You’re on a roll
Create a free account to save your ACCA progress, track your accuracy by topic, and pick up right where you left off.
Free Questions › ACCA › Audit and Assurance
Free ACCA Audit and Assurance Practice Questions & Answers
300 exam-style Audit and Assurance questions. Pick your answer, hit Check answer, and see the worked solution — free to start, no signup.
100% free · No login to startQuestion 91
What is the 'control objectives' approach to understanding internal controls?
Select an option first.
Correct answer: B — An approach where the auditor identifies what each business process aims to achieve (e.g., all purchases should be authorised, all receipts banked promptly) and then assesses whether the existing controls are sufficient to achieve those objectives — identifying gaps or weaknesses
Explanation: B is correct. Control objectives (e.g., for the purchase system: completeness, accuracy, authorisation, recording, payment) provide a structured way of evaluating the sufficiency of controls. The auditor first determines what needs to be achieved, then assesses whether existing controls are adequate. Gaps between objectives and controls = potential weaknesses. A, C and D mischaracterise the approach.
Question 92
What is 'non-sampling risk' and how can it be mitigated?
Select an option first.
Correct answer: B — The risk of audit error that is not related to sample selection — including: applying an inappropriate procedure, misinterpreting evidence, failing to recognise a misstatement, or drawing incorrect conclusions. Mitigated by: proper training, appropriate supervision, quality review, and clear audit programmes
Explanation: B is correct. Non-sampling risk (ISA 530) covers all audit risks other than sampling risk: wrong procedure (e.g., testing existence when completeness is the risk), misreading a document, overlooking an error, or incorrectly evaluating an exception. These are human errors mitigated by training, supervision, EQR, and cold reviews. A, C and D mischaracterise non-sampling risk.
Question 93
What is 'related service' and how does it differ from an assurance engagement?
Select an option first.
Correct answer: B — A professional service where no assurance is provided — including agreed-upon procedures (factual findings reported, no conclusion) and compilation engagements (accounts assembled from management's data, no verification). Differs from assurance engagements because no opinion or conclusion is expressed
Explanation: B is correct. ISRS: related services are on the lower end of the assurance spectrum — no assurance at all. Agreed-upon procedures: report what was found, users interpret. Compilation: assemble accounts without verification. These contrast with assurance engagements (limited or reasonable assurance) where a conclusion is expressed. A, C and D are incorrect.
Question 94
What is 'substantive vs controls approach' to the payroll audit?
Select an option first.
Correct answer: B — With a controls approach, the auditor tests payroll controls (authorisation of pay rates, joiners/leavers procedures, segregation) and if effective, reduces substantive testing. With a substantive approach, the auditor bypasses control testing and tests individual transactions directly — recalculating pay, agreeing to bank transfers, tracing to HR records
Explanation: B is correct. The choice depends on efficiency and risk: strong controls → test controls, reduce substantive work. Weak or untestable controls → go directly to substantive testing. For payroll, both approaches are common — the auditor makes a cost-benefit assessment. A, C and D are incorrect.
Question 95
What is 'documentation completeness' and why does the standard state that what is not documented was not done?
Select an option first.
Correct answer: B — The principle that audit documentation must be complete enough for an experienced auditor not involved in the engagement to understand what was done and why — undocumented procedures cannot be assumed to have been performed, as there is no evidence they existed
Explanation: B is correct. ISA 230: documentation is the primary evidence of audit work. If something is not documented, from the perspective of any reviewer (quality review, regulator, court), it may as well not have been done. This drives the requirement to document all significant matters, not just procedures performed. A, C and D mischaracterise the principle.
Get the full ACCA question bank — free
Drop your email and we'll send you fresh ACCA practice questions, fully worked solutions and exam-deadline reminders. No spam — unsubscribe in one click.
Want to save your score and take a full mock exam? Create a free account →
Question 96
What is an internal control system and what objectives does it serve?
Select an option first.
Correct answer: B — Policies, procedures, and processes established by management to achieve objectives related to reliable financial reporting, effective and efficient operations, and compliance with applicable laws
Explanation: B is correct. Internal controls (ISA 315 / COSO framework) serve three broad categories: financial reporting reliability, operational efficiency, and regulatory compliance. They are established by management/those charged with governance — not auditors. A, C and D mischaracterise internal controls.
Question 97
What are the five components of internal control in the COSO framework?
Select an option first.
Correct answer: B — Control environment, risk assessment, control activities, information and communication, and monitoring of controls
Explanation: B is correct. COSO's five components: (1) Control environment — tone at the top, culture; (2) Risk assessment — identifying and analysing risks; (3) Control activities — preventive and detective controls; (4) Information and communication — accurate data flow; (5) Monitoring — ongoing assessment of control effectiveness. A, C and D are not the COSO components.
Question 98
What is the 'control environment' and why is it considered the foundation of internal control?
Select an option first.
Correct answer: B — The overall attitude, awareness, and actions of the board and management regarding internal control — setting the tone for the organisation and influencing the control consciousness of its people
Explanation: B is correct. The control environment is the 'tone at the top' — it reflects management's commitment to integrity, ethical values, and competence. A weak control environment undermines all other controls, regardless of how well they are designed. A, C and D are other COSO components, not the control environment.
Question 99
What is 'segregation of duties' and why is it an important internal control?
Select an option first.
Correct answer: B — Ensuring that no single individual can authorise, execute, record, and maintain custody of assets in a transaction — separating these functions reduces the ability of one person to commit and conceal fraud
Explanation: B is correct. Effective segregation separates: authorisation (approving transactions), recording (booking to ledger), custody (holding assets), and reconciliation. A single person controlling all four could commit fraud and conceal it. A, C and D mischaracterise segregation of duties.
Question 100
What is the difference between a 'preventive control' and a 'detective control'?
Select an option first.
Correct answer: B — Preventive controls aim to stop errors or fraud from occurring; detective controls aim to identify errors or fraud that have already occurred
Explanation: B is correct. Preventive: authorisation requirements, access controls, segregation of duties — designed to stop misstatements. Detective: reconciliations, audit logs, variance analysis, internal audit — designed to identify problems after the fact. A is not necessarily true. C reverses the concepts. D ignores a meaningful distinction.
Question 101
What is an 'authorisation control' and give an example?
Select an option first.
Correct answer: B — A control requiring transactions to be approved by an appropriate person before they are processed — for example, a manager approving purchase orders above a defined value
Explanation: B is correct. Authorisation controls ensure transactions are genuine and appropriate. Examples: credit approval before sales on account, manager sign-off on expense claims, board approval for capital expenditure. A is too restrictive — not all transactions need board approval. C is a specific example. D is a physical control.
Question 102
What is a 'reconciliation' and how does it function as an internal control?
Select an option first.
Correct answer: B — A comparison of two or more sets of data to ensure they agree — differences are investigated and corrected, providing assurance that records are complete and accurate
Explanation: B is correct. Reconciliations are detective controls — e.g., bank reconciliations compare cash book to bank statements; debtor ledger reconciliation compares individual accounts to the control account. Regular reconciliation identifies errors, fraud, or mispostings. A, C and D mischaracterise reconciliation.
Question 103
What is an 'internal control questionnaire' (ICQ) and how does it differ from an internal control evaluation questionnaire (ICEQ)?
Select an option first.
Correct answer: B — An ICQ asks whether specific controls exist; an ICEQ evaluates whether controls are operating effectively enough to prevent or detect material misstatements
Explanation: B is correct. ICQ: 'Does the company do X?' — existence of controls. ICEQ: 'Do controls prevent/detect key errors?' — effectiveness. Both are methods of documenting the understanding of internal controls alongside narrative notes and flowcharts. A reverses the relationship. C and D are incorrect.
Question 104
What are the advantages of using a flowchart to document an accounting system?
Select an option first.
Correct answer: B — Flowcharts give a comprehensive overview of the system in one visual diagram, use standard symbols for controls making gaps easy to identify, and are easier to understand than lengthy narrative descriptions for complex systems
Explanation: B is correct. Advantages of flowcharts: visual overview, standard symbols highlight controls, systematic — easy to spot missing controls. Disadvantages: difficult to amend (may require redrawing), complex systems are hard to depict, need supplementary narrative notes. A, C and D overstate or misstate the advantages.
Question 105
What is a 'walk-through test' and what is its purpose?
Select an option first.
Correct answer: A — A test performed by tracing a single transaction through the entire accounting system from initiation to recording — confirming the auditor's understanding of the system and whether controls exist as described
Explanation: A is correct. A walk-through involves selecting one transaction type and following it from initiation through the entire process to the financial statements — confirming the auditor's documented understanding of the system and verifying controls exist. B is observation. C is test data. D is substantive testing.
Question 106
What are 'general IT controls' (GITCs) and why are they important?
Select an option first.
Correct answer: B — Controls over the IT environment as a whole — including access management, change management, operations, and physical security — which underpin the reliability of application controls and therefore all IT-based audit evidence
Explanation: B is correct. GITCs apply across all systems and include: logical access controls (passwords, authentication), change management (testing changes before live implementation), IT operations, and physical security. Weak GITCs undermine all application controls and data reliability — meaning the auditor cannot rely on system-generated reports. A and D describe application controls. C is a specific security matter.
Question 107
What are 'application controls' in IT auditing?
Select an option first.
Correct answer: B — Controls embedded within specific business applications to ensure the completeness, accuracy, and authorisation of data — examples include input validation, sequence checks, and automated matching
Explanation: B is correct. Application controls operate within specific systems (e.g., payroll, purchase ledger). Examples: validation checks (data type, range, field), sequence checks (no gaps in invoice numbers), automated three-way matching (PO, GRN, invoice). A describes GITCs. C and D are not application controls.
Question 108
What are the inherent limitations of any internal control system?
Select an option first.
Correct answer: B — Human error, collusion between employees, management override, the potential for controls to become outdated, and the cost-benefit constraint on implementing controls
Explanation: B is correct. All control systems have inherent limitations: humans make mistakes (carelessness, fatigue), two or more people may collude to circumvent controls, management can override controls, circumstances may change making controls obsolete, and perfect control is too expensive. A and C are incorrect. D is wrong — IT controls have their own limitations.
Question 109
What are the control objectives of a purchase/creditor system?
Select an option first.
Correct answer: B — To ensure: orders are only placed for genuine business needs; goods received match orders; only valid invoices are recorded; all purchases are accurately recorded; liabilities are paid promptly and only when authorised
Explanation: B is correct. Purchase system control objectives include: only necessary goods/services ordered, orders authorised, goods received match orders, invoices matched to GRNs and POs, invoices recorded completely and accurately at correct amounts, payments made only to valid suppliers with proper authorisation. A, C and D are too narrow.
Question 110
What are the control objectives of a payroll system?
Select an option first.
Correct answer: B — To ensure: only valid employees are on the payroll; pay rates are correctly authorised; deductions are correctly calculated; net pay is accurately transferred to the correct bank accounts; payroll is completely and accurately recorded
Explanation: B is correct. Payroll controls must prevent: ghost employees (fictitious people on payroll), incorrect pay rates, incorrect tax/NIC deductions, misdirected payments (to wrong accounts), and unrecorded payroll costs. Payroll fraud is significant because cash is disbursed directly. A, C and D are too narrow.
Question 111
What is 'audit evidence' and what characteristics make it sufficient and appropriate?
Select an option first.
Correct answer: B — Information used by the auditor to draw conclusions on which the audit opinion is based — sufficiency measures quantity (enough evidence); appropriateness measures quality (relevance and reliability)
Explanation: B is correct. ISA 500: sufficient = enough quantity of evidence; appropriate = the right quality (relevant to the assertion tested and reliable). The auditor uses professional judgement to determine when enough appropriate evidence has been obtained. A is too narrow. C and D are incorrect.
Question 112
What factors affect the reliability of audit evidence?
Select an option first.
Correct answer: B — External evidence is more reliable than internal; original documents more reliable than photocopies; direct auditor observation more reliable than inquiry; documentary evidence more reliable than oral evidence; internal evidence more reliable when controls are strong
Explanation: B is correct. ISA 500 reliability principles: (1) external > internal; (2) direct auditor evidence > indirect; (3) documentary > oral; (4) original > copy; (5) from entity with strong controls > weak controls. A, C and D are incorrect — management-provided evidence is less reliable; electronic can be manipulated.
Question 113
What is 'inspection of records or documents' as an audit procedure?
Select an option first.
Correct answer: B — Examining documents or records, whether internal or external, in any format — providing evidence about their existence, accuracy, and the rights of the entity
Explanation: B is correct. Inspection of records includes reviewing invoices, contracts, bank statements, ledger entries, board minutes, and other documents. It provides evidence relevant to several assertions. A is physical inspection of assets (a different procedure). C is observation. D is analytical procedures.
Question 114
What is 'observation' as an audit procedure and what are its limitations?
Select an option first.
Correct answer: B — Looking at a process or procedure being performed by others — its main limitation is that behaviour may change when people know they are being watched (the Hawthorne effect)
Explanation: B is correct. Observation (ISA 500) provides evidence that a procedure is performed — e.g., observing inventory count, observing authorisation procedures. The key limitation is that it only provides evidence of what happens at the time of observation, not routinely. A, C and D describe other procedures.
Question 115
What is 'external confirmation' and what is the difference between a positive and negative form?
Select an option first.
Correct answer: B — A direct written response to the auditor from a third party — positive form requires the third party to respond whether or not they agree; negative form requests a response only if they disagree
Explanation: B is correct. ISA 505: external confirmations (e.g., bank letters, debtor circulars, lawyer letters) are reliable because they come directly from independent third parties. Positive = reply always required (blank form avoids complacency). Negative = reply only if disagreeing (lower reliability but used in low-risk situations). A, C and D are incorrect.
Question 116
When should an auditor use a positive confirmation request for receivables rather than a negative one?
Select an option first.
Correct answer: B — When individual balances are material, inherent risk or control risk is high, or there is reason to believe some customers may disagree — requiring a definitive response
Explanation: B is correct. Positive confirmations are used when: balances are large/material, risk is high, or the auditor expects disagreements. They require a response, providing stronger evidence. Negative confirmations suit low-risk, large populations with small balances. A describes when negative is appropriate. C and D are wrong.
Question 117
What alternative procedures should the auditor perform if a debtor does not respond to a positive confirmation request?
Select an option first.
Correct answer: B — Examine subsequent cash receipts from the debtor, inspect supporting documentation (sales orders, delivery notes, invoices), and perform cut-off testing of sales near the year-end
Explanation: B is correct. ISA 505: if a positive confirmation is not returned, the auditor performs alternative procedures to gather evidence about the balance — primarily subsequent receipts (strong evidence the debt existed and was collectible), inspection of original documents, and cut-off testing. A, C and D do not represent proper audit responses.
Question 118
What is 'recalculation' as an audit procedure?
Select an option first.
Correct answer: B — The auditor independently checking the mathematical accuracy of documents or records — confirming computations are arithmetically correct
Explanation: B is correct. Recalculation (ISA 500) tests arithmetic accuracy — e.g., recalculating depreciation, casting (adding up) schedules, checking invoice totals, verifying tax computations. It tests the accuracy assertion. A is management's task. C and D describe other procedures.
Question 119
What is 're-performance' as an audit procedure?
Select an option first.
Correct answer: B — The auditor independently executing procedures or controls that were originally performed by the entity — testing whether they were done correctly
Explanation: B is correct. Re-performance (ISA 500) involves the auditor independently performing the same process as the entity — e.g., independently preparing a bank reconciliation, re-casting a schedule, or re-performing an inventory valuation. This tests whether the entity's control/procedure functions correctly. A is not re-performance. C and D are incorrect.
Question 120
What is 'inquiry' as an audit procedure and what are its limitations?
Select an option first.
Correct answer: B — Seeking information from knowledgeable persons within or outside the entity — its main limitation is that inquiry alone does not provide sufficient appropriate evidence and responses may be biased or incorrect
Explanation: B is correct. Inquiry (ISA 500) includes formal and informal questioning of management, staff, and others. It is widely used and efficient, but the auditor cannot rely solely on inquiries — they must be corroborated by other evidence. Responses may be deliberately misleading or simply incorrect. A confuses with legal processes. C is external confirmation. D is internal audit.
More free ACCA topics
Management Accounting401
Financial Accounting400
Corporate and Business Law400
Performance Management400
Financial Reporting400
Financial Management400
Strategic Business Reporting400
Advanced Financial Management400
Advanced Performance Management400
Advanced Taxation400
Business and Technology300
Taxation300
Strategic Business Leader300
Advanced Audit and Assurance296
Ten questions in
- The ones you miss are saved as a drill you can repeat
- Your place is kept, on this device and any other
- A streak, if that is the thing that gets you back tomorrow
Every question on this page stays free and open either way.