You’re on a roll
Create a free account to save your ACCA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › ACCA › Advanced Audit and Assurance
Free ACCA Advanced Audit and Assurance Practice Questions & Answers
300 exam-style Advanced Audit and Assurance questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 211
What is the 'independence' requirement for auditors and what are the main threats to it?
Select an option first.
Correct answer: B — The requirement for auditors to be free from conflicts of interest and to be perceived as such — key threats include: self-interest (financial stake in the client), self-review (reviewing one's own work), advocacy (acting as client's advocate), familiarity (close personal relationship with client), and intimidation (being pressured by the client)
Explanation: B is correct. Auditor independence (IESBA Code of Ethics / ISA 200): two dimensions — independence of mind (actual objectivity) and independence in appearance (perceived objectivity). Five threats — all reduce independence. Safeguards: quality management procedures, partner rotation, audit committee oversight, limitations on non-audit services, disclosure of threats. A: financial interests are just one threat. C: independence applies to all team members. D: independence is required for all audits.
Question 212
What is the 'self-review threat' to auditor independence and give an example?
Select an option first.
Correct answer: B — A situation where the audit firm has provided a non-audit service to the audit client, and the auditor then needs to evaluate (as part of the audit) the output of that non-audit service — the auditor cannot objectively review their own previous work. Example: the audit firm prepares the financial statements and then audits them
Explanation: B is correct. Self-review (IESBA Code): the auditor audits work they or their firm previously produced. Examples: preparing financial statements then auditing them, performing internal audit services then relying on them as external auditor, designing IT systems then testing their general controls. Safeguard: prohibit such services for audit clients (absolute prohibition for PIEs in many jurisdictions). A and C are wrong. D: applies to the entire team.
Question 213
What are 'non-audit services' and why are they restricted for audit clients?
Select an option first.
Correct answer: B — Services provided by the audit firm to its audit client other than the audit itself — restricted because they can create independence threats (particularly self-review, self-interest, and advocacy). Highly restricted or prohibited for PIEs: bookkeeping, preparing financial statements, valuation services, internal audit outsourcing, tax advisory (beyond compliance), and due diligence
Explanation: B is correct. Non-audit services (IESBA Code / FRC Ethical Standard): the 'threats and safeguards' approach — evaluate whether the non-audit service creates an unacceptable independence threat. For PIEs: absolute prohibitions (cannot be managed by safeguards) include: bookkeeping, preparing financial statements, payroll services, designing/implementing financial IT systems, valuation services (that are material and subject to significant uncertainty), internal audit, legal services. A is too broad. C is wrong. D: some non-audit services are permissible with appropriate safeguards.
Question 214
What is the 'advocacy threat' to independence and when does it arise?
Select an option first.
Correct answer: B — When the auditor promotes or represents a client's position or interests to the degree that objectivity is compromised — example: an auditor who acts as a legal advocate for a client in litigation or actively markets the client's shares cannot then provide an objective audit opinion on the same client
Explanation: B is correct. Advocacy threat: the auditor cannot objectively evaluate a position they have been promoting. Examples: acting as legal counsel, actively marketing the client's business, representing the client in tax disputes (beyond basic advice). These roles put the auditor on the client's 'side' — incompatible with objective audit judgement. A is wrong. C is the intimidation threat. D is the familiarity threat.
Question 215
What is the 'intimidation threat' to independence?
Select an option first.
Correct answer: B — When management or those charged with governance use their power to deter the auditor from exercising appropriate professional judgement — e.g., threatening to remove the audit appointment, put pressure on fees, or personally criticise the auditor in the market
Explanation: B is correct. Intimidation (IESBA Code): the auditor feels pressured to not raise issues or to accept management's preferred accounting treatment. Examples: management threatens to remove the audit contract if the auditor qualifies the report, or major shareholders threaten litigation if the auditor raises going concern doubts. Auditors should report such pressure to the firm's ethics committee and, if unresolvable, resign. A is a knowledge challenge. C is an engagement risk factor. D: resignation is a last resort.
Get the full ACCA question bank — free
Drop your email and we'll send you fresh ACCA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 216
What is the 'familiarity threat' to independence?
Select an option first.
Correct answer: B — When a long or close relationship between the auditor and the client means the auditor may become too sympathetic to the client's interests, fail to maintain professional scepticism, or cease to challenge management on significant issues — managed through: partner rotation, annual independence confirmations, peer review
Explanation: B is correct. Familiarity threat: a natural consequence of building a working relationship. The auditor may: be unwilling to challenge long-standing accounting policies, trust management's representations without sufficient evidence, or be reluctant to raise issues that might upset a well-liked client. Safeguards: mandatory rotation at 5 years (listed company partners), quality management reviews, fresh concurring partner reviews. A is wrong. C: it can arise in much shorter timeframes. D is wrong.
Question 217
What is the concept of 'materiality' in the context of ethics and independence?
Select an option first.
Correct answer: B — In the context of financial interests, a 'material' interest is one that is of significance to the auditor or the firm — the ethical codes prohibit direct financial interests in audit clients regardless of amount (no materiality threshold for financial interests). However, for some other independence considerations, significance/materiality of the relationship or the amount is relevant
Explanation: B is correct. Ethics/independence: direct financial interest (e.g., owning shares in an audit client) → prohibited regardless of size (any financial interest creates an unacceptable self-interest threat). Indirect financial interests: assessed for significance. Loans: financial institution loans are permissible if on normal commercial terms. A reverses the concept (no exemption for small interests). C is a specific (wrong) threshold. D: audit planning materiality benchmarks don't apply to ethical rules.
Question 218
What are 'group audit' challenges when using component auditors?
Select an option first.
Correct answer: B — Key challenges include: assessing the competence and independence of component auditors, ensuring that communication requirements are met (sending group audit instructions, receiving component auditor outputs), evaluating the work performed by component auditors against the group audit strategy, and dealing with different financial reporting frameworks or regulatory environments across jurisdictions
Explanation: B is correct. Group audit (ISA 600): the group engagement team must: understand the group structure, identify significant and non-significant components, direct component auditor work through group instructions, review component auditor working papers or summaries, and aggregate findings to form the group opinion. The group auditor takes overall responsibility. A: group audits are typically more complex. C: the group auditor is ultimately responsible. D is wrong.
Question 219
What is 'audit of public sector entities' and how does it differ from private sector audit?
Select an option first.
Correct answer: B — Public sector audits focus not only on financial statements but also on regularity (funds used in accordance with legislative authority), economy, efficiency, and effectiveness (the 'three Es' or value for money) — auditors also examine whether public money has been applied for its intended purposes and whether public sector bodies have complied with relevant regulations
Explanation: B is correct. Public sector audit: typically carried out by government audit bodies (e.g., National Audit Office in the UK, General Accounting Office in the US). In addition to the financial audit, public sector auditors conduct: value for money (VFM) audits, regularity audits (funds used as authorised), and performance audits. A: public sector audits are often more extensive. C: private sector firms may also audit public bodies. D is wrong.
Question 220
What is a 'value for money' (VFM) audit and what does it assess?
Select an option first.
Correct answer: B — An assessment of whether a public sector entity is achieving economy (minimising input costs), efficiency (maximising output from given inputs), and effectiveness (achieving intended outcomes) — VFM audits are common in public sector to ensure public funds are appropriately deployed
Explanation: B is correct. VFM audit (three Es): Economy: paying the right price for the right quality of inputs. Efficiency: using minimal inputs to produce maximum outputs (e.g., school performance per £ spent). Effectiveness: achieving policy goals (e.g., health outcomes per pound of NHS spending). VFM findings are used to hold government bodies accountable to taxpayers and elected representatives. A is about investment returns. C: VFM covers all three Es, not just pricing. D is private sector cost analysis.
Question 221
What is 'reporting under ISAE 3000' and how does it differ from ISA-based reporting?
Select an option first.
Correct answer: B — ISAE 3000 covers assurance engagements other than audits or reviews of historical financial information — it provides the framework for sustainability, internal control, and other assurance reports. Conclusions under ISAE 3000 are expressed either positively (reasonable assurance) or negatively (limited assurance), depending on the engagement type
Explanation: B is correct. ISAE 3000: the general standard for non-financial statement assurance. Examples: sustainability reporting assurance, compliance reports, reporting on controls at service organisations. Limited assurance: 'nothing has come to our attention to suggest...' Reasonable assurance: 'in our opinion, the sustainability report is prepared...'. Both are valid under ISAE 3000. A: they are different standards covering different subject matters. C: the level of evidence depends on the assurance level, not the standard alone. D is wrong.
Question 222
What is a 'service organisation' and how does the auditor consider it?
Select an option first.
Correct answer: B — A third-party organisation that provides services that are part of the user entity's information system (e.g., payroll processing, IT hosting, loan servicing) — the user auditor may not be able to test controls at the service organisation directly and may rely on a service auditor's report (SOC 1 / ISAE 3402 report) or perform their own procedures
Explanation: B is correct. Service organisations (ISA 402): when a client outsources a key process (e.g., payroll to ADP), the auditor must understand and evaluate those outsourced controls. The user auditor can: obtain a Type 1 or Type 2 SOC 1 (SSAE 16 / ISAE 3402) report from the service auditor, visit the service organisation, or use alternative procedures. A: they provide processing, not cleaning. C: service organisations are not always related parties. D is wrong.
Question 223
What is the role of technology in modern auditing (data analytics, AI)?
Select an option first.
Correct answer: B — Data analytics allows auditors to test entire populations of transactions rather than samples, identify anomalies and patterns that might indicate misstatement or fraud, and improve audit efficiency — AI and machine learning can assist in document analysis, risk assessment, and identifying unusual journal entries across large datasets
Explanation: B is correct. Technology in audit: whole population testing (100% of journal entries tested), predictive analytics (compare actual to expected), anomaly detection (identify unusual transactions), natural language processing (review contracts), and robotic process automation (automate routine tasks). This transforms audit from sampling-based to more comprehensive. However, professional judgement remains critical — technology supports but does not replace the auditor. A and C are wrong. D: technology adoption is spreading across firms of all sizes.
Question 224
What is 'continuous auditing' and how does it change the traditional annual audit cycle?
Select an option first.
Correct answer: B — An approach where audit procedures are performed regularly and more frequently (e.g., monthly or quarterly) rather than only at year-end — enabled by technology (real-time access to client data, automated monitoring), it allows earlier identification of issues and reduces the concentration of work at year-end
Explanation: B is correct. Continuous auditing: uses automated tools to analyse transactions on an ongoing basis. Advantages: issues identified and resolved earlier, better assurance, smoother distribution of audit effort. The annual statutory audit still culminates in a formal audit report — continuous auditing supports but doesn't replace this. A: 'continuous' relates to timing of procedures, not testing 100% of transactions in real time (though technology is moving in that direction). C and D are wrong.
Question 225
What is 'blockchain technology' and what implications does it have for auditing?
Select an option first.
Correct answer: B — A distributed ledger technology where transactions are recorded in 'blocks' and linked in a 'chain' — each transaction is immutable once recorded and verified by multiple participants. For auditing: could reduce the need for transaction verification (transactions are self-verifying), change evidence gathering approaches, and may make completeness and occurrence assertions easier to verify
Explanation: B is correct. Blockchain implications: immutable transaction record could reduce existence and occurrence risk. The audit focus may shift from transaction verification to: assessing the blockchain's control environment, ensuring only legitimate transactions are recorded, validating smart contracts, and verifying wallets and addresses. However, blockchain does not eliminate audit risk (e.g., valuation of assets on the blockchain, governance of the blockchain platform). A is wrong. C and D are wrong.
Question 226
What is 'cybersecurity' risk and how does it affect the audit?
Select an option first.
Correct answer: B — The risk that the client's information systems are compromised by a cyber attack — relevant to the audit because: a cyber breach may affect the integrity of financial data, could constitute a subsequent event, may require disclosure (e.g., a data breach), and the auditor must consider whether IT general controls are adequate to prevent data manipulation
Explanation: B is correct. Cybersecurity in audit: the auditor considers whether: the client's IT environment is secure (affecting reliance on IT-generated data), a cyber breach during or after the year affects the financial statements (going concern, potential liabilities), disclosures are adequate (GDPR breach notifications), and data used in the audit has been compromised. A: it has significant audit implications. C: relevant for all entities. D is wrong.
Question 227
What is 'greenwashing' and why is it a risk relevant to auditors providing assurance on ESG reports?
Select an option first.
Correct answer: B — The practice of making misleading claims about a company's environmental or sustainability credentials — either by overstating positive environmental practices, understating harmful activities, or presenting selective data that paints an inaccurate picture. As ESG reporting grows, the risk of greenwashing increases, making independent assurance increasingly important
Explanation: B is correct. Greenwashing risk for assurance providers: the assurance practitioner must evaluate whether: sustainability disclosures fairly represent the company's actual practices (completeness), metrics are calculated using appropriate and consistent methods (accuracy), and material negative impacts are not omitted or understated (completeness and presentation). A: greenwashing is about environmental claims, not financial records. C: it affects all sectors. D: increasingly regulated and subject to regulatory investigation.
Question 228
What is the 'financial reporting supply chain' and why is it relevant to understanding the audit's role?
Select an option first.
Correct answer: B — The sequence of parties involved in creating and verifying financial information: management prepares financial statements → those charged with governance review and approve them → the external auditor independently reviews and expresses an opinion → users (investors, lenders, regulators) rely on the audited information to make decisions. The audit provides credibility to the information used throughout this chain
Explanation: B is correct. Financial reporting supply chain: the audit is the critical credibility function in the chain. Without independent audit, users could not rely on management-prepared information with confidence. The audit bridges the information asymmetry between management (insiders) and users (outsiders). A: it includes all parties, not just accountants. C and D misuse the term.
Question 229
What is 'integrated reporting' and why is it gaining prominence?
Select an option first.
Correct answer: B — A reporting approach that communicates how a company's strategy, governance, performance, and prospects create value over the short, medium, and long term — drawing on six capitals (financial, manufactured, human, intellectual, natural, and social/relationship). Gaining prominence as investors seek a more holistic view of value creation beyond just financial metrics
Explanation: B is correct. Integrated reporting (IR Framework by IIRC): combines financial and non-financial reporting to tell a more complete story of value creation. Used by listed companies, particularly in South Africa (mandatory for JSE-listed companies) and growing globally. Auditors may be asked to provide assurance over elements of integrated reports. A: it combines financial and non-financial information. C and D are wrong.
Question 230
What is the 'audit quality review' process and how does it support the profession?
Select an option first.
Correct answer: B — A regulatory inspection process where audit regulators (e.g., the FRC's Audit Quality Review team in the UK) review completed audit files to assess whether audits were conducted in accordance with applicable standards and whether appropriate opinions were expressed — findings are publicly reported and drive improvements
Explanation: B is correct. Audit quality review (AQR): the FRC annually inspects a sample of audit engagements from major audit firms. Firms receive individual feedback and the findings are published in an annual report, which: holds audit firms accountable, drives improvements in audit quality, helps the profession understand common weaknesses, and provides transparency to investors and regulators. A and C are wrong. D: external regulation provides independence that internal reviews cannot.
Question 231
What is 'auditor liability' and what are the main limitations on it?
Select an option first.
Correct answer: B — The legal liability of auditors for losses suffered by parties who relied on negligent audit opinions — limitations include: contractual limitations in engagement letters (limited to a specific amount or period), proportionate liability (UK: auditors liable only for their share of the total loss, not the full loss), and the need to establish a 'duty of care' to the claimant
Explanation: B is correct. Auditor liability (Caparo Industries v Dickman [1990] UK): auditors owe a duty of care to the company (client) and shareholders as a class for general monitoring, but not to individual shareholders or third parties relying on audited accounts for specific transactions. Companies can negotiate liability caps with auditors. Limited liability partnerships (LLPs) protect individual partners. A: liability is limited. C: depends on jurisdiction and structure. D: following ISAs provides a defence, but not an absolute one.
Question 232
What is 'audit expectation gap' and what measures are taken to close it?
Select an option first.
Correct answer: B — The difference between what the public believes auditors do and what auditors actually do — measures to close it include: improved audit reports (key audit matters, enhanced disclosures), better education of users about the audit's scope and limitations, expanding assurance to more areas (e.g., going concern, internal controls), and increasing auditor communication during the audit process
Explanation: B is correct. Closing the expectation gap: enhanced audit reports (KAMs since ISA 701) make the audit more visible and informative. Going concern disclosures improved. Some advocate: auditor reporting on whether fraud has been considered, commentary on internal control effectiveness, or interim reporting. Education campaigns help. However, the gap may never fully close because users will always have higher expectations of auditors than the standards require. A is wrong. C: relevant for all audits. D: the gap persists.
Question 233
What is the significance of 'audit firm concentration' in the audit market?
Select an option first.
Correct answer: B — The dominance of a small number of large audit firms (the 'Big Four' and beyond) in auditing major listed companies — this creates systemic risk: if a major firm fails (like Arthur Andersen in 2002), there are limited alternatives for large clients, potentially causing market disruption. Regulators consider: requiring joint audits, mandatory use of smaller firms for non-audit services, operational separation of audit from consulting, and financial support for mid-tier firms
Explanation: B is correct. Market concentration: regulators worry about systemic risk (too few large firms for PIE audits), barriers to entry for challenger firms, and reduced competition that may impair audit quality. Initiatives: mandatory audit tendering, shared engagements, operational separation. Arthur Andersen collapse (2002) dramatically illustrated the risk. A describes M&A activity. C: concentration affects market functioning and audit quality — relevant to all stakeholders. D is wrong.
Question 234
What is 'interim financial information' and what level of assurance does the auditor provide?
Select an option first.
Correct answer: B — A review of financial information covering a period less than a full year — typically performed under ISRE 2410 (review of interim financial information performed by the entity's auditor). Provides limited assurance — conclusion expressed in negative form: 'nothing has come to our attention...' Primarily inquiry and analytical procedures
Explanation: B is correct. Interim review (ISRE 2410): common for listed companies required to produce half-year reports. Procedures: inquiry of financial reporting process, analytical review of the interim statements, review of management's estimates. Limited assurance (not full audit). The output is not an audit opinion — it is a review conclusion. A: it is a review, not a full audit. C: listed companies typically require half-year reviews. D: limited assurance < reasonable assurance.
Question 235
What is the 'Sarbanes-Oxley Act' (SOX) and what are its key auditing requirements?
Select an option first.
Correct answer: B — A US federal law enacted after major corporate accounting scandals (Enron, WorldCom) — key requirements: CEO/CFO must personally certify financial statements, mandatory internal control assessment (Section 404), enhanced auditor independence rules (more restrictions on non-audit services), criminal penalties for fraud and document destruction, and the PCAOB created to oversee US audit firms
Explanation: B is correct. SOX (2002): created in response to confidence crisis following Enron and WorldCom. Key auditing elements: s.201 (prohibited non-audit services), s.203 (partner rotation), s.301 (audit committee requirements), s.404 (internal control over financial reporting — both management assessment and auditor attestation). PCAOB: sets auditing standards for US public companies. A: it is US law. C: ISAs are the global standard (PCAOB standards apply to US listed companies separately). D: applies to all SEC registrants.
Question 236
What is 'professionalism' in the context of auditing and why is it important?
Select an option first.
Correct answer: B — A commitment to professional values including: integrity, objectivity, professional competence and due care, confidentiality, and professional behaviour — professionalism means the auditor acts in the public interest, not solely in the client's or firm's commercial interest, and maintains standards even under pressure
Explanation: B is correct. Professionalism: the audit profession serves the public interest — investors, lenders, and society rely on audited financial information. IESBA Code of Ethics: five fundamental principles (integrity, objectivity, professional competence, confidentiality, professional behaviour). A professional may need to refuse a client instruction, qualify a report, or resign rather than compromise these principles. A: following instructions that compromise ethics is unprofessional. C: important but narrower than professionalism. D: applies to all audit personnel.
Question 237
What is 'NOCLAR' (Non-Compliance with Laws and Regulations) in the context of professional accountants?
Select an option first.
Correct answer: B — An IESBA Code of Ethics provision that guides professional accountants on how to respond when they become aware of actual or suspected non-compliance with laws and regulations by a client (or employer) — the accountant must: assess the nature of the non-compliance, discuss with appropriate management/TCWG, consider disclosure requirements, and potentially report to regulators (if in the public interest and permitted)
Explanation: B is correct. NOCLAR (IESBA Section 360/Section 270): when a professional accountant identifies suspected non-compliance with laws and regulations, the response depends on: the severity of the non-compliance, who is involved, the public interest implications. Steps: discuss with management, escalate to TCWG if needed, obtain legal advice, consider whether to make disclosures in the public interest (e.g., to regulators). A: it is an ethics standard. C: resignation may be necessary but is not the first or only response. D: covers all laws and regulations.
Question 238
What is an 'ISA 800' audit (special purpose framework) and how does the report differ?
Select an option first.
Correct answer: B — An audit of financial statements prepared using a special purpose framework (not IFRS/UK GAAP) such as a cash-basis, regulatory basis, or contractual basis — the audit report is modified to: reference the special purpose framework (not GAAP), include an emphasis of matter paragraph describing the purpose and basis, and restrict distribution to intended users
Explanation: B is correct. ISA 800: the auditor understands the applicable criteria (the special purpose framework), evaluates whether the financial statements are prepared in accordance with it, and issues an opinion accordingly. Key differences in the report: opinion worded to reference the special purpose framework, emphasis of matter explaining the basis and restriction on use. A describes small company audit. C is public sector performance audit. D is wrong.
Question 239
What is an 'assurance engagement on controls' at a service organisation (ISAE 3402)?
Select an option first.
Correct answer: B — A type of engagement where an auditor reports on the controls of a service organisation that processes transactions on behalf of user entities — Type 1: reports on whether controls are suitably designed (at a point in time). Type 2: reports on whether controls are suitably designed AND operating effectively over a period
Explanation: B is correct. ISAE 3402 / SSAE 18 (US): relevant for organisations like payroll processors, cloud service providers, and IT outsourcing providers. Type 1 (design only): less assurance, used by new service organisations. Type 2 (design and effectiveness): more comprehensive, covers a period (typically 12 months) — this is what most user auditors need to place reliance on the service organisation's controls. A is wrong. C is too narrow. D: Type 2 provides reasonable assurance.
Question 240
What is a 'grant claims' assurance engagement and how does it work?
Select an option first.
Correct answer: B — An engagement where a practitioner provides assurance to a grant-giving body that the grant recipient has spent funds in accordance with the grant conditions — typically performed under ISAE 3000 or as agreed-upon procedures. The accountant verifies: expenditure against the grant conditions, achievement of specified outputs or milestones, and compliance with reporting requirements
Explanation: B is correct. Grant certification: commonly required by government bodies, EU structural funds, charities, and research councils. The accountant confirms that: expenditure meets eligible cost criteria (staff costs, materials), records are maintained, the grant was used for its intended purpose, and conditions (e.g., employment targets) were met. The report may be positive or negative assurance depending on the agreed terms. A and C are wrong. D: it is routine, not just fraud-triggered.
More free ACCA topics
Management Accounting401
Financial Accounting400
Corporate and Business Law400
Performance Management400
Financial Reporting400
Financial Management400
Strategic Business Reporting400
Advanced Financial Management400
Advanced Performance Management400
Advanced Taxation400
Business and Technology300
Taxation300
Audit and Assurance300
Strategic Business Leader300
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.