Internal Control Deficiencies in ACCA AA: Exam Guide

Internal control deficiency questions in ACCA AA are high-value and highly predictable. They typically carry 14–18 marks in Section B and follow the same pattern every sitting: identify the deficiency, explain the implication, recommend a control, and often describe a test of control.

Yet every year, candidates lose easy marks for the same reasons: copying scenario facts instead of identifying the actual deficiency, writing vague “fraud/error” explanations, and phrasing recommendations as objectives — “ensure that…” — instead of concrete actions. This guide gives you a clear, repeatable framework to avoid those traps and turn internal control questions into a scoring opportunity.

How Internal Control Deficiency Questions Are Marked

Although the scenario and company change each sitting, the marking logic doesn’t. When a requirement says:

“Identify and explain EIGHT deficiencies in the system of internal control and provide a control recommendation to address each deficiency.”

the marks are almost always allocated like this:

Examiner summaries and tutor analysis reflect the same point: the majority of marks lie in the quality of your explanation and recommendation, not just spotting the issue. A copied sentence from the scenario with “this could lead to fraud/error” on the end rarely scores more than ½ mark.

The 4-Step Framework: Identify → Explain → Recommend → Test

To make sure you always cover all the marks available, use this simple internal control answer formula:

Think of it as a mini-story for each deficiency:

• What is wrong? (Deficiency)
• Why does it matter? (Implication)
• What should management do? (Recommendation)
• How will the auditor check it works? (Test of control)

If any link in that chain is missing or vague, you lose marks at that point.

Step 1: How to Identify a Control Deficiency (Not Just a Fact)

A deficiency is a weakness in the system — something that increases the risk that errors or fraud won’t be prevented or detected. Many candidates copy a line from the scenario and call it a deficiency. The examiner comments every year that this is not enough.

Here’s the difference:

In each case, the deficiency identification makes the weakness explicit (no segregation, no independent authorisation, movements allowed, no review), not just the fact.

Step 2: How to Explain the Implication to the Business

This is where many candidates lose marks. They write exactly the same explanation for every deficiency: “this could lead to fraud and error.” The examiner comments make it clear this generic explanation is not enough. You must show you understand how this particular weakness could cause a specific problem.

Use this pattern:

Let’s apply that to the earlier examples:

Step 3: How to Recommend a Practical Control (Avoid “Ensure That…”)

Now we fix the system. Here is where many candidates throw away the easiest mark. The examiner guidance is crystal clear:

“Ensure that…” describes an objective (what you want the system to achieve), not an action (what staff will actually do). To score the full mark, your recommendation must:

• Be an action, not an outcome
• Address the specific deficiency you identified
• Be practical in the context of the scenario

Use this pattern:

Let’s rewrite the earlier deficiencies into strong recommendations:

Step 4: How to Write a Test of Control in ACCA AA

Many internal control questions also ask for tests of controls for each control you recommend. This is where you switch from management’s perspective (what they should do) to the auditor’s perspective (how you will test that they’re doing it).

A valid test of control must:

• Focus on the auditor’s action, not management’s
• Provide evidence the specific control operates as described
• Use methods like inspection, re-performance, enquiry + corroboration, or observation

Use this pattern:

A few examples, continuing our earlier chains:

Worked Examples: Cash, Sales, Purchases, Payroll, Inventory

Let’s put all four steps together for a few classic AA internal control areas. Notice how each deficiency is answered using the same chain: identify → explain → recommend → test.

1. Cash Receipts — Lack of Segregation

Deficiency: The same clerk opens post, records cash received in the cash book and prepares the bank reconciliation.

Implication: The clerk could steal cash received from customers and conceal this by not recording the receipts or by manipulating the reconciliation, leading to cash at bank and revenue being understated and fraud remaining undetected.

Control Recommendation: Segregate duties so that one clerk opens post and prepares a daily list of cash and cheques received, a second clerk records receipts in the cash book and posts to receivables, and a senior person independent of these tasks prepares and reviews the bank reconciliation, comparing it to the cash book and daily remittance list.

Test of Control: Inspect a sample of monthly bank reconciliations and confirm that the preparer and reviewer are different individuals by checking signatures against the staff list, and agree cash book receipts for selected days to the daily remittance list and bank statements.

2. Sales & Credit Notes — No Independent Review

Deficiency: Sales staff can issue credit notes for returns and allowances without any review or authorisation.

Implication: Staff could issue credit notes inappropriately (for friends, to hide theft of cash, or to manipulate sales figures), leading to revenue and receivables being understated and weakening control over cash collection.

Control Recommendation: Require that all credit notes above a specified threshold are authorised by the credit controller or finance manager before processing, evidenced by their signature or electronic approval on the credit note.

Test of Control: Inspect a sample of credit notes above the threshold and confirm that each bears the authorising signature or approval of the credit controller/finance manager, and that no credit notes have been processed without such approval.

3. Purchases — Missing Matching of Documents

Deficiency: The purchase ledger clerk posts purchase invoices directly to the ledger without matching them to purchase orders and goods received notes.

Implication: Invoices could be recorded and paid for goods or services that were not ordered or not received, leading to purchases and trade payables being overstated and increasing the risk of fraud through fictitious suppliers.

Control Recommendation: Implement a three-way match policy so that invoices are only approved for recording and payment after the quantities and prices agree to an authorised purchase order and to a goods received note, with evidence of this check on each invoice.

Test of Control: Inspect a sample of recorded purchase invoices and confirm that each is matched to a purchase order and goods received note, and that the matching has been evidenced (e.g. by initials or a “matched” stamp) before the invoice was processed.

4. Payroll — No Review of Changes

Deficiency: Payroll clerks can amend employee pay rates and bank details directly on the payroll system without independent review.

Implication: Payroll staff could increase their own pay rate or divert salaries to their own bank accounts, resulting in payroll expenses being overstated and unauthorised payments being made.

Control Recommendation: Require that all changes to pay rates and bank details are supported by authorised change forms from HR, and that a senior payroll supervisor reviews a change report each month, comparing it to authorised forms.

Test of Control: Inspect a sample of payroll change reports and trace changes to signed HR authorisation forms; confirm that the payroll supervisor has evidenced their review of the change report each month.

5. Inventory — Movements During the Count

Deficiency: The warehouse continues to dispatch and receive goods during the inventory count without maintaining movement records.

Implication: Items may be moved after being counted or before being counted, leading to stock being double counted or omitted, so inventory and cost of sales could be misstated.

Control Recommendation: Close the warehouse to movements during the count where possible; if not, record all despatches and receipts on inventory movement sheets during the count and adjust count sheets for these movements before finalising the inventory figure.

Test of Control: Attend the inventory count to observe whether warehouse movements are halted or recorded on movement sheets, and review a sample of movement sheets to confirm that adjustments have been made to the relevant count sheets.

Top 7 Mistakes to Avoid (Examiner-Backed)

Pulling together patterns from recent examiner reports and tutor analyses, these are the most common — and most avoidable — errors in internal control deficiency answers:

How Many Deficiencies Should You Write in AA Section B?

AA internal control questions normally tell you exactly how many deficiencies to identify — for example, “identify and explain EIGHT deficiencies...” If the number is given, aim to write exactly that many, each with a full explanation and recommendation (and test if required).

As a rule of thumb:

• 18-mark controls question → typically 6 deficiencies with identify + explain + recommend + tests; or 8 deficiencies without tests
• 16-mark controls question → typically 8 deficiencies with identify + explain + recommend

Remember that published model answers are more detailed than any candidate is expected to produce in the exam. Focus on clear, exam-length sentences using the four-step framework, not on matching every line of the model solution.

Related AA Exam tips

• Substantive Procedure vs Tests of Control
• AA Audit Risk questions
• Internal control deficiencies - how to answer

FAQ