> For the complete documentation index, see [llms.txt](https://doc.montoyer.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.montoyer.com/competitions/epso-ad-428-26/qcm-epso-ad-428-26/qcm-a.md).

# QCM A

30 items · 40 minutes · pass mark 15/30 · no negative marking, so answer everything.

{% hint style="info" %}
Set a timer for 40 minutes and work straight through. Open an answer only after you have committed to your own, and keep a tally as you go — GitBook cannot score this for you.
{% endhint %}

**1. (Q1)** In audit planning, the *audit universe* is best described as:

* **A.** The complete population of auditable entities, processes, systems and themes falling within the audit function's mandate.
* **B.** The set of engagements approved for execution in the current year.
* **C.** The population of transactions from which the audit sample is drawn.
* **D.** The register of risks that management has formally decided to accept.

***

**2. (Q4)** Which practice most directly anchors a strategic audit plan in the organisation's objectives?

* **A.** Allocating audit days in proportion to each directorate's headcount.
* **B.** Deriving candidate audit topics from the risks that threaten achievement of the organisation's stated strategic objectives.
* **C.** Repeating the topics of the previous plan to allow year-on-year comparison.
* **D.** Selecting topics that the audit function has the strongest existing expertise in.

***

**3. (Q7)** Audit resources are insufficient to cover all areas assessed as high risk. The most appropriate response when submitting the annual plan is to:

* **A.** Present the plan together with an explicit statement of the high-risk areas left uncovered and the resulting assurance gap.
* **B.** Lower the risk scores of the areas that cannot be covered so the plan appears complete.
* **C.** Cover all high-risk areas with reduced-scope engagements regardless of whether meaningful conclusions can be drawn.
* **D.** Defer the uncovered areas without comment and address them in the following year's plan.

***

**4. (Q10)** The main purpose of *assurance mapping* at the planning stage is to:

* **A.** Record which managers have accepted which risks.
* **B.** Establish the audit function's independence from management.
* **C.** Identify overlaps and gaps in the assurance provided by the different assurance providers, so audit effort is placed where assurance is missing.
* **D.** Demonstrate that all controls in the organisation have been tested at least once.

***

**5. (Q13)** Which combination correctly states the dimensions examined in a *performance audit*?

* **A.** Legality, regularity and transparency.
* **B.** Accuracy, completeness and cut-off.
* **C.** Economy, efficiency and effectiveness.
* **D.** Relevance, coherence and EU added value only.

***

**6. (Q16)** Under Article 287 TFEU, the European Court of Auditors provides the European Parliament and the Council with:

* **A.** A statement of assurance on the reliability of the accounts and on the legality and regularity of the underlying transactions.
* **B.** A binding decision on the discharge of the budget.
* **C.** A certificate of conformity for each Member State's paying agencies.
* **D.** An annual opinion on the Commission's staff policy.

***

**7. (Q19)** The eight core principles of the independence of supreme audit institutions are set out in:

* **A.** INTOSAI-P 1 (Lima Declaration).
* **B.** ISSAI 130 (Code of Ethics).
* **C.** INTOSAI-P 12 (Value and Benefits of SAIs).
* **D.** INTOSAI-P 10 (Mexico Declaration).

***

**8. (Q22)** Under the Financial Regulation, *shared management* means budget implementation:

* **A.** By Commission departments or executive agencies directly.
* **B.** Through financial instruments managed by the European Investment Bank.
* **C.** Entrusted to third countries, international organisations or other entrusted entities.
* **D.** Entrusted to the Member States.

***

**9. (Q25)** The audit risk model expresses audit risk as a function of:

* **A.** Inherent risk, control risk and detection risk.
* **B.** Inherent risk, residual risk and sampling risk.
* **C.** Business risk, fraud risk and reputational risk.
* **D.** Strategic risk, operational risk and compliance risk.

***

**10. (Q28)** The primary purpose of a walkthrough at the start of an engagement is to:

* **A.** Obtain sufficient appropriate evidence on the operating effectiveness of controls.
* **B.** Quantify the financial error in the population.
* **C.** Confirm the auditor's understanding of the process and of how controls are designed to operate.
* **D.** Satisfy the documentation requirement for the engagement file.

***

**11. (Q31)** Running a pilot test on a small number of items before executing the full programme is done mainly to:

* **A.** Validate that the procedure and the criteria work in practice, and refine them before committing the full resource.
* **B.** Reduce the final sample size required.
* **C.** Give the auditee advance notice of the testing approach.
* **D.** Establish the projected error rate for the population.

***

**12. (Q34)** Which source generally provides the most reliable audit evidence?

* **A.** A written confirmation obtained by the auditor directly from an independent third party.
* **B.** A schedule prepared by the auditee from its own accounting system.
* **C.** An oral explanation from the process owner.
* **D.** An internal memorandum recording a management decision.

***

**13. (Q37)** Stratifying a population before sampling primarily serves to:

* **A.** Increase the total sample size.
* **B.** Allow the auditor to exclude low-value items from the population.
* **C.** Group items with similar characteristics so as to reduce variability within each stratum and improve the efficiency of the sample.
* **D.** Convert a statistical sample into a judgemental one.

***

**14. (Q40)** Applying Benford's law to a large payments dataset is a technique for:

* **A.** Confirming the completeness of the population.
* **B.** Calculating the projected error rate.
* **C.** Screening for anomalous distributions of leading digits that may indicate manipulated or fabricated figures.
* **D.** Testing the segregation of duties in the payment process.

***

**15. (Q43)** Audit documentation is adequate when it enables:

* **A.** The engagement to be completed within the time budget.
* **B.** An experienced auditor with no previous connection to the engagement to understand the work performed, the evidence obtained and the conclusions reached.
* **C.** The auditee to reproduce the auditor's tests.
* **D.** The audit file to be archived in the shortest possible form.

***

**16. (Q46)** A fully developed audit finding comprises:

* **A.** Criteria, condition, cause and effect.
* **B.** Objective, scope, methodology and limitation.
* **C.** Risk, control, test and result.
* **D.** Observation, opinion, reservation and follow-up.

***

**17. (Q49)** The difference between a finding and a conclusion is that a conclusion:

* **A.** Answers the audit question at the level of the audit objective, drawing together the findings.
* **B.** Is always expressed in financial terms.
* **C.** Is the element of the report that management must formally accept.
* **D.** Covers only the deficiencies, whereas findings cover both strengths and deficiencies.

***

**18. (Q52)** The objective of follow-up work is to determine whether:

* **A.** Management has responded to the report within the agreed deadline.
* **B.** The action taken has effectively addressed the reported deficiency and the associated risk.
* **C.** The original finding was correctly formulated.
* **D.** The auditee has accepted all recommendations.

***

**19. (Q55)** Analysing recurring findings across several engagements is most useful for:

* **A.** Reducing the length of individual audit reports.
* **B.** Identifying systemic weaknesses and common root causes, which can then feed the strategic audit plan and organisation-wide recommendations.
* **C.** Demonstrating the audit function's productivity.
* **D.** Justifying a reduction in follow-up work.

***

**20. (Q58)** COBIT 2019 is best described as:

* **A.** A framework for the governance and management of enterprise information and technology.
* **B.** An information security certification standard against which organisations are audited.
* **C.** A methodology for software development lifecycle testing.
* **D.** A data analytics toolset for auditors.

***

**21. (Q61)** For a change management control, the evidence the auditor seeks is that, for each change:

* **A.** The change was applied outside business hours.
* **B.** The change log is stored in an immutable format.
* **C.** It was authorised, tested and approved before deployment to production, by parties independent of the developer.
* **D.** The user community was notified.

***

**22. (Q64)** The control environment is described as the foundation of internal control because:

* **A.** It contains the entity's most heavily documented controls.
* **B.** Integrity, ethical values, the tone set by governance and management, and the commitment to competence condition the effectiveness of all other components.
* **C.** It is the component the auditor tests first.
* **D.** It is the only component for which management is personally accountable.

***

**23. (Q67)** The same team processes 30% more payment claims within the same staffing and budget, at unchanged quality. This is primarily an improvement in:

* **A.** Economy.
* **B.** Efficiency.
* **C.** Effectiveness.
* **D.** Compliance.

***

**24. (Q70)** Internal control can provide only reasonable, not absolute, assurance because:

* **A.** Controls are never documented completely.
* **B.** Risk assessments are inherently subjective.
* **C.** Auditors test only a sample of controls.
* **D.** Human error, collusion and management override of controls, together with cost-benefit constraints, limit what any control system can achieve.

***

**25. (Q73)** Under the Common Provisions Regulation, the annual assurance package a Member State submits for a cohesion programme includes:

* **A.** Only the certified accounts.
* **B.** The accounts, the management declaration, and the annual control report and audit opinion of the audit authority.
* **C.** The accounts together with the external auditor's report on the beneficiaries' financial statements.
* **D.** The management declaration and the Commission's own compliance assessment.

***

**26. (Q76)** A disclaimer of opinion is issued when the auditor:

* **A.** Disagrees with an accounting treatment whose effect is pervasive.
* **B.** Is unable to obtain sufficient appropriate audit evidence and the possible effects are pervasive.
* **C.** Identifies a material weakness in internal control.
* **D.** Finds errors above the materiality threshold but confined to one area.

***

**27. (Q79)** The executive summary of an audit report exists primarily to:

* **A.** Record the methodology and the limitations of the work.
* **B.** Summarise the evidence supporting each finding.
* **C.** List the auditee's comments.
* **D.** Convey the key messages, conclusions and recommendations to readers who will not read the full report.

***

**28. (Q82)** A technically sound report issued eight months after fieldwork closed is deficient mainly because:

* **A.** Its value to management is reduced: the conditions may have changed and the opportunity to act on the findings has partly passed.
* **B.** The evidence obtained is no longer valid.
* **C.** The engagement file cannot be archived.
* **D.** Materiality must be recalculated at the reporting date.

***

**29. (Q85)** Supervision of an engagement is evidenced by:

* **A.** Attendance of the team leader at the opening meeting.
* **B.** The team leader's signature on the final report.
* **C.** Documented review of the working papers, with review notes raised and cleared before the report is issued.
* **D.** The absence of findings on the engagement in the subsequent quality review.

***

**30. (Q88)** A member of the audit team worked in the unit under audit until recently. The correct handling is to:

* **A.** Proceed, since former colleagues facilitate access to information.
* **B.** Exclude the person from the audit function entirely.
* **C.** Disclose the circumstance and reassign the person, or apply safeguards so that they do not audit their own former work.
* **D.** Note the matter in the report as a scope limitation.

***

{% hint style="success" %}
**Score yourself**

| Score    | Read                                                                                         |
| -------- | -------------------------------------------------------------------------------------------- |
| Below 15 | Foundations missing. Work the items untimed with the reasoning before sitting another paper. |
| 15–19    | Passing, but poorly placed for ranking. Drill your two weakest clusters.                     |
| 20–24    | Competitive. Push on speed and on the EU-framework items.                                    |
| 25–30    | Strong. Maintain with short timed sets.                                                      |

The real pass mark is 15/30, but the field-related MCQ score is also used to rank candidates, so the target is not 15.
{% endhint %}