> For the complete documentation index, see [llms.txt](https://doc.montoyer.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://doc.montoyer.com/competitions/epso-ad-428-26/qcm-epso-ad-428-26/qcm-c.md).

# QCM C

30 items · 40 minutes · pass mark 15/30 · no negative marking, so answer everything.

{% hint style="info" %}
Set a timer for 40 minutes and work straight through. Open an answer only after you have committed to your own, and keep a tally as you go — GitBook cannot score this for you.
{% endhint %}

**1. (Q3)** *Residual risk* is:

* **A.** The risk that the auditor issues an inappropriate opinion.
* **B.** The risk remaining after management's risk responses and controls have been taken into account.
* **C.** The risk arising from the absence of any control framework.
* **D.** The portion of risk that cannot be quantified.

***

**2. (Q6)** Which of the following is **not** a legitimate criterion for scoring and prioritising candidate audit topics?

* **A.** Materiality of the expenditure or activity concerned.
* **B.** Complexity and recent change in the applicable legal framework.
* **C.** The willingness of the responsible manager to be audited.
* **D.** Time elapsed since the area was last audited.

***

**3. (Q9)** Within the European Commission, the body that monitors the adequacy of internal audit coverage and the follow-up given to Internal Audit Service recommendations is:

* **A.** The European Court of Auditors.
* **B.** The European Parliament's Committee on Budgetary Control.
* **C.** The OLAF Supervisory Committee.
* **D.** The Audit Progress Committee.

***

**4. (Q12)** A *compliance audit* assesses whether:

* **A.** The subject matter conforms with the applicable authorities — laws, regulations, budgetary rules and agreements.
* **B.** Management has achieved the targets set in its annual work programme.
* **C.** The accounts present a true and fair view of the financial position.
* **D.** The entity's risk appetite has been formally approved.

***

**5. (Q15)** The clearest structural difference between internal and external audit is that:

* **A.** Internal audit examines controls while external audit examines transactions.
* **B.** Internal audit applies ISSAIs whereas external audit applies the Global Internal Audit Standards.
* **C.** Internal audit is voluntary whereas external audit is compulsory in all organisations.
* **D.** Internal audit reports to the organisation's own governance bodies to help it improve, whereas external audit reports to external stakeholders on the accounts and on legality and regularity.

***

**6. (Q18)** The materiality threshold the European Court of Auditors applies in concluding on the legality and regularity of EU expenditure is:

* **A.** 0.5% of the audited population.
* **B.** 1% of the audited population.
* **C.** 2% of the audited population.
* **D.** 5% of the audited population.

***

**7. (Q21)** The *single audit* principle in EU shared management means that:

* **A.** Only one audit body may audit any given operation.
* **B.** Audit work and controls performed at one level should be relied upon at higher levels so as to avoid unnecessary duplication of checks on the same expenditure.
* **C.** Each operation is audited once and never revisited.
* **D.** The Commission delegates all audit responsibility to the Member State audit authority.

***

**8. (Q24)** In the CAP delivery model, the annual accounts of an accredited paying agency are subject to:

* **A.** Certification by the Commission's Internal Audit Service.
* **B.** Certification by an independent certification body, whose work the Commission uses for the annual clearance of accounts.
* **C.** Direct certification by the European Court of Auditors.
* **D.** No external certification, since the paying agency's own director signs a management declaration.

***

**9. (Q27)** Which procedure is a *test of controls* rather than a substantive procedure?

* **A.** Inspecting a sample of payment files for evidence that the required second authorising signature was obtained before payment.
* **B.** Recalculating the depreciation charge for a sample of assets.
* **C.** Confirming a year-end balance directly with the counterparty.
* **D.** Comparing declared personnel costs with payroll records.

***

**10. (Q30)** In auditing declared personnel costs on an EU grant, the eligibility of the amounts claimed is most directly tested by:

* **A.** Reconciling the declared hours and hourly rates to payroll records, time records and the grant agreement's cost rules.
* **B.** Confirming that the beneficiary's annual accounts were audited by a statutory auditor.
* **C.** Verifying that the total claim does not exceed the maximum grant amount.
* **D.** Obtaining written confirmation from the beneficiary that the costs were incurred.

***

**11. (Q33)** A top-down approach to identifying the key controls to be tested starts from:

* **A.** The objectives and the risks that threaten them, then identifies the controls that mitigate those risks.
* **B.** The list of controls documented in the entity's procedure manuals.
* **C.** The controls that failed in the previous audit.
* **D.** The controls that are least costly to test.

***

**12. (Q36)** Monetary unit sampling is particularly suited to testing for overstatement because:

* **A.** Every item in the population has an equal probability of selection.
* **B.** The probability of selecting an item is proportional to its monetary value, so high-value items are more likely to be selected.
* **C.** It removes the need to project errors to the population.
* **D.** It eliminates sampling risk.

***

**13. (Q39)** The principal limitation of a purely judgemental sample is that:

* **A.** It cannot detect fraud.
* **B.** It requires a larger sample than a statistical approach.
* **C.** Its results cannot be statistically extrapolated to the population.
* **D.** It cannot be documented in the working papers.

***

**14. (Q42)** The main audit advantage of using data analytics to identify duplicate payments, matching supplier, amount, invoice number and date, is that it:

* **A.** Removes the need to obtain corroborating evidence for the items identified.
* **B.** Proves that the duplicates were fraudulent rather than accidental.
* **C.** Allows testing of the entire population rather than a sample, so no sampling risk attaches to the identification of the exceptions.
* **D.** Replaces the assessment of the control environment.

***

**15. (Q45)** In EU funds management, an adequate *audit trail* requires that:

* **A.** Beneficiaries retain original invoices for at least ten years in all cases.
* **B.** All supporting documents are transmitted to the Commission with each payment claim.
* **C.** Records and documents are kept that allow amounts declared to the Commission to be reconciled with the accounting records and supporting documents held at each level of implementation.
* **D.** The managing authority re-performs the audit authority's checks.

***

**16. (Q48)** Which feature would make a recommendation *inappropriate*?

* **A.** It is addressed to the party with the authority to implement it.
* **B.** It states what must be achieved and by when.
* **C.** It specifies the particular commercial software product the auditee must purchase.
* **D.** It is proportionate to the risk and the cost of implementation.

***

**17. (Q51)** Management declines a recommendation and states that it accepts the risk. The auditor should:

* **A.** Withdraw the recommendation from the report.
* **B.** Discuss the matter with management and, if the residual risk is judged unacceptable to the organisation, communicate it to the board.
* **C.** Escalate immediately to the external auditor.
* **D.** Re-issue the recommendation unchanged in the following year's report without further action.

***

**18. (Q54)** Classifying findings by significance, for example critical / very important / important, is done primarily to:

* **A.** Determine which findings may be omitted from the report.
* **B.** Set the fee or resource charge for the engagement.
* **C.** Direct management's attention and the sequence of corrective action to where the risk is greatest.
* **D.** Decide which findings require a root cause analysis.

***

**19. (Q57)** If IT general controls are found to be ineffective, the consequence for the audit is that:

* **A.** Application controls can still be relied upon if they were correctly designed.
* **B.** Application controls cannot be relied upon, because their continued proper operation is not assured.
* **C.** Substantive testing becomes unnecessary.
* **D.** The audit scope must exclude all IT-dependent processes.

***

**20. (Q60)** The most effective test of whether user access rights are appropriate is to:

* **A.** Confirm that the system enforces password complexity rules.
* **B.** Confirm that the access rights were approved when the system went live.
* **C.** Check that an access request form exists for each user.
* **D.** Compare the current list of user rights against authorised roles and against HR records of transfers and leavers.

***

**21. (Q63)** The five components of internal control in the COSO 2013 framework are:

* **A.** Strategy, operations, reporting, compliance, resilience.
* **B.** Governance, risk, compliance, assurance, reporting.
* **C.** Planning, execution, review, reporting, follow-up.
* **D.** Control environment, risk assessment, control activities, information and communication, monitoring activities.

***

**22. (Q66)** An administration procures laptops of identical specification at a unit price 20% lower than in the previous contract. This is primarily an improvement in:

* **A.** Economy.
* **B.** Efficiency.
* **C.** Effectiveness.
* **D.** Regularity.

***

**23. (Q69)** The audit committee's core role in governance is:

* **A.** To approve the financial statements on behalf of the board.
* **B.** To oversee financial reporting, the internal control and risk management systems, and the work of internal and external audit.
* **C.** To manage the organisation's response to identified risks.
* **D.** To carry out investigations into suspected irregularities.

***

**24. (Q72)** A reservation in an annual activity report is normally warranted when:

* **A.** Any control weakness has been identified during the year.
* **B.** A weakness or an error rate has a quantified material impact on the assurance that can be given for the activity concerned.
* **C.** The Internal Audit Service has issued recommendations that are not yet implemented.
* **D.** The Court of Auditors has selected the service for audit.

***

**25. (Q75)** An auditor concludes that misstatements are material but not pervasive to the financial statements. The appropriate opinion is:

* **A.** Unmodified with an emphasis of matter paragraph.
* **B.** Qualified.
* **C.** Adverse.
* **D.** A disclaimer of opinion.

***

**26. (Q78)** A report is *balanced* when it:

* **A.** Contains an equal number of positive and negative observations.
* **B.** Omits findings the auditee contests.
* **C.** Places findings in context, acknowledges what functions well, and presents the auditee's position alongside the auditor's conclusions.
* **D.** Reports only the findings management has agreed to act on.

***

**27. (Q81)** During an engagement the auditor develops a suspicion of fraud. The correct course of action is to:

* **A.** Report the suspicion through the prescribed channel to the competent body, such as OLAF or the EPPO, without undertaking the investigation itself.
* **B.** Investigate the matter fully before reporting, so that the report contains proven facts.
* **C.** Confront the individual concerned to obtain an explanation.
* **D.** Omit the matter from the report and address it in the following engagement.

***

**28. (Q84)** Halfway through an engagement the time budget is clearly going to be exceeded. The team leader should:

* **A.** Reduce sample sizes across all tests so that the budget is met.
* **B.** Transfer the remaining work to the following year's plan without notifying anyone.
* **C.** Complete the work as planned and report the overrun after the report is issued.
* **D.** Analyse the cause, re-plan scope and resources, and inform the engagement owner early enough for a decision to be taken.

***

**29. (Q87)** Several teams audit the same topic in different Member States. The most effective safeguard for consistency of results is:

* **A.** A common methodology and standard test programme, shared criteria, and central review of the teams' findings before consolidation.
* **B.** A single closing meeting held jointly for all auditees.
* **C.** Having all teams led by the same person.
* **D.** Standardising the size of each team.

***

**30. (Q90)** A structured post-engagement lessons-learned exercise contributes most to:

* **A.** Reducing the time budget of the next engagement.
* **B.** Determining the ratings of team members.
* **C.** Justifying the engagement's resource consumption.
* **D.** Improving methodology, tools and guidance, and building the audit function's institutional knowledge.

***

{% hint style="success" %}
**Score yourself**

| Score    | Read                                                                                         |
| -------- | -------------------------------------------------------------------------------------------- |
| Below 15 | Foundations missing. Work the items untimed with the reasoning before sitting another paper. |
| 15–19    | Passing, but poorly placed for ranking. Drill your two weakest clusters.                     |
| 20–24    | Competitive. Push on speed and on the EU-framework items.                                    |
| 25–30    | Strong. Maintain with short timed sets.                                                      |

The real pass mark is 15/30, but the field-related MCQ score is also used to rank candidates, so the target is not 15.
{% endhint %}