QCM B
Paper B
30 items · 40 minutes · pass mark 15/30 · no negative marking, so answer everything.
1. (Q2) The principal reason for building the annual audit plan on a risk assessment rather than on a fixed rotation of auditees is that it:
A. Directs limited audit resources to the areas where risk to the organisation's objectives is greatest.
B. Guarantees that every auditable entity is covered within a defined cycle.
C. Reduces the need to document the planning process.
D. Shifts responsibility for identifying risk from the auditor to management.
2. (Q5) Under the 2024 Global Internal Audit Standards, responsibility for the internal audit plan is allocated as follows:
A. Senior management drafts the plan and the chief audit executive executes it.
B. The external auditor approves the plan to avoid duplication of coverage.
C. The chief audit executive develops the plan, discusses it with senior management, and the board approves it.
D. The audit committee drafts the plan and the chief audit executive may propose amendments.
3. (Q8) Six months into the year, a major new risk emerges in an area not in the approved plan. The professionally correct course is to:
A. Decline to act, since the plan was formally approved and must be delivered as adopted.
B. Reassess priorities, propose a revision of the plan, and communicate the resulting changes in coverage to the board.
C. Add the engagement and absorb it by reducing sample sizes across all other engagements.
D. Refer the risk to the external auditor as it falls outside the approved plan.
4. (Q11) The objective of a financial audit is to express an opinion on whether:
A. Resources have been used economically, efficiently and effectively.
B. The entity's internal control system is designed in accordance with COSO.
C. Transactions comply with the applicable rules and contractual conditions.
D. The financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework.
5. (Q14) In the INTOSAI framework, the fundamental principles of performance auditing are set out in:
A. ISSAI 100.
B. ISSAI 200.
C. ISSAI 300.
D. ISSAI 400.
6. (Q17) Discharge in respect of the implementation of the EU budget is granted by:
A. The European Parliament, on a recommendation from the Council.
B. The Council, after consulting the European Court of Auditors.
C. The European Court of Auditors, in its annual report.
D. The Commission, through the declarations of assurance of its Directors-General.
7. (Q20) In the three lines model, risk management and compliance functions that support and monitor the business belong to:
A. The first line.
B. The second line.
C. The third line.
D. External assurance providers.
8. (Q23) The principle of sound financial management in the Financial Regulation comprises:
A. Unity, annuality and universality.
B. Legality, regularity and transparency.
C. Economy, efficiency and effectiveness.
D. Specification, equilibrium and unit of account.
9. (Q26) If the auditor assesses control risk as higher than initially planned, the appropriate response is to:
A. Increase the acceptable level of detection risk.
B. Raise the materiality threshold for the engagement.
C. Reduce the assessed inherent risk to compensate.
D. Reduce detection risk by extending substantive testing.
10. (Q29) Audit criteria are:
A. The conditions observed by the audit team during fieldwork.
B. The thresholds above which a finding must be reported to the board.
C. The benchmarks against which the observed condition is assessed.
D. The reasons why an observed deficiency occurred.
11. (Q32) Professional scepticism requires the auditor to:
A. Assume that management is dishonest until the contrary is proved.
B. Treat evidence produced by the auditee as inadmissible.
C. Corroborate every management representation with third-party confirmation.
D. Maintain a questioning mind, be alert to conditions indicating possible error or fraud, and critically assess audit evidence.
12. (Q35) The distinction between sufficiency and appropriateness of audit evidence is that:
A. Sufficiency concerns quantity; appropriateness concerns quality, i.e. relevance and reliability.
B. Sufficiency concerns relevance; appropriateness concerns volume.
C. Sufficiency applies to financial audit only; appropriateness to performance audit only.
D. They are alternative terms for the same requirement.
13. (Q38) After testing a statistical sample, the auditor's next step in concluding on the population is to:
A. Project the errors found to the population and compare the projected error with materiality.
B. Report the absolute value of the errors found in the sample.
C. Request that the auditee correct the errors found and then re-test the same items.
D. Extend the sample until no further errors are found.
14. (Q41) Before analysing a dataset extracted by the auditee from its own systems, the auditor's first step should be to:
A. Assess the completeness and accuracy of the dataset, for example by reconciling totals and record counts to an authoritative source.
B. Run the planned analytical tests and investigate outliers.
C. Anonymise the personal data it contains.
D. Agree the analysis results with the process owner.
15. (Q44) Cross-referencing within the engagement file serves principally to:
A. Record the time charged to each procedure.
B. Shorten the working papers.
C. Demonstrate the trail from each reported finding back to the supporting evidence.
D. Show the order in which procedures were performed.
16. (Q47) Root cause analysis is performed so that:
A. Responsibility for the deficiency can be attributed to a named official.
B. The finding can be classified by risk level.
C. The financial impact of the finding can be quantified.
D. Recommendations address the underlying cause rather than the symptom, making recurrence less likely.
17. (Q50) The purpose of the contradictory procedure with the auditee before a report is finalised is to:
A. Obtain the auditee's agreement to the conclusions as a condition of publication.
B. Transfer ownership of the recommendations to the auditee.
C. Allow the auditee to remove findings it considers unfair.
D. Establish the factual accuracy of the findings and give the auditee the opportunity to comment, while the auditor retains responsibility for the conclusions.
18. (Q53) In the Commission, responsibility for implementing an accepted internal audit recommendation lies with:
A. The Internal Audit Service, which both recommends and implements corrective action.
B. The management of the audited service, under the responsibility of the authorising officer by delegation, with implementation monitored and reported on.
C. The European Court of Auditors, as part of its annual follow-up.
D. The Secretariat-General, which centralises all corrective action.
19. (Q56) IT general controls are conventionally grouped as:
A. Confidentiality, integrity, availability and resilience.
B. Input, processing, output and storage controls.
C. Preventive, detective, corrective and directive controls.
D. Access to programs and data, program change, program development, and computer operations.
20. (Q59) A developer who also holds standing write access to the production environment creates which primary risk?
A. Loss of data integrity through hardware failure.
B. Inability to recover the system after an incident.
C. Unauthorised or untested changes being introduced into production without independent approval.
D. Excessive licensing cost.
21. (Q62) In business continuity arrangements, the recovery point objective defines:
A. The maximum tolerable period for restoring service after an incident.
B. The maximum tolerable amount of data loss, expressed as a period of time.
C. The minimum capacity of the backup site.
D. The frequency of the disaster recovery test.
22. (Q65) Which statement correctly defines economy?
A. Achieving the objectives set for an activity.
B. Minimising the cost of the resources used, having regard to appropriate quality.
C. Maximising the ratio of outputs to inputs.
D. Ensuring expenditure complies with the applicable rules.
23. (Q68) Risk appetite is:
A. The maximum loss an organisation can sustain before insolvency.
B. The amount of risk an organisation is willing to accept in pursuit of its objectives.
C. The aggregate of all residual risks in the risk register.
D. The level of risk that triggers mandatory reporting to the board.
24. (Q71) In the Commission's annual reporting cycle, each Director-General:
A. Obtains a compliance certificate from the European Court of Auditors.
B. Receives a declaration of assurance from the Internal Audit Service.
C. Certifies the Commission's consolidated accounts.
D. Signs a declaration of assurance in the annual activity report, entering reservations where material weaknesses are identified.
25. (Q74) An audit authority reports a total error rate above 2% for a cohesion programme. The consequence is that:
A. The programme is automatically suspended.
B. The Commission takes over the audit authority's functions.
C. The materiality threshold is recalculated for that programme.
D. Additional corrections must be made so that the residual error rate for the accounts is brought to 2% or below.
26. (Q77) An emphasis of matter paragraph:
A. Modifies the opinion by restricting its scope.
B. Is used only in performance audit reports.
C. Replaces the need for a qualification where the auditee agrees to corrective action.
D. Draws the reader's attention to a matter already appropriately presented or disclosed, without modifying the opinion.
27. (Q80) A European Court of Auditors opinion, as distinct from a special report, is:
A. A performance audit of a specific spending programme.
B. A summary of the Court's recommendations to a single Member State.
C. The Court's annual statement of assurance on the budget.
D. The Court's view on draft EU legislation or other proposals with financial impact, in some cases subject to mandatory consultation.
28. (Q83) In allocating tasks within an engagement team, the team leader should primarily weigh:
A. The competence and experience each task requires, the development needs of team members, and any circumstance impairing a member's objectivity for a given task.
B. Equal distribution of hours among team members.
C. The seniority of the team members alone.
D. The preferences expressed by the auditee.
29. (Q86) A team member's work is repeatedly below the required standard. The appropriate management response is to:
A. Record the issue in the annual appraisal and reassign the person after the engagement.
B. Reduce the scope of the engagement to match the available capability.
C. Re-perform the work without informing the person concerned.
D. Give specific, evidence-based feedback during the engagement and agree remedial action, with closer review of the work in the meantime.
30. (Q89) The principal purpose of an audit manual is to:
A. Demonstrate to the auditee how audits are conducted.
B. Serve as the training material for new recruits only.
C. Record the audit function's annual plan.
D. Translate the applicable professional standards into working practice so that engagements are conducted consistently.
Last updated