QCM C
30 items · 40 minutes · pass mark 15/30 · no negative marking, so answer everything.
1. (Q3) Residual risk is:
A. The risk that the auditor issues an inappropriate opinion.
B. The risk remaining after management's risk responses and controls have been taken into account.
C. The risk arising from the absence of any control framework.
D. The portion of risk that cannot be quantified.
2. (Q6) Which of the following is not a legitimate criterion for scoring and prioritising candidate audit topics?
A. Materiality of the expenditure or activity concerned.
B. Complexity and recent change in the applicable legal framework.
C. The willingness of the responsible manager to be audited.
D. Time elapsed since the area was last audited.
3. (Q9) Within the European Commission, the body that monitors the adequacy of internal audit coverage and the follow-up given to Internal Audit Service recommendations is:
A. The European Court of Auditors.
B. The European Parliament's Committee on Budgetary Control.
C. The OLAF Supervisory Committee.
D. The Audit Progress Committee.
4. (Q12) A compliance audit assesses whether:
A. The subject matter conforms with the applicable authorities — laws, regulations, budgetary rules and agreements.
B. Management has achieved the targets set in its annual work programme.
C. The accounts present a true and fair view of the financial position.
D. The entity's risk appetite has been formally approved.
5. (Q15) The clearest structural difference between internal and external audit is that:
A. Internal audit examines controls while external audit examines transactions.
B. Internal audit applies ISSAIs whereas external audit applies the Global Internal Audit Standards.
C. Internal audit is voluntary whereas external audit is compulsory in all organisations.
D. Internal audit reports to the organisation's own governance bodies to help it improve, whereas external audit reports to external stakeholders on the accounts and on legality and regularity.
6. (Q18) The materiality threshold the European Court of Auditors applies in concluding on the legality and regularity of EU expenditure is:
A. 0.5% of the audited population.
B. 1% of the audited population.
C. 2% of the audited population.
D. 5% of the audited population.
7. (Q21) The single audit principle in EU shared management means that:
A. Only one audit body may audit any given operation.
B. Audit work and controls performed at one level should be relied upon at higher levels so as to avoid unnecessary duplication of checks on the same expenditure.
C. Each operation is audited once and never revisited.
D. The Commission delegates all audit responsibility to the Member State audit authority.
8. (Q24) In the CAP delivery model, the annual accounts of an accredited paying agency are subject to:
A. Certification by the Commission's Internal Audit Service.
B. Certification by an independent certification body, whose work the Commission uses for the annual clearance of accounts.
C. Direct certification by the European Court of Auditors.
D. No external certification, since the paying agency's own director signs a management declaration.
9. (Q27) Which procedure is a test of controls rather than a substantive procedure?
A. Inspecting a sample of payment files for evidence that the required second authorising signature was obtained before payment.
B. Recalculating the depreciation charge for a sample of assets.
C. Confirming a year-end balance directly with the counterparty.
D. Comparing declared personnel costs with payroll records.
10. (Q30) In auditing declared personnel costs on an EU grant, the eligibility of the amounts claimed is most directly tested by:
A. Reconciling the declared hours and hourly rates to payroll records, time records and the grant agreement's cost rules.
B. Confirming that the beneficiary's annual accounts were audited by a statutory auditor.
C. Verifying that the total claim does not exceed the maximum grant amount.
D. Obtaining written confirmation from the beneficiary that the costs were incurred.
11. (Q33) A top-down approach to identifying the key controls to be tested starts from:
A. The objectives and the risks that threaten them, then identifies the controls that mitigate those risks.
B. The list of controls documented in the entity's procedure manuals.
C. The controls that failed in the previous audit.
D. The controls that are least costly to test.
12. (Q36) Monetary unit sampling is particularly suited to testing for overstatement because:
A. Every item in the population has an equal probability of selection.
B. The probability of selecting an item is proportional to its monetary value, so high-value items are more likely to be selected.
C. It removes the need to project errors to the population.
D. It eliminates sampling risk.
13. (Q39) The principal limitation of a purely judgemental sample is that:
A. It cannot detect fraud.
B. It requires a larger sample than a statistical approach.
C. Its results cannot be statistically extrapolated to the population.
D. It cannot be documented in the working papers.
14. (Q42) The main audit advantage of using data analytics to identify duplicate payments, matching supplier, amount, invoice number and date, is that it:
A. Removes the need to obtain corroborating evidence for the items identified.
B. Proves that the duplicates were fraudulent rather than accidental.
C. Allows testing of the entire population rather than a sample, so no sampling risk attaches to the identification of the exceptions.
D. Replaces the assessment of the control environment.
15. (Q45) In EU funds management, an adequate audit trail requires that:
A. Beneficiaries retain original invoices for at least ten years in all cases.
B. All supporting documents are transmitted to the Commission with each payment claim.
C. Records and documents are kept that allow amounts declared to the Commission to be reconciled with the accounting records and supporting documents held at each level of implementation.
D. The managing authority re-performs the audit authority's checks.
16. (Q48) Which feature would make a recommendation inappropriate?
A. It is addressed to the party with the authority to implement it.
B. It states what must be achieved and by when.
C. It specifies the particular commercial software product the auditee must purchase.
D. It is proportionate to the risk and the cost of implementation.
17. (Q51) Management declines a recommendation and states that it accepts the risk. The auditor should:
A. Withdraw the recommendation from the report.
B. Discuss the matter with management and, if the residual risk is judged unacceptable to the organisation, communicate it to the board.
C. Escalate immediately to the external auditor.
D. Re-issue the recommendation unchanged in the following year's report without further action.
18. (Q54) Classifying findings by significance, for example critical / very important / important, is done primarily to:
A. Determine which findings may be omitted from the report.
B. Set the fee or resource charge for the engagement.
C. Direct management's attention and the sequence of corrective action to where the risk is greatest.
D. Decide which findings require a root cause analysis.
19. (Q57) If IT general controls are found to be ineffective, the consequence for the audit is that:
A. Application controls can still be relied upon if they were correctly designed.
B. Application controls cannot be relied upon, because their continued proper operation is not assured.
C. Substantive testing becomes unnecessary.
D. The audit scope must exclude all IT-dependent processes.
20. (Q60) The most effective test of whether user access rights are appropriate is to:
A. Confirm that the system enforces password complexity rules.
B. Confirm that the access rights were approved when the system went live.
C. Check that an access request form exists for each user.
D. Compare the current list of user rights against authorised roles and against HR records of transfers and leavers.
21. (Q63) The five components of internal control in the COSO 2013 framework are:
A. Strategy, operations, reporting, compliance, resilience.
B. Governance, risk, compliance, assurance, reporting.
C. Planning, execution, review, reporting, follow-up.
D. Control environment, risk assessment, control activities, information and communication, monitoring activities.
22. (Q66) An administration procures laptops of identical specification at a unit price 20% lower than in the previous contract. This is primarily an improvement in:
A. Economy.
B. Efficiency.
C. Effectiveness.
D. Regularity.
23. (Q69) The audit committee's core role in governance is:
A. To approve the financial statements on behalf of the board.
B. To oversee financial reporting, the internal control and risk management systems, and the work of internal and external audit.
C. To manage the organisation's response to identified risks.
D. To carry out investigations into suspected irregularities.
24. (Q72) A reservation in an annual activity report is normally warranted when:
A. Any control weakness has been identified during the year.
B. A weakness or an error rate has a quantified material impact on the assurance that can be given for the activity concerned.
C. The Internal Audit Service has issued recommendations that are not yet implemented.
D. The Court of Auditors has selected the service for audit.
25. (Q75) An auditor concludes that misstatements are material but not pervasive to the financial statements. The appropriate opinion is:
A. Unmodified with an emphasis of matter paragraph.
B. Qualified.
C. Adverse.
D. A disclaimer of opinion.
26. (Q78) A report is balanced when it:
A. Contains an equal number of positive and negative observations.
B. Omits findings the auditee contests.
C. Places findings in context, acknowledges what functions well, and presents the auditee's position alongside the auditor's conclusions.
D. Reports only the findings management has agreed to act on.
27. (Q81) During an engagement the auditor develops a suspicion of fraud. The correct course of action is to:
A. Report the suspicion through the prescribed channel to the competent body, such as OLAF or the EPPO, without undertaking the investigation itself.
B. Investigate the matter fully before reporting, so that the report contains proven facts.
C. Confront the individual concerned to obtain an explanation.
D. Omit the matter from the report and address it in the following engagement.
28. (Q84) Halfway through an engagement the time budget is clearly going to be exceeded. The team leader should:
A. Reduce sample sizes across all tests so that the budget is met.
B. Transfer the remaining work to the following year's plan without notifying anyone.
C. Complete the work as planned and report the overrun after the report is issued.
D. Analyse the cause, re-plan scope and resources, and inform the engagement owner early enough for a decision to be taken.
29. (Q87) Several teams audit the same topic in different Member States. The most effective safeguard for consistency of results is:
A. A common methodology and standard test programme, shared criteria, and central review of the teams' findings before consolidation.
B. A single closing meeting held jointly for all auditees.
C. Having all teams led by the same person.
D. Standardising the size of each team.
30. (Q90) A structured post-engagement lessons-learned exercise contributes most to:
A. Reducing the time budget of the next engagement.
B. Determining the ratings of team members.
C. Justifying the engagement's resource consumption.
D. Improving methodology, tools and guidance, and building the audit function's institutional knowledge.
Last updated