400
Business and Technology300
Taxation300
Audit and Assurance300
Strategic Business Leader300
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.