QCM A
30 items · 40 minutes · pass mark 15/30 · no negative marking, so answer everything.
1. (Q1) In audit planning, the audit universe is best described as:
A. The complete population of auditable entities, processes, systems and themes falling within the audit function's mandate.
B. The set of engagements approved for execution in the current year.
C. The population of transactions from which the audit sample is drawn.
D. The register of risks that management has formally decided to accept.
2. (Q4) Which practice most directly anchors a strategic audit plan in the organisation's objectives?
A. Allocating audit days in proportion to each directorate's headcount.
B. Deriving candidate audit topics from the risks that threaten achievement of the organisation's stated strategic objectives.
C. Repeating the topics of the previous plan to allow year-on-year comparison.
D. Selecting topics that the audit function has the strongest existing expertise in.
3. (Q7) Audit resources are insufficient to cover all areas assessed as high risk. The most appropriate response when submitting the annual plan is to:
A. Present the plan together with an explicit statement of the high-risk areas left uncovered and the resulting assurance gap.
B. Lower the risk scores of the areas that cannot be covered so the plan appears complete.
C. Cover all high-risk areas with reduced-scope engagements regardless of whether meaningful conclusions can be drawn.
D. Defer the uncovered areas without comment and address them in the following year's plan.
4. (Q10) The main purpose of assurance mapping at the planning stage is to:
A. Record which managers have accepted which risks.
B. Establish the audit function's independence from management.
C. Identify overlaps and gaps in the assurance provided by the different assurance providers, so audit effort is placed where assurance is missing.
D. Demonstrate that all controls in the organisation have been tested at least once.
5. (Q13) Which combination correctly states the dimensions examined in a performance audit?
A. Legality, regularity and transparency.
B. Accuracy, completeness and cut-off.
C. Economy, efficiency and effectiveness.
D. Relevance, coherence and EU added value only.
6. (Q16) Under Article 287 TFEU, the European Court of Auditors provides the European Parliament and the Council with:
A. A statement of assurance on the reliability of the accounts and on the legality and regularity of the underlying transactions.
B. A binding decision on the discharge of the budget.
C. A certificate of conformity for each Member State's paying agencies.
D. An annual opinion on the Commission's staff policy.
7. (Q19) The eight core principles of the independence of supreme audit institutions are set out in:
A. INTOSAI-P 1 (Lima Declaration).
B. ISSAI 130 (Code of Ethics).
C. INTOSAI-P 12 (Value and Benefits of SAIs).
D. INTOSAI-P 10 (Mexico Declaration).
8. (Q22) Under the Financial Regulation, shared management means budget implementation:
A. By Commission departments or executive agencies directly.
B. Through financial instruments managed by the European Investment Bank.
C. Entrusted to third countries, international organisations or other entrusted entities.
D. Entrusted to the Member States.
9. (Q25) The audit risk model expresses audit risk as a function of:
A. Inherent risk, control risk and detection risk.
B. Inherent risk, residual risk and sampling risk.
C. Business risk, fraud risk and reputational risk.
D. Strategic risk, operational risk and compliance risk.
10. (Q28) The primary purpose of a walkthrough at the start of an engagement is to:
A. Obtain sufficient appropriate evidence on the operating effectiveness of controls.
B. Quantify the financial error in the population.
C. Confirm the auditor's understanding of the process and of how controls are designed to operate.
D. Satisfy the documentation requirement for the engagement file.
11. (Q31) Running a pilot test on a small number of items before executing the full programme is done mainly to:
A. Validate that the procedure and the criteria work in practice, and refine them before committing the full resource.
B. Reduce the final sample size required.
C. Give the auditee advance notice of the testing approach.
D. Establish the projected error rate for the population.
12. (Q34) Which source generally provides the most reliable audit evidence?
A. A written confirmation obtained by the auditor directly from an independent third party.
B. A schedule prepared by the auditee from its own accounting system.
C. An oral explanation from the process owner.
D. An internal memorandum recording a management decision.
13. (Q37) Stratifying a population before sampling primarily serves to:
A. Increase the total sample size.
B. Allow the auditor to exclude low-value items from the population.
C. Group items with similar characteristics so as to reduce variability within each stratum and improve the efficiency of the sample.
D. Convert a statistical sample into a judgemental one.
14. (Q40) Applying Benford's law to a large payments dataset is a technique for:
A. Confirming the completeness of the population.
B. Calculating the projected error rate.
C. Screening for anomalous distributions of leading digits that may indicate manipulated or fabricated figures.
D. Testing the segregation of duties in the payment process.
15. (Q43) Audit documentation is adequate when it enables:
A. The engagement to be completed within the time budget.
B. An experienced auditor with no previous connection to the engagement to understand the work performed, the evidence obtained and the conclusions reached.
C. The auditee to reproduce the auditor's tests.
D. The audit file to be archived in the shortest possible form.
16. (Q46) A fully developed audit finding comprises:
A. Criteria, condition, cause and effect.
B. Objective, scope, methodology and limitation.
C. Risk, control, test and result.
D. Observation, opinion, reservation and follow-up.
17. (Q49) The difference between a finding and a conclusion is that a conclusion:
A. Answers the audit question at the level of the audit objective, drawing together the findings.
B. Is always expressed in financial terms.
C. Is the element of the report that management must formally accept.
D. Covers only the deficiencies, whereas findings cover both strengths and deficiencies.
18. (Q52) The objective of follow-up work is to determine whether:
A. Management has responded to the report within the agreed deadline.
B. The action taken has effectively addressed the reported deficiency and the associated risk.
C. The original finding was correctly formulated.
D. The auditee has accepted all recommendations.
19. (Q55) Analysing recurring findings across several engagements is most useful for:
A. Reducing the length of individual audit reports.
B. Identifying systemic weaknesses and common root causes, which can then feed the strategic audit plan and organisation-wide recommendations.
C. Demonstrating the audit function's productivity.
D. Justifying a reduction in follow-up work.
20. (Q58) COBIT 2019 is best described as:
A. A framework for the governance and management of enterprise information and technology.
B. An information security certification standard against which organisations are audited.
C. A methodology for software development lifecycle testing.
D. A data analytics toolset for auditors.
21. (Q61) For a change management control, the evidence the auditor seeks is that, for each change:
A. The change was applied outside business hours.
B. The change log is stored in an immutable format.
C. It was authorised, tested and approved before deployment to production, by parties independent of the developer.
D. The user community was notified.
22. (Q64) The control environment is described as the foundation of internal control because:
A. It contains the entity's most heavily documented controls.
B. Integrity, ethical values, the tone set by governance and management, and the commitment to competence condition the effectiveness of all other components.
C. It is the component the auditor tests first.
D. It is the only component for which management is personally accountable.
23. (Q67) The same team processes 30% more payment claims within the same staffing and budget, at unchanged quality. This is primarily an improvement in:
A. Economy.
B. Efficiency.
C. Effectiveness.
D. Compliance.
24. (Q70) Internal control can provide only reasonable, not absolute, assurance because:
A. Controls are never documented completely.
B. Risk assessments are inherently subjective.
C. Auditors test only a sample of controls.
D. Human error, collusion and management override of controls, together with cost-benefit constraints, limit what any control system can achieve.
25. (Q73) Under the Common Provisions Regulation, the annual assurance package a Member State submits for a cohesion programme includes:
A. Only the certified accounts.
B. The accounts, the management declaration, and the annual control report and audit opinion of the audit authority.
C. The accounts together with the external auditor's report on the beneficiaries' financial statements.
D. The management declaration and the Commission's own compliance assessment.
26. (Q76) A disclaimer of opinion is issued when the auditor:
A. Disagrees with an accounting treatment whose effect is pervasive.
B. Is unable to obtain sufficient appropriate audit evidence and the possible effects are pervasive.
C. Identifies a material weakness in internal control.
D. Finds errors above the materiality threshold but confined to one area.
27. (Q79) The executive summary of an audit report exists primarily to:
A. Record the methodology and the limitations of the work.
B. Summarise the evidence supporting each finding.
C. List the auditee's comments.
D. Convey the key messages, conclusions and recommendations to readers who will not read the full report.
28. (Q82) A technically sound report issued eight months after fieldwork closed is deficient mainly because:
A. Its value to management is reduced: the conditions may have changed and the opportunity to act on the findings has partly passed.
B. The evidence obtained is no longer valid.
C. The engagement file cannot be archived.
D. Materiality must be recalculated at the reporting date.
29. (Q85) Supervision of an engagement is evidenced by:
A. Attendance of the team leader at the opening meeting.
B. The team leader's signature on the final report.
C. Documented review of the working papers, with review notes raised and cleared before the report is issued.
D. The absence of findings on the engagement in the subsequent quality review.
30. (Q88) A member of the audit team worked in the unit under audit until recently. The correct handling is to:
A. Proceed, since former colleagues facilitate access to information.
B. Exclude the person from the audit function entirely.
C. Disclose the circumstance and reassign the person, or apply safeguards so that they do not audit their own former work.
D. Note the matter in the report as a scope limitation.
Last updated