ACCA AA common mistakes
ACCA AA · Understand the traps and how to avoid them.
Answering 'what is audit risk' by listing only the risk that the auditor gives the wrong opinion, omitting that audit risk is the risk that the auditor expresses an inappropriate opinion when the financial statements are materially misstated, and failing to break it into inherent, control and detection risk components.
Candidates memorise the phrase 'audit risk' but never learn its model, so they produce a one-line definition and lose the marks for the three components and their interaction.
What to do instead
Write out the model from memory: Audit risk = Inherent risk × Control risk × Detection risk, define each in one sentence, and practise explaining how a change in one component (e.g. weak controls) affects the others and the nature/extent/timing of procedures.
When asked to identify risks in a scenario, candidates list generic business risks (e.g. 'competition may reduce sales') rather than risks of material misstatement in the financial statements, and do not link each risk to a specific assertion and account balance.
The word 'risk' triggers everyday business thinking; candidates do not convert the scenario fact into an audit consequence for a named figure or disclosure.
What to do instead
Use a fixed three-part sentence for every risk: 'Because [scenario fact], there is a risk that [account balance/class of transactions] is overstated/understated, affecting the [assertion] assertion.' Practise on past scenario questions until the pattern is automatic.
Confusing the responsibilities of management and the auditor, for example stating the auditor prepares the financial statements, or that the auditor guarantees the accounts are free from error, or that the auditor is responsible for detecting all fraud.
Candidates blur the assurance engagement into a preparation or guarantee role because the distinction is not drilled and the concept of 'reasonable assurance' is misunderstood.
What to do instead
Learn the split explicitly: management prepares the FS, maintains internal control and prevents/detects fraud; the auditor obtains reasonable (not absolute) assurance and gives an opinion. Write out the phrase 'reasonable assurance, not a guarantee' and the fraud responsibility split until recall is exact.
Describing internal controls only as 'the company should have good controls' instead of specifying the control activity (authorisation, segregation of duties, reconciliation, physical control, information processing control) and the specific risk it addresses.
Candidates know control categories in the abstract but cannot apply them to a described process, so answers stay vague and earn no application marks.
What to do instead
For each control activity, memorise one concrete example and the risk it mitigates (e.g. segregation of duties between recording cash receipts and reconciling the bank account mitigates misappropriation). Practise writing controls as 'Who does what, using which document, checked by whom'.
Recommending an increase in the sample size as the only response to a risk, without adjusting the nature or timing of procedures, and without linking the response to the assessed risk level.
Candidates default to 'test more' because it is easy to write, missing that the syllabus expects a tailored response combining nature, timing and extent.
What to do instead
For each risk, answer three prompts: what procedure (nature), when (timing, e.g. year-end rather than interim), and how much (extent). State the direction: higher risk means more reliable evidence, more year-end work and larger samples.
Treating analytical procedures as a single technique used only at the planning stage, and failing to state that they are also required at the overall review stage and can be used as substantive procedures.
Candidates learn analytical procedures in one chapter and never map them across the audit timeline, so they miss the mandatory review-stage use.
What to do instead
Build a timeline: analytical procedures at planning (risk identification), as substantive procedures (when data is predictable and reliable), and at final review (required by standards). Note the ISA requirement for the review-stage use and the need to investigate significant unexpected fluctuations.
Confusing the types of audit opinion and when each is appropriate, for example giving a qualified opinion for a material but not pervasive misstatement and an adverse opinion for a pervasive limitation of scope, or using an emphasis of matter paragraph to fix a misstatement.
The decision tree (material vs pervasive; misstatement vs limitation of scope) is memorised as isolated labels rather than as a two-dimensional table, so candidates misplace the categories.
What to do instead
Draw and memorise the 2×2 grid: misstatement (material = qualified, pervasive = adverse) and inability to obtain evidence (material = qualified, pervasive = disclaimer). Learn that emphasis of matter only highlights properly presented matters and never corrects a misstatement.
Writing that the auditor 'checks' or 'verifies' figures without naming the source document, the direction of testing, or the assertion being tested, so evidence answers lack the professional specificity the marker rewards.
Candidates describe the purpose ('to confirm receivables exist') rather than the procedure and evidence source, so the answer is not operational.
What to do instead
Use the formula: procedure + source document + assertion. For example, 'agree the receivables ledger to subsequent bank receipts after year-end to test existence and valuation'. Practise converting every 'check' into a named document and assertion.
Confusing the purpose of the engagement letter, the management representation letter and the audit report, or omitting key content such as the respective responsibilities, the scope of the audit, or the basis for opinion.
Candidates group all audit documents as 'paperwork' and do not learn the distinct purpose and mandatory content of each, so they swap contents between documents.
What to do instead
Create a one-page comparison: engagement letter (agrees terms and responsibilities before the audit), management representations (written confirmation obtained near the end), audit report (communicates the opinion and its basis). List the mandatory sections of each and test yourself on which document contains which statement.
Ignoring ethical threats and safeguards when a scenario describes a familiarity, self-interest or self-review threat, and failing to apply the conceptual framework or state the appropriate safeguard such as removing the individual from the team.
Candidates treat ethics as a separate topic and do not scan scenario facts for threat indicators, so they answer the technical question and miss the ethical dimension entirely.
What to do instead
Before answering any scenario question, run a checklist: identify the threat type, assess its significance, then state the safeguard (e.g. rotate staff, independent review, decline the engagement). Memorise the five threat categories and one safeguard for each.