> For the complete documentation index, see [llms.txt](https://doc.montoyer.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.montoyer.com/competitions/epso-ad-428-26/qcm-epso-ad-428-26/qcm-b.md).

# QCM B

## Paper B

30 items · 40 minutes · pass mark 15/30 · no negative marking, so answer everything.

{% hint style="info" %}
Set a timer for 40 minutes and work straight through. Open an answer only after you have committed to your own, and keep a tally as you go — GitBook cannot score this for you.
{% endhint %}

**1. (Q2)** The principal reason for building the annual audit plan on a risk assessment rather than on a fixed rotation of auditees is that it:

* **A.** Directs limited audit resources to the areas where risk to the organisation's objectives is greatest.
* **B.** Guarantees that every auditable entity is covered within a defined cycle.
* **C.** Reduces the need to document the planning process.
* **D.** Shifts responsibility for identifying risk from the auditor to management.

***

**2. (Q5)** Under the 2024 Global Internal Audit Standards, responsibility for the internal audit plan is allocated as follows:

* **A.** Senior management drafts the plan and the chief audit executive executes it.
* **B.** The external auditor approves the plan to avoid duplication of coverage.
* **C.** The chief audit executive develops the plan, discusses it with senior management, and the board approves it.
* **D.** The audit committee drafts the plan and the chief audit executive may propose amendments.

***

**3. (Q8)** Six months into the year, a major new risk emerges in an area not in the approved plan. The professionally correct course is to:

* **A.** Decline to act, since the plan was formally approved and must be delivered as adopted.
* **B.** Reassess priorities, propose a revision of the plan, and communicate the resulting changes in coverage to the board.
* **C.** Add the engagement and absorb it by reducing sample sizes across all other engagements.
* **D.** Refer the risk to the external auditor as it falls outside the approved plan.

***

**4. (Q11)** The objective of a *financial audit* is to express an opinion on whether:

* **A.** Resources have been used economically, efficiently and effectively.
* **B.** The entity's internal control system is designed in accordance with COSO.
* **C.** Transactions comply with the applicable rules and contractual conditions.
* **D.** The financial statements are prepared, in all material respects, in accordance with the applicable financial reporting framework.

***

**5. (Q14)** In the INTOSAI framework, the fundamental principles of **performance auditing** are set out in:

* **A.** ISSAI 100.
* **B.** ISSAI 200.
* **C.** ISSAI 300.
* **D.** ISSAI 400.

***

**6. (Q17)** Discharge in respect of the implementation of the EU budget is granted by:

* **A.** The European Parliament, on a recommendation from the Council.
* **B.** The Council, after consulting the European Court of Auditors.
* **C.** The European Court of Auditors, in its annual report.
* **D.** The Commission, through the declarations of assurance of its Directors-General.

***

**7. (Q20)** In the three lines model, risk management and compliance functions that support and monitor the business belong to:

* **A.** The first line.
* **B.** The second line.
* **C.** The third line.
* **D.** External assurance providers.

***

**8. (Q23)** The principle of *sound financial management* in the Financial Regulation comprises:

* **A.** Unity, annuality and universality.
* **B.** Legality, regularity and transparency.
* **C.** Economy, efficiency and effectiveness.
* **D.** Specification, equilibrium and unit of account.

***

**9. (Q26)** If the auditor assesses control risk as higher than initially planned, the appropriate response is to:

* **A.** Increase the acceptable level of detection risk.
* **B.** Raise the materiality threshold for the engagement.
* **C.** Reduce the assessed inherent risk to compensate.
* **D.** Reduce detection risk by extending substantive testing.

***

**10. (Q29)** Audit *criteria* are:

* **A.** The conditions observed by the audit team during fieldwork.
* **B.** The thresholds above which a finding must be reported to the board.
* **C.** The benchmarks against which the observed condition is assessed.
* **D.** The reasons why an observed deficiency occurred.

***

**11. (Q32)** Professional scepticism requires the auditor to:

* **A.** Assume that management is dishonest until the contrary is proved.
* **B.** Treat evidence produced by the auditee as inadmissible.
* **C.** Corroborate every management representation with third-party confirmation.
* **D.** Maintain a questioning mind, be alert to conditions indicating possible error or fraud, and critically assess audit evidence.

***

**12. (Q35)** The distinction between *sufficiency* and *appropriateness* of audit evidence is that:

* **A.** Sufficiency concerns quantity; appropriateness concerns quality, i.e. relevance and reliability.
* **B.** Sufficiency concerns relevance; appropriateness concerns volume.
* **C.** Sufficiency applies to financial audit only; appropriateness to performance audit only.
* **D.** They are alternative terms for the same requirement.

***

**13. (Q38)** After testing a statistical sample, the auditor's next step in concluding on the population is to:

* **A.** Project the errors found to the population and compare the projected error with materiality.
* **B.** Report the absolute value of the errors found in the sample.
* **C.** Request that the auditee correct the errors found and then re-test the same items.
* **D.** Extend the sample until no further errors are found.

***

**14. (Q41)** Before analysing a dataset extracted by the auditee from its own systems, the auditor's first step should be to:

* **A.** Assess the completeness and accuracy of the dataset, for example by reconciling totals and record counts to an authoritative source.
* **B.** Run the planned analytical tests and investigate outliers.
* **C.** Anonymise the personal data it contains.
* **D.** Agree the analysis results with the process owner.

***

**15. (Q44)** Cross-referencing within the engagement file serves principally to:

* **A.** Record the time charged to each procedure.
* **B.** Shorten the working papers.
* **C.** Demonstrate the trail from each reported finding back to the supporting evidence.
* **D.** Show the order in which procedures were performed.

***

**16. (Q47)** Root cause analysis is performed so that:

* **A.** Responsibility for the deficiency can be attributed to a named official.
* **B.** The finding can be classified by risk level.
* **C.** The financial impact of the finding can be quantified.
* **D.** Recommendations address the underlying cause rather than the symptom, making recurrence less likely.

***

**17. (Q50)** The purpose of the contradictory procedure with the auditee before a report is finalised is to:

* **A.** Obtain the auditee's agreement to the conclusions as a condition of publication.
* **B.** Transfer ownership of the recommendations to the auditee.
* **C.** Allow the auditee to remove findings it considers unfair.
* **D.** Establish the factual accuracy of the findings and give the auditee the opportunity to comment, while the auditor retains responsibility for the conclusions.

***

**18. (Q53)** In the Commission, responsibility for implementing an accepted internal audit recommendation lies with:

* **A.** The Internal Audit Service, which both recommends and implements corrective action.
* **B.** The management of the audited service, under the responsibility of the authorising officer by delegation, with implementation monitored and reported on.
* **C.** The European Court of Auditors, as part of its annual follow-up.
* **D.** The Secretariat-General, which centralises all corrective action.

***

**19. (Q56)** IT general controls are conventionally grouped as:

* **A.** Confidentiality, integrity, availability and resilience.
* **B.** Input, processing, output and storage controls.
* **C.** Preventive, detective, corrective and directive controls.
* **D.** Access to programs and data, program change, program development, and computer operations.

***

**20. (Q59)** A developer who also holds standing write access to the production environment creates which primary risk?

* **A.** Loss of data integrity through hardware failure.
* **B.** Inability to recover the system after an incident.
* **C.** Unauthorised or untested changes being introduced into production without independent approval.
* **D.** Excessive licensing cost.

***

**21. (Q62)** In business continuity arrangements, the *recovery point objective* defines:

* **A.** The maximum tolerable period for restoring service after an incident.
* **B.** The maximum tolerable amount of data loss, expressed as a period of time.
* **C.** The minimum capacity of the backup site.
* **D.** The frequency of the disaster recovery test.

***

**22. (Q65)** Which statement correctly defines *economy*?

* **A.** Achieving the objectives set for an activity.
* **B.** Minimising the cost of the resources used, having regard to appropriate quality.
* **C.** Maximising the ratio of outputs to inputs.
* **D.** Ensuring expenditure complies with the applicable rules.

***

**23. (Q68)** *Risk appetite* is:

* **A.** The maximum loss an organisation can sustain before insolvency.
* **B.** The amount of risk an organisation is willing to accept in pursuit of its objectives.
* **C.** The aggregate of all residual risks in the risk register.
* **D.** The level of risk that triggers mandatory reporting to the board.

***

**24. (Q71)** In the Commission's annual reporting cycle, each Director-General:

* **A.** Obtains a compliance certificate from the European Court of Auditors.
* **B.** Receives a declaration of assurance from the Internal Audit Service.
* **C.** Certifies the Commission's consolidated accounts.
* **D.** Signs a declaration of assurance in the annual activity report, entering reservations where material weaknesses are identified.

***

**25. (Q74)** An audit authority reports a total error rate above 2% for a cohesion programme. The consequence is that:

* **A.** The programme is automatically suspended.
* **B.** The Commission takes over the audit authority's functions.
* **C.** The materiality threshold is recalculated for that programme.
* **D.** Additional corrections must be made so that the residual error rate for the accounts is brought to 2% or below.

***

**26. (Q77)** An emphasis of matter paragraph:

* **A.** Modifies the opinion by restricting its scope.
* **B.** Is used only in performance audit reports.
* **C.** Replaces the need for a qualification where the auditee agrees to corrective action.
* **D.** Draws the reader's attention to a matter already appropriately presented or disclosed, without modifying the opinion.

***

**27. (Q80)** A European Court of Auditors *opinion*, as distinct from a special report, is:

* **A.** A performance audit of a specific spending programme.
* **B.** A summary of the Court's recommendations to a single Member State.
* **C.** The Court's annual statement of assurance on the budget.
* **D.** The Court's view on draft EU legislation or other proposals with financial impact, in some cases subject to mandatory consultation.

***

**28. (Q83)** In allocating tasks within an engagement team, the team leader should primarily weigh:

* **A.** The competence and experience each task requires, the development needs of team members, and any circumstance impairing a member's objectivity for a given task.
* **B.** Equal distribution of hours among team members.
* **C.** The seniority of the team members alone.
* **D.** The preferences expressed by the auditee.

***

**29. (Q86)** A team member's work is repeatedly below the required standard. The appropriate management response is to:

* **A.** Record the issue in the annual appraisal and reassign the person after the engagement.
* **B.** Reduce the scope of the engagement to match the available capability.
* **C.** Re-perform the work without informing the person concerned.
* **D.** Give specific, evidence-based feedback during the engagement and agree remedial action, with closer review of the work in the meantime.

***

**30. (Q89)** The principal purpose of an audit manual is to:

* **A.** Demonstrate to the auditee how audits are conducted.
* **B.** Serve as the training material for new recruits only.
* **C.** Record the audit function's annual plan.
* **D.** Translate the applicable professional standards into working practice so that engagements are conducted consistently.

***

{% hint style="success" %}
**Score yourself**

| Score    | Read                                                                                         |
| -------- | -------------------------------------------------------------------------------------------- |
| Below 15 | Foundations missing. Work the items untimed with the reasoning before sitting another paper. |
| 15–19    | Passing, but poorly placed for ranking. Drill your two weakest clusters.                     |
| 20–24    | Competitive. Push on speed and on the EU-framework items.                                    |
| 25–30    | Strong. Maintain with short timed sets.                                                      |

The real pass mark is 15/30, but the field-related MCQ score is also used to rank candidates, so the target is not 15.
{% endhint %}