ACCA AA Audit Risk Questions: Step-by-Step Guide
How to Answer Audit Risk Questions in ACCA AA (Step-by-Step with Worked Examples)
Written by Vicky Sarin, CA | INSEAD
25+ years in audit, financial reporting, and professional exam coaching. I've reviewed hundreds of AA scripts and marked mock exams — the mistakes in this guide are ones I see every single sitting, without exception.
Every sitting, audit risk is the question that separates the candidates who pass from the ones who don't. It appeared as a 16-mark requirement in March/June 2025 (Pimento Co) and a 14-mark requirement in December 2025 (Survival Solutions Co). I've coached students through both — and the pattern of mistakes was identical in both sittings.
The good news: audit risk questions are highly learnable. Once you understand the three-part structure and the specific traps, you can walk into the exam knowing exactly how to approach this question every time. That's what this guide is for.
💡 The Short Version
• Every audit risk answer needs three parts: identify the risk (½ mark), explain it with the right account and direction — overstated or understated (½ mark), and give a specific auditor procedure (1 mark).
• "Discuss with management" scores zero. "Increase professional scepticism" scores zero on its own. These are the two most common wasted marks I see.
• "Misstated" is only acceptable when the balance genuinely could go either way. Using it when the risk is clearly one-directional scores zero for explanation.
• Copying a fact from the scenario without explaining why it creates a financial statement risk scores zero for identification.
• Specificity wins every time — "PPE is overstated" scores, "assets are overstated" does not. "Depreciation expense is understated" scores, "expenses are understated" does not.
📋 Table of Contents
What Is Audit Risk? A Quick Recap
Step 1: Identify the Risk — Not Just the Fact
Step 2: Explain with Assertion and Direction
Step 3: Write the Auditor's Response — Not Management's
Full Worked Examples (Pimento Co & Survival Solutions)
Assertions: What They Mean and When to Use Them
Valid vs. Invalid Auditor Responses (Reference Table)
8 Mistakes That Cost Candidates Marks
What Is Audit Risk? A Quick Recap
Before diving into exam technique, let me make sure the model is crystal clear — because I've seen students write excellent procedures for the wrong risk component.
Audit risk is the risk that you, as the auditor, express the wrong opinion on financial statements that are materially misstated. It has three parts:
| Component | Plain English | Can the Auditor Control It? | What It Looks Like in a Scenario |
|---|---|---|---|
| Inherent Risk | The natural susceptibility of a balance to misstatement — before any controls. Estimates, judgements, complex transactions, and volatile balances all carry high inherent risk. | No — it exists whether or not you're auditing | A new inventory valuation method, a warranty provision, a property revaluation, a bonus scheme tied to profit |
| Control Risk | The risk that the client's own controls don't catch the misstatement before it reaches the financial statements | No — but you assess it and plan around it | A recently discovered fraud in the finance team, delays in processing accounting records, no segregation of duties |
| Detection Risk | The risk that your audit procedures miss the misstatement. This is the only component you can reduce — by doing more, better testing. | Yes — this is what your response controls | When IR and CR are both high, you must increase the extent and quality of your substantive procedures to bring detection risk down |
In Section B of the AA exam, most scenario-based risks are inherent risks — something about the client's business that makes a balance prone to misstatement. Your job is to spot those factors, link them to a specific financial statement balance, and explain what you'd do about them as the auditor. If you want to understand how audit risk fits into the wider audit process, our ACCA AA technical articles hub covers planning, evidence, and reporting in full.
How This Question Is Marked
I want you to memorise this before you read another word. The mark allocation for audit risk questions in AA is fixed and consistent:
📋 Mark Allocation Per Risk
½ mark — Identification: You name the risk (linked to a specific scenario fact, not just a generic category).
½ mark — Explanation: You explain why it's a risk, naming the specific account and whether it's overstated or understated (or the assertion at risk).
1 mark — Auditor's Response: You describe one specific, practical audit procedure that addresses the risk.
Total: 2 marks per risk. For 8 risks = 16 marks. For 7 risks = 14 marks.
Here's what this tells you practically: two-thirds of your marks (1½ marks out of 2) come from the explanation and response, not the identification. Students who only focus on spotting risks walk away with 8–10 out of 16 when they could have had 14+. The marks are in the quality of what you write after you've spotted the risk.
The 3-Step Formula
Over the years I've taught hundreds of AA students, and the ones who consistently score 75%+ on audit risk questions use this formula — consciously or instinctively — for every single risk they write:
THE 3-STEP AUDIT RISK FORMULA
FACT → RISK → SPECIFIC ACCOUNT + DIRECTION → WHAT THE AUDITOR DOES
½ mark | ½ mark | 1 mark = 2 marks per risk
Think of it as a chain. Each link connects to the next. If you break the chain at any point — if your explanation doesn't connect to your identification, or your response doesn't address the specific risk you identified — you lose marks at that broken link. Let me walk you through each step with examples from recent exam sittings.
Step 1: Identify the Risk — Not Just the Fact
This is the mistake I see most often, and it's painful because it costs the ½ mark for identification even though the student clearly read the scenario carefully.
There's an important difference between a scenario fact and an audit risk. A fact is what the scenario tells you. An audit risk is what that fact means for the financial statements. You need to make that connection explicit in your answer — the marker won't do it for you.
| ❌ Just a Fact (No Mark) | ✅ Audit Risk Identification (½ Mark) |
|---|---|
| "Pimento Co has changed its inventory valuation method." | "Pimento Co has changed its inventory valuation method — there is a risk the new method does not approximate to cost as required by IAS 2, meaning inventory could be misstated." |
| "Survival Solutions Co switched to a cheaper component supplier." | "Survival Solutions Co switched to a cheaper supplier, which has led to increased warranty claims — there is a risk the warranty provision is understated if it has not been increased to reflect the higher level of expected claims." |
| "A fraud was discovered in the finance department." | "A fraud has been discovered in the finance department — there is a risk that not all fraudulent entries have been identified, meaning multiple financial statement balances could be misstated." |
| "There is a new bonus scheme for the finance director based on profit." | "The finance director has a profit-related bonus — this creates an incentive to overstate revenue or understate expenses to inflate reported profit, raising the risk of management bias in key judgements." |
One nuance that trips students up: sometimes two facts in the scenario are actually one risk. In the Survival Solutions sitting, many students correctly identified both "cheaper supplier" and "increased warranty claims" as separate points — but they're two parts of the same risk. The examiner expected them to be linked into one complete identification. If you split them, you only get credit for one.
✅ Vicky's Tip — Step 1:
When reading the scenario, highlight every fact that relates to: (1) a financial statement balance or transaction, (2) a change from prior year, (3) an estimate or judgement, (4) a weak control, (5) an unusual or one-off transaction, (6) a management incentive, or (7) an external event affecting the business. These are your audit risk triggers. I tell my students to aim for 10–12 potential risks in their reading time, then choose the 7 or 8 strongest. You'll always have more material than you need.Step 2: Explain with Assertion and Direction
This is where I see the most unnecessary mark loss. Students identify the risk correctly, then write a vague explanation that doesn't score the ½ mark. Two rules fix this almost entirely.
Rule 1: Name the specific account. "Assets could be overstated" — zero marks. "Property, plant and equipment could be overstated" — marks. "Expenses could be understated" — zero marks. "Depreciation expense could be understated" — marks. The more specific, the safer you are. This applies to every balance — revenue, not "income." Warranty provision, not "liabilities." Trade receivables, not "debtors."
Rule 2: State the direction — overstated or understated. "Misstated" is only valid when a balance could genuinely go either way. If the scenario makes it clear the risk is in one direction, you must name it. Writing "misstated" when the risk is obviously one-directional will cost you the explanation mark.
Using Assertions in Your Explanation
You don't always have to use over/understated. Naming the assertion at risk is an equally valid way to earn the explanation mark. Here's the full set with practical examples:
| Assertion | What It Tests | Typical Trigger in Scenario | Example Explanation |
|---|---|---|---|
| Existence / Occurrence | Assets or transactions actually exist | Fictitious sales, assets disposed of but still on balance sheet, year-end inventory that may not exist | "Inventory may be overstated if slow-moving or obsolete items have not been written down." |
| Completeness | All items that should be recorded have been recorded | Unrecorded liabilities, omitted provisions, year-end cut-off errors | "The warranty provision may be understated if not all anticipated claims arising from the cheaper components have been captured." |
| Valuation / Accuracy | Balances are at the right amount per the applicable standard | Estimates and provisions, inventory at NRV, PPE at fair value (part-exchange), impairment reviews | "PPE may be overstated if the part-exchanged asset has not been measured at fair value as required by IAS 16." |
| Cut-Off | Transactions are in the right period | Delays in recording transactions, year-end sales and purchases, goods in transit | "Revenue may be overstated if sales occurring after the year end have been incorrectly included in the current period due to the delay in processing records." |
| Classification | Items are in the right place in the financial statements | Capital vs. revenue expenditure, current vs. non-current classification, disclosure requirements | "PPE may be overstated and operating expenses understated if repair costs have been incorrectly capitalised." |
| Rights & Obligations | The entity owns/controls assets and owes liabilities | Consignment inventory, leased assets, factored receivables | "Inventory may be overstated if items held on consignment for third parties have been incorrectly included in closing inventory." |
✅ Vicky's Tip — Step 2:
You have three equally valid ways to earn the explanation mark: (1) name the assertion, (2) state overstated/understated, or (3) refer to inherent, control or detection risk. Pick whichever flows most naturally from your identification. What you cannot do is be vague — generic account names and generic directions both score zero. When I mark mocks, I draw a line between "explains the impact on a specific account" and "repeats the scenario fact." Only the first earns the mark. Build this habit and your explanation marks will become automatic.Step 3: Write the Auditor's Response — Not Management's
This is worth 1 mark per risk — the biggest single mark available — and it's the part I see students consistently undersell. Two types of responses appear again and again in scripts that don't score:
⚠️ Two Responses That Score Zero (Every Time)
1. "Discuss with management."
I know it feels like a safe answer. It isn't. "Discuss with management" on its own tells the marker nothing about what you're actually doing as an auditor or what evidence you're gathering. If you want to reference a discussion, you need to say exactly what you're asking about: "Discuss with management the assumptions used in calculating the warranty provision and obtain written representation that all known claims have been captured." Now that's a procedure worth 1 mark.
2. "Increase professional scepticism."
Scepticism is a mindset, not a procedure. You can be sceptical and still do nothing useful. If you want to use scepticism, pair it with a specific test: "Apply increased professional scepticism when reviewing management's fair value estimate for the property — obtain an independent valuation to compare against management's figure." The scepticism tells me your attitude; the test tells me your procedure. Both together = 1 mark.
The other common mistake is writing what management should do rather than what the auditor should do. Management implements controls. The auditor tests and gathers evidence. These are fundamentally different activities. If your response starts with "Management should..." — it's a management action, not an audit procedure.
| ❌ Management Action (No Mark) | ✅ Auditor Procedure (1 Mark) |
|---|---|
| "Management should review the warranty provision and increase it." | "Obtain a breakdown of warranty claims raised since the supplier change and agree to the underlying customer records to assess whether the provision has been calculated on the updated claims experience." |
| "Inventory should be valued at the lower of cost and NRV." | "Obtain a copy of management's new inventory valuation calculations and test whether the methodology produces a result that approximates to cost as required by IAS 2; compare a sample of lines to underlying purchase invoices." |
| "Management should implement controls to prevent further fraud." | "Obtain details of all journal entries posted by the finance department during the year and review for unusual amounts, timing, or approvals that may indicate further fraudulent entries not yet identified." |
| "The finance director should not be given a bonus based on profit." | "Apply increased professional scepticism to revenue recognition and accruals judgements made by the finance director; compare revenue cut-off around the year end to prior periods and investigate significant variances." |
✅ Vicky's Tip — Step 3:
Use this sentence starter for every response: "As the auditor, I would..." — or just start with a verb that belongs to the auditor: obtain, inspect, recalculate, compare, agree, confirm, attend, review, test, trace, observe. These are auditor verbs. "Implement," "ensure," "correct," "increase," "improve" — these are management verbs. If you're using management verbs, you're answering the wrong person's question.Full Worked Examples
Let me show you what a complete 2-mark audit risk answer looks like in practice, using the types of risks that appeared in recent AA exam sittings. I'll use the three-step formula for each one so you can see how the chain works.
Example 1 — Changed Inventory Valuation Method (Pimento Co type)
Scenario Fact: Pimento Co has changed its method of inventory valuation during the year.
Step 1 — Identification (½ mark): Pimento Co has changed its inventory valuation methodology during the year — there is a risk that the new method does not produce a result that approximates to cost as required by IAS 2 Inventories.
Step 2 — Explanation (½ mark): If the new methodology is not appropriate, inventory will be misstated — it could be overstated if the method attributes higher costs than actual cost, or understated if it attributes lower costs. The valuation assertion is at risk.
Step 3 — Auditor Response (1 mark): Obtain management's documentation of the new valuation methodology and assess whether it produces a result that approximates to cost per IAS 2. Test a sample of inventory lines, recalculating the value under both the old and new methods, and investigate any material differences.
Example 2 — Warranty Provision and Cheaper Supplier (Survival Solutions type)
Scenario Fact: Survival Solutions Co switched to a cheaper component supplier during the year, and warranty claims have increased as a result.
Step 1 — Identification (½ mark): The switch to a cheaper supplier has led to increased warranty claims — there is a risk the warranty provision is understated if it has not been recalculated to reflect the higher volume of expected claims arising from the lower-quality components.
Step 2 — Explanation (½ mark): The warranty provision would be understated, meaning liabilities are understated and expenses are understated — the completeness and valuation assertions are both at risk.
Step 3 — Auditor Response (1 mark): Obtain a schedule of all warranty claims received since the supplier change and agree to supporting customer correspondence; recalculate the provision using the updated claims rate and compare to management's figure. Discuss with management the assumptions used, specifically whether the higher claims rate has been incorporated, and obtain written representation confirming management's basis.
Example 3 — Finance Director Profit Bonus
Scenario Fact: The finance director has a bonus scheme linked to the company's reported profit before tax.
Step 1 — Identification (½ mark): The finance director's bonus is linked to profit — this creates an incentive to overstate revenue, understate expenses, or make aggressive accounting judgements that inflate reported profit.
Step 2 — Explanation (½ mark): Revenue may be overstated or provisions and accruals may be understated due to management bias. The occurrence assertion for revenue and the completeness assertion for liabilities are at risk.
Step 3 — Auditor Response (1 mark): Apply increased professional scepticism when reviewing all estimates, provisions and revenue recognition decisions approved by the finance director. Perform detailed cut-off testing around the year end, agree a sample of year-end revenue entries to despatch notes and signed customer orders, and scrutinise any provisions or accruals that have been reduced compared to the prior year.
Example 4 — Delays in Processing Accounting Records
Scenario Fact: Pimento Co experienced significant delays in processing accounting records during the year due to a systems issue.
Step 1 — Identification (½ mark): Delays in processing accounting records increase control risk — there is a higher risk that transactions have not been recorded in the correct period, and errors may have been introduced or gone undetected during the backlog.
Step 2 — Explanation (½ mark): Revenue and expenditure balances could be misstated due to incorrect cut-off. Detection risk is also elevated as the records may be less orderly and harder to audit.
Step 3 — Auditor Response (1 mark): Perform extended cut-off testing around the year end — agree a sample of sales invoices, purchase invoices and journal entries recorded in the final two weeks of the year and first two weeks after year end to supporting documentation to confirm they are recorded in the correct period. Increase the sample size for substantive testing across all affected transaction streams given the elevated control risk.
Valid vs. Invalid Auditor Responses
Use this as a revision reference. Every response on the left is something I've marked as zero in mock scripts. Every response on the right is the corrected version that earns 1 mark:
| ❌ Invalid Response (0 Marks) | ✅ Valid Response (1 Mark) |
|---|---|
| "Discuss with management." | "Discuss with management the specific assumptions underlying the fair value estimate and obtain supporting documentation." |
| "Apply increased professional scepticism." | "Apply increased professional scepticism when reviewing management's revenue cut-off judgements; agree year-end sales to despatch notes and confirm delivery dates." |
| "Inventory should be valued at the lower of cost and NRV." | "Obtain management's NRV calculations and compare to post year-end sales prices; identify any lines selling below cost and test whether a write-down has been recorded." |
| "Management should ensure all warranty claims are recorded." | "Obtain a schedule of warranty claims received after the year end and assess whether they relate to pre year-end sales — use these to evaluate the completeness and adequacy of the provision." |
| "Review the financial statements." | "Review the prior year disclosure note for the lease and compare to the current year note to confirm that all material leases have been correctly classified under IFRS 16." |
| "Perform substantive testing." | "Perform a detailed recalculation of the depreciation charge for all asset classes and agree useful lives and residual values to management's most recent review." |
📚 Build Audit Risk Skills with the Right Study Materials
The fastest way to internalise this formula is scenario practice with immediate feedback. Our ACCA AA Online Course at Eduyush includes full case-based mock exams covering audit risk, internal controls, evidence, and reporting — at regional pricing significantly below list price. Not sure where AA sits in your overall ACCA journey? Read our guide on whether to do FR or Audit first.
8 Mistakes That Cost Candidates Marks
These are the mistakes I've seen most consistently across both recent AA sittings. Each one is avoidable — if you know about it before you sit the exam.
⚠️ The 8 Most Common Audit Risk Mistakes in AA
1. Copying the scenario fact without turning it into a risk. Identification requires you to explain the financial statement implication, not just repeat what the scenario said. Always connect the fact to a balance and a potential misstatement.
2. Using generic account names. "Assets overstated" — zero. "Property, plant and equipment overstated" — marks. "Expenses understated" — zero. "Depreciation charge understated" — marks. The account name must match the specific balance at risk.
3. Writing "misstated" when the direction is clear. If the scenario shows a clear risk of overstatement, write overstated. Misstated as a hedge will cost you the explanation mark.
4. "Discuss with management" as the full response. Without specifying what you're discussing and what evidence you're seeking, this is not an audit procedure and scores zero.
5. "Increase professional scepticism" as the full response. Scepticism without a specific test scores zero. Always pair it with a procedure.
6. Stating the correct accounting treatment rather than the audit test. Telling me that IAS 2 requires inventory at the lower of cost and NRV is not an audit procedure. Telling me you'll test NRV by comparing inventory lines to post year-end sales prices — that's a procedure.
7. Splitting linked facts into two separate risks. When two scenario facts together create one risk (e.g., cheaper supplier + increased claims = understated provision), present them as one complete risk identification. Splitting them earns credit for only one.
8. Identifying a fact that isn't actually an audit risk. In MJ25, many students flagged the internal audit department's 24-month visit schedule as an audit risk — the examiner confirmed this was not a risk the external auditor would be concerned with. Only identify risks that create a possibility of material misstatement in the financial statements.
Exam Technique: How to Read the Scenario
The AA exam gives you a detailed business scenario with multiple exhibits. How you read that scenario in your planning time determines how many risks you identify — and how well you can apply them. Here's the approach I teach in every AA coaching session:
📋 Scenario Reading Checklist
Step 1 — Read the requirement first. Before you read the scenario, read what you're being asked. Underline the task verb and the specific focus. This tells you what to look for.
Step 2 — Read the scenario and annotate. For each paragraph, ask: does this fact create a risk that a balance is wrong? Mark it with a highlighter or a note. Don't stop to write your answer — just identify candidate risks first.
Step 3 — Look for the 7 risk trigger categories: (1) changes from prior year, (2) accounting estimates and judgements, (3) unusual/complex transactions, (4) management incentives, (5) weak controls, (6) external events affecting the business, (7) new accounting standards or policies applied for the first time.
Step 4 — Select your strongest risks. You'll typically have more material than marks. Choose risks where you can write a complete three-part answer — identification, specific explanation, and a precise procedure. Avoid risks where you can only identify the fact but can't think of a clear auditor response.
Step 5 — Write using the formula. Fact → Risk → Account + Direction → Auditor Procedure. Check each answer before moving to the next: does my response start with an auditor verb? Have I named the specific account? Have I stated a direction or assertion?
Time management matters here too. With 14–16 marks available and a typical AA time allocation, you have roughly 2–2.5 minutes per risk. If you're spending 4 minutes on one risk, you're losing marks elsewhere. Practice under time conditions using past papers — our How to Pass ACCA AA guide includes a full study and practice plan for all Section B question types.
Related AA Exam tips
- Substantive Procedure vs Tests of Control
- AA Audit Risk questions
- Internal control deficiencies - how to answer
FAQ
About the Author
Vicky Sarin, CA | INSEAD
Vicky has 25+ years of experience in audit, financial reporting, and professional qualification coaching. She has guided hundreds of ACCA students through AA and AAA, and her practical, technique-first teaching approach has consistently produced above-average pass rates across both papers.
For ACCA AA study materials, mock exams, and course options, visit the Eduyush ACCA AA course page. For the complete ACCA AA study resource list, see our AA technical articles guide. Planning your full ACCA journey? Our How to Pass ACCA AA guide and How to Pass ACCA AAA guide have everything you need.
Popular posts
Featured product
Featured product
ACCA Books
Get 50% off original BPP & KAPLAN ACCA books. Study smarter, save bigger today!
BPP Online lectures
BPP online lectures at India pricing – under £55/subject. Learn smart, pay less.
FAQs
How can I prepare for the ACCA exams?
There are several ways to prepare for the ACCA exams, including studying the exam syllabus and practicing past exam questions. You can also attend review courses or hire a tutor to help you prepare. It's also a good idea to create a study schedule and stick to it, and to take breaks and pace yourself during your studies.
What should I do if I fail an ACCA exam?
If you fail an ACCA exam, you will need to re-register and pay the exam fees again. You may also want to consider reviewing the exam syllabus and studying more before attempting the exam again. It's also a good idea to talk to your tutor or mentor for guidance and to get feedback on where you may have gone wrong.
How many attempts do I have to pass the ACCA exams?
There is no limit to the number of times you can attempt the ACCA exams, but you will need to pay the exam fees each time you register. It's a good idea to carefully review the exam syllabus and consider seeking additional help if you are struggling to pass the exams after multiple attempts.
How often are ACCA exams held?
ACCA Exams are held four times a year for skill level and strategic level exams. These are held every quarter
March, June, September and December
What is the difference CA and ACCA in india?
The CA (Chartered Accountant) qualification is offered by the Institute of Chartered Accountants of India (ICAI). The ACCA qualification is offered by the Association of Chartered Certified Accountants (ACCA).
The CA qualification has been in existence for over 150 years, and is a globally recognised qualification. The ACCA qualification has been in existence for over 100 years, and is also a globally recognised qualification.
The CA qualification is available in India only, while the ACCA qualification is available in over 180 countries.
How many marks should be scored in the ACCA subjects?
The ACCA subjects are assessed on a 100-point scale. The pass mark is 50 points. A score of 60 or more is required to achieve the grades of distinction, credit, and merit.
Is Eduyush.com an ACCA RLP?
Yes. Eduyush (Yush Consultants) is anACCA Registered Learning Partnerfor DipIFR online classes. Verify our RLP status on ACCA's official directory →
Which is the hardest ACCA paper?
The hardest ACCA paper is the F5 performance management paper. This is because it requires a detailed knowledge of financial accounting and management accounting in order to pass.
Other papers that are difficult include the F7 financial reporting paper and the P2 advanced auditing and assurance paper. However, all of the ACCA papers are challenging, so it is important to thoroughly prepare for each one before sitting the exam.
Leave a comment