IER Framework: Stop Losing 10 Marks on ACCA AA Deficiency Questions

by Eduyush Team

FACULTY INSIGHT

The IER Framework: Stop Losing 10 Marks on ACCA AA Control Deficiency Questions

Master the Identify → Explain → Recommend structure that examiners demand — and start banking every mark in AA Section B.

Every single examiner report from December 2023 through to September/December 2025 says the same thing: candidates identify the deficiency, then stop. One sentence. Move on. And in doing that, they throw away a guaranteed ½ mark — sometimes a full mark — on every single deficiency point. On a 16-mark Section B question, that's 6–8 marks disappearing before a single incorrect answer is written.

I've taught AA candidates across India, the UAE, and Singapore for years, and this is the most consistent, preventable loss I see. It's not a knowledge problem. You know what a segregation of duties failure looks like. The problem is structural — you're not giving the examiner the three things they're trained to award marks for. In this post I'm going to give you the IER Framework — Identify, Explain, Recommend — and show you exactly how it works across real exam scenarios. Use this template in every deficiency question and you won't lose these marks again. If you're preparing for the ACCA AA exam, this is the most important post you'll read this week.

AA Control Deficiency Questions in 30 Seconds

Before we go deep, here's the complete mark scheme in one table. Print it. Stick it above your desk. Every deficiency question in the AA exam follows this exact structure.

IER Step	What You Must Do	Marks	Most Common Failure
I — Identify	State the specific deficiency from the scenario — the gap, not the scenario fact	½ mark	Copy-pasting the scenario wording instead of stating the actual gap
E — Explain	Explain the specific business consequence of this deficiency	½ mark	Writing "this could lead to fraud or error" — too generic, not awarded
R — Recommend	Describe a detailed, actionable control with who, what, and how often	1 mark	Phrasing as "ensure that…" (objective, not action) — earns only ½ mark
Total per deficiency point		2 marks	6–8 deficiencies = 12–16 marks at stake per question

That's the whole game. Every deficiency question you'll ever face in an AA exam runs on this structure. Now let's break down each step so you know exactly what to write.

I — Identify the Deficiency (The ½ Mark Most People Think They've Already Got)

Here's something that surprises students: you can lose the identification mark even when you've spotted the right issue. The examiner isn't checking whether you found the problem — they're checking whether you've correctly stated what the deficiency actually is.

Key Insight

The deficiency is not the scenario fact — it's the gap the fact reveals. If the scenario says "two directors are subject to re-election on a rotational basis," copying that earns zero marks. The deficiency is that re-election does not happen frequently enough. That's the gap you need to name.

When reading a scenario, ask: "What control is missing or broken here?" Not "what does the scenario say?" but "what should be happening that isn't?" Train yourself to look for these four red flags:

One person, multiple incompatible duties → segregation of duties failure
Transactions with no evidence of approval → authorisation control missing
Reconciliations or reviews that don't happen regularly → periodic review absent
Documents not being matched, checked or filed → completeness or accuracy control weakness

Understanding control design from first principles — what a well-designed control looks like before you look for gaps — is exactly what CIA Part 2 engagement planning builds. When you know what good looks like, spotting the deficiency becomes much faster under exam pressure.

E — Explain the Implication (The ½ Mark Almost Everyone Misses)

This is where most candidates lose marks on every single deficiency point, and they don't even realise it. I've reviewed hundreds of student scripts across India and the Middle East. The pattern is always the same: identify, then immediately jump to the recommendation, with the explanation skipped entirely. Or worse — "this could lead to fraud or error." The examiner will not award that. Every deficiency can lead to fraud or error. You need to say how this specific deficiency leads to a specific named consequence.

The Examiner's Rule

"This could result in fraud" is not an implication. The explanation needs to be specific to the deficiency and explain the actual business impact. Direct from the SD25 examiner report: stating "this will result in fraud/error" without explaining how is not sufficient for the mark.

Here's the formula I use with all my students:

The IER Implication Formula:

[Deficiency] → therefore → [what can happen as a direct result] → which means → [specific named business impact]

Example: "One clerk handles several elements of the cash receipts cycle → therefore there is no independent check on their work → which means errors may not be identified on a timely basis and fraud could go undetected, resulting in misappropriation of cash."

Notice the difference between "this could lead to fraud" and "fraud could go undetected, resulting in misappropriation of cash." The second is scenario-specific and names a real business consequence. The examiner is checking whether you understand the scenario's business context, not just reciting definitions.

This kind of analytical thinking — connecting a control gap to its downstream risk consequence — is precisely what the CIA Part 2 syllabus trains you to do. If you've studied CIA Part 2 control evaluation, the E step in IER feels natural. For AA candidates who haven't, practise the implication formula until it's automatic.

R — Recommend a Control That Earns the Full Mark (Not Just Half)

The recommendation carries 1 full mark — the highest single allocation per deficiency point. But here's the catch: it's internally split as two ½ marks. You need to (a) correctly identify what the control should be, and (b) provide enough operational detail about how it works. Most students get the first ½ and lose the second by stopping too soon.

The Recommendation Test

Ask yourself: If a manager read this recommendation, would they know exactly what to do, who should do it, and how often? If not, add the who, the how, and the frequency. That's the second ½ mark.

Three traps I see constantly — and how to avoid them:

Trap 1 — The Objective, Not the Action ("Ensure That…"): "Ensure that invoices are sequentially numbered" is an objective. ½ mark only. Full mark answer: "Invoices should be sequentially numbered, and a supervisor should perform regular sequence checks to identify any missing numbers and investigate promptly."

Trap 2 — The Converse of the Deficiency: "The credit controller should chase outstanding debts" is just the mirror of the deficiency. ½ mark only. Full mark answer: "The credit controller should review the aged receivables listing at least monthly, identify all balances overdue beyond agreed terms, and follow up with formal reminder letters at 30, 60 and 90 day intervals, escalating to the finance manager for balances exceeding a set threshold."

Trap 3 — Impractical Recommendations: Always re-read the scenario before recommending. If the scenario tells you inventory movements must continue during the count, recommending they stop earns zero. Recommend a cut-off procedure instead — documenting movements separately and adjusting count sheets in real time. The examiner penalises impractical suggestions that ignore the scenario context.

For the detailed control design frameworks that underpin strong recommendations, our BPP ACCA AA Study Text eBook covers this in depth with past exam worked examples across all major business cycles.

The IER Template You Can Use in Every AA Exam

I want to give you something you can physically use in your exam. Copy this template into your notes. When you face a deficiency question, work through it point by point — one IER block per deficiency.

IER Answer Template (copy into every deficiency answer)

I — Identify: The deficiency is that _____________________ [state the gap, not the scenario fact].

E — Explain: This means that _____________________ [specific consequence], which could result in _____________________ [named business impact — e.g. irrecoverable receivables / misappropriation of cash / overstated payroll].

R — Recommend: _____________________ [responsible party] should _____________________ [specific action] _____________________ [how often / at what point in the process], in order to _____________________ [purpose of the control].

That template works for every deficiency type — segregation of duties, authorisation controls, periodic reviews, IT access controls, and corporate governance deficiencies. Once you've internalised it, the structure becomes automatic and you stop losing the explanation mark.

Bad vs. Good: 3 Worked Examples with Full IER Scoring

Here are the three deficiency types that appear most consistently in AA exam scenarios — segregation of duties, authorisation controls, and periodic review. These come directly from the patterns I've tracked across multiple sitting examiner reports. I've also seen these discussed in our ACCA AA exam resources.

Example 1: Segregation of Duties Failure

Scenario: One accounts clerk raises purchase orders, receives supplier invoices, and also authorises payments.

❌ Weak Answer (earns 1 mark only): "There is a lack of segregation of duties. The company should separate these duties between different staff members."
Why it fails: Identification ½ mark — yes. Explanation — missing entirely. Recommendation — too vague, no who, no how, earns only ½ mark.

✅ Full IER Answer (earns 2 marks):
I (½ mark): One clerk is responsible for raising purchase orders, receiving invoices, and authorising payments — incompatible duties are not separated.
E (½ mark): This means the clerk could create fictitious purchase orders and approve fraudulent payments without any independent check, increasing the risk of misappropriation of company funds that may go undetected for a significant period.
R (1 mark): Duties should be separated across at least two staff members — one responsible for raising purchase orders, a separate individual for receiving and matching invoices to orders, and a senior manager or finance director authorising payment runs weekly. An independent review of the payment listing should also be performed by the finance manager before funds are released.

Example 2: Authorisation Control Missing

Scenario: Credit checks are not performed before new customer accounts are opened.

❌ Weak Answer (earns 1 mark only): "The company does not carry out credit checks on new customers. Credit checks should be done for all new customers."
Why it fails: Identification ½ — yes. Explanation — missing. Recommendation — too vague, earns only ½ mark.

✅ Full IER Answer (earns 2 marks):
I (½ mark): No credit checks are performed before new customer accounts are opened.
E (½ mark): If credit checks are not performed, sales may be made to customers who are not creditworthy, resulting in irrecoverable receivables and a direct financial loss to the business.
R (1 mark): A formal credit check should be completed by the credit control team for all new customers prior to account creation, using an external credit reference agency. A credit limit should be set, documented on the customer account, reviewed annually, and automatically flagged when any order exceeds the approved limit.

Example 3: Periodic Review Absent

Scenario: The aged receivables listing is not reviewed or actioned by the credit controller.

❌ Weak Answer (earns ½ mark only): "The credit controller should chase outstanding debts."
Why it fails: This is just the converse of the deficiency — no mechanism, no explanation. ½ mark at most.

✅ Full IER Answer (earns 2 marks):
I (½ mark): Outstanding debts are not being chased because the aged receivables listing is not being reviewed by the credit controller.
E (½ mark): Overdue balances will go unpursued, increasing the risk of irrecoverable receivables that overstate the net realisable value of trade receivables in the financial statements.
R (1 mark): The credit controller should review the aged receivables listing at least monthly, identify all balances outstanding beyond agreed credit terms, and follow up with formal reminder letters and telephone calls at 30, 60 and 90 day intervals. Balances above a set threshold should be escalated to the finance manager monthly with a written report.

Why Smart Students Still Lose These Marks

I want to talk about something more honest for a moment, because I hear versions of this from students in India and across Asia every sitting:

"I knew the answer. I just didn't write enough."

What's really happening:

You identified the deficiency in your head but only wrote one sentence on paper. The examiner marks what you write, not what you know. The IER template fixes this — it forces you to produce all three parts before moving on.

"I thought 'fraud or error' was a valid implication."

What's really happening:

It feels like an answer, but it's a generic placeholder. Every control that exists is there to prevent fraud or error. The examiner needs the specific type of fraud or error this particular gap enables — misappropriation of cash, irrecoverable receivables, overstated payroll.

"I didn't know the implication was marked separately."

What's really happening:

Most students discover this in their first sitting, then fix it in the second. Don't wait for that. The marking scheme explicitly awards ½ mark for explanation on every deficiency point. It's never been bundled into the identification mark.

"I ran out of time and cut my recommendations short."

What's really happening:

This is a time management signal, not a knowledge gap. Use the IER template to write faster, not longer — tight, structured sentences per step rather than prose paragraphs. Two or three sentences per step is enough when they hit the right points.

What the Examiner Reports Actually Say

Across five consecutive AA sittings (D23 through SD25), the examiner has repeated the same observation: candidates fail to explain the implication and miss the ½ mark available at that step. They also routinely provide recommendations phrased as "ensure that…" which are objectives, not controls, and earn only ½ mark instead of a full mark. In the SD25 report, the examiner specifically noted that stating "this will result in fraud/error" without articulating how is insufficient — the explanation must be complete and scenario-specific. Additionally, several candidates provided tests of controls where control recommendations were required, demonstrating a fundamental confusion between what the auditor does and what management should do.

— Based on ACCA AA Examiner Reports (D23, MJ24, SD24, MJ25, SD25) & eduyush Student Performance Data

🎯

Ready to Apply IER Across Every AA Section B Question?

Our ACCA AA BPP ECR course is built around exactly this exam technique — structured, examiner-aligned, and proven with students across India and Asia. Working professionals looking to add CIA-level control knowledge alongside AA will find our Surgent CIA course the perfect self-paced companion.

ACCA AA (BPP ECR) CIA with Surgent AA eBook

Why the IER Framework Works Beyond ACCA AA

One thing I emphasise to all my students — the IER structure isn't just an AA exam technique. It's the way internal audit professionals communicate findings in the real world, and in professional qualifications beyond AA.

In the CIA (Certified Internal Auditor): CIA Part 2 covers engagement findings, which follow exactly the IER structure — condition (the deficiency), effect (the implication), and recommendation. If you plan to sit the CIA after AA, you're reinforcing the same analytical pattern. Our CIA engagement planning guide shows how GIAS maps directly to this framework.

In Internal Audit practice: Every audit finding report — whether in SOX compliance, ISO certification, or risk-based internal audit — is structured as deficiency, impact, and recommendation. Companies in India, the UAE, and Singapore increasingly expect junior auditors to communicate in exactly this format. Mastering IER now builds a professional habit that outlasts the exam.

In CIA Part 2 specifically: The 2026 CIA Part 2 syllabus emphasises control evaluation and engagement findings more than ever. If you're considering the CIA — especially if you're a working professional who wants a globally recognised qualification — understanding how IER maps to CIA Part 2 content is a strong motivation to pursue both.

Questions Students Ask About AA Deficiency Questions

How many marks is a deficiency worth in the AA exam?

Each deficiency point is worth 2 marks in total: ½ mark for identifying the deficiency, ½ mark for explaining the implication, and 1 mark for the control recommendation. A typical Section B deficiency question asks for 6–8 deficiencies, meaning the question is worth 12–16 marks. This makes it one of the highest-value question types in the paper, and the IER framework is designed to help you pick up all 2 marks on every point rather than just 1.

Do I always need to include an implication even if the question doesn't ask for one?

Yes — almost always. Even when the question wording says "identify deficiencies and provide recommendations," the marking scheme almost always includes ½ mark for the explanation at each deficiency point. The examiner reports from MJ24, SD24, MJ25, and SD25 all confirm this. Including the implication never costs marks; omitting it almost always does. Make it a non-negotiable step in your IER routine regardless of how the requirement is phrased.

What happens if I skip the recommendation and just explain the deficiency well?

You'll earn 1 mark (identification ½ + explanation ½) instead of 2 marks. The recommendation is the single highest-value element per point — 1 full mark compared to ½ mark each for identify and explain. Skipping it for even half your deficiency points on a 16-mark question costs you 4 marks. Use the IER template to ensure you always complete all three steps.

How detailed should my recommendation be?

Detailed enough that a named person in the business could act on it immediately. The recommendation needs: (1) who does it — a specific role, not just "the company"; (2) what they do — the specific control action; and (3) how often or at what trigger point. Two to three focused sentences that hit those three elements will almost always earn the full mark. Avoid vague language like "ensure that," "make sure," or "the company should consider" — these signal an objective rather than an action and typically earn only ½ mark.

Are recommendations and tests of controls the same thing?

No — they are completely different, and confusing them is one of the most common mistakes in AA. A control recommendation describes what management should do to prevent a misstatement or fraud risk — it's a management action. A test of control describes what the auditor does to check whether a control is operating effectively — it's an audit procedure. The SD25 examiner explicitly flagged that many candidates provided tests of controls when recommendations were required. A quick test: does your recommendation start with "the auditor should"? If yes, rewrite it as a management action.

Can I use bullet points in my deficiency answers?

Yes, and I'd actually encourage a structured format that maps clearly to the IER steps. Label each part — "Deficiency:", "Implication:", "Recommendation:" — so the examiner can award marks efficiently. This also stops you skipping the explanation step by accident. The IER template in this post is designed to be used exactly like this in your exam answer book.

Does IER apply to corporate governance deficiency questions too?

Absolutely — the SD25 examiner confirmed the same structure applies to governance questions: ½ mark for identifying the governance deficiency, ½ mark for explaining the implication in governance terms (independence, accountability, board oversight), and 1 mark for a detailed, actionable recommendation ensuring compliance with governance principles. The only adjustment is that your implication should reference a governance principle rather than a financial statement impact. The template and the mark structure are identical.

What are the most common AA exam deficiency mistakes?

Based on examiner reports across five sittings (D23–SD25): (1) skipping the explanation entirely; (2) writing "could lead to fraud or error" as the explanation — too generic; (3) recommendations phrased as "ensure that" — objectives not actions; (4) incomplete recommendations that omit who is responsible or how often; (5) impractical recommendations that ignore scenario constraints; (6) providing tests of controls instead of management recommendations; and (7) copy-pasting scenario wording as the deficiency identification rather than stating the actual gap.

Is the CIA useful if I want to deepen my control knowledge for AA?

Yes — genuinely and practically. CIA Part 1 covers the five components of internal control in depth, including control design and operating effectiveness. CIA Part 2 covers control evaluation and audit findings, which is the professional version of exactly what AA tests in deficiency questions. Many of my students who've studied both find AA Section B significantly easier because they're applying professional-level control knowledge rather than exam technique alone. If you're a working professional in India or Asia, the CIA study plan guide explains how to combine CIA and ACCA preparation efficiently using Surgent's self-paced platform.

How CIA Knowledge Makes IER Effortless

I want to be direct about something I believe strongly: if you're a working professional in India or Asia who wants to take audit seriously, the CIA qualification and the ACCA AA sit together better than almost any other combination in the market. And not just for career reasons.

The CIA's internal control framework — Part 1 on control design, Part 2 on control evaluation and findings — is the professional version of exactly what the IER framework asks you to demonstrate in AA. When a CIA candidate looks at a deficiency scenario, they're not applying an exam technique. They're applying professional knowledge. The E step (explain the implication) stops being hard when you've studied how control gaps translate to risk exposure in CIA Part 2.

For working professionals who can't commit to fixed class schedules, the Surgent CIA course is built around self-paced adaptive learning — you study around your job, not the other way around. It's recognised in 170+ countries including a strong and growing community in India, UAE, and Singapore. Not sure where to start? Our guide on CIA exam order explains the best sequence for working professionals, and our CIA study material guide for India covers exactly what you need per part.

🚀

Stop Losing 8+ Marks on Deficiency Questions — Start Using IER Today

The framework is three steps. The template is one page. The difference between a pass and a fail on Section B is often exactly these marks. Our ACCA AA BPP ECR course is built around this exam technique — structured, examiner-aligned, and proven across students in India and Asia.

Master AA Exam Topics Start Your CIA Journey

Back to ACCA exam articles and tips

IER Framework: Stop Losing 10 Marks on ACCA AA Deficiency Questions

The IER Framework: Stop Losing 10 Marks on ACCA AA Control Deficiency Questions

AA Control Deficiency Questions in 30 Seconds

I — Identify the Deficiency (The ½ Mark Most People Think They've Already Got)

E — Explain the Implication (The ½ Mark Almost Everyone Misses)

R — Recommend a Control That Earns the Full Mark (Not Just Half)

The IER Template You Can Use in Every AA Exam