Bulgarian Public Sector Internal Auditor Exam common mistakes
Bulgarian Public Sector Internal Auditor Exam · Understand the traps and how to avoid them.
Citing the Public Sector Internal Audit Act (Закон за вътрешния одит в публичния сектор, ЗВОПС) as the sole legal basis for an auditor's duties, while ignoring the implementing Regulation and the Minister of Finance's methodological guidance that define the practical requirements.
Candidates memorise the headline statute and treat it as complete, so they miss the secondary instruments that carry the operational detail (reporting deadlines, register content, quality review requirements) the exam actually tests.
What to do instead
Build a one-page hierarchy map: ЗВОПС, then the Regulation on the implementation of ЗВОПС, then methodological guidelines and the Internal Audit Charter template. For each rule you learn, write which layer it sits in and re-read the relevant article before the exam.
Treating the IIA Code of Ethics principles (integrity, objectivity, confidentiality, competency) as abstract slogans and giving a vague answer to a scenario, instead of identifying the specific principle breached and the required action.
Candidates learn the four headings but not the Rules of Conduct underneath them, so they cannot map a fact pattern to a named violation and default to general statements about 'professionalism'.
What to do instead
For each of the twelve Rules of Conduct, write one short public-sector scenario and the exact required response (disclose, decline, reassign, escalate to the audit committee). Practise classifying scenarios by principle first, then by rule, then by action.
Answering an independence question by saying the auditor 'should be careful' rather than applying the specific safeguards: removing the auditor from the engagement, disclosing the impairment to the head of internal audit and the audit committee, and documenting the nature of the conflict.
Independence is tested as application, not definition; candidates know the concept but not the safeguard hierarchy, so they produce a moral answer instead of a procedural one.
What to do instead
Memorise the impairment decision tree: identify the threat (self-review, familiarity, undue influence), assess significance, apply safeguards in order (avoidance, structural separation, disclosure), and document. Rehearse with scenarios such as auditing a process the auditor previously designed.
Describing COSO internal control as 'five components' and stopping there, without naming the seventeen principles or explaining how a control activity is distinguished from a control environment element in a given public-sector example.
Candidates learn the component labels as a list and never practise placing a concrete control into the framework, so they cannot answer questions that require classification or gap analysis.
What to do instead
For each of the five components, write the associated principles and one Bulgarian public-sector example per principle (e.g. tone at the top set by the head of the institution, segregation of duties in commitment and payment). Then practise taking a described control and stating which component and principle it serves.
Writing an engagement objective that restates the audit topic ('to audit procurement') instead of stating the auditable question, the scope boundaries, and the criteria against which conclusions will be judged.
Candidates confuse the audit subject with the engagement objective and omit criteria, which makes the later findings and conclusions untestable and loses marks on planning questions.
What to do instead
Draft every objective in the form: assess whether [subject] in [period/entity] complies with [criteria] and achieves [intended result]. Check that scope, criteria and the eventual report conclusion all trace back to that sentence.
Selecting samples or choosing procedures without linking them to the assessed risk level, and using the same procedure mix for high-risk and low-risk areas.
Risk-based planning is tested as a reasoning chain; candidates learn risk assessment and audit procedures as separate topics and never connect them, so their answers describe generic testing.
What to do instead
For each risk you identify, state the inherent and residual rating, then the response (nature, timing, extent of procedures) and the evidence type that would reduce it. Practise writing a short risk-to-procedure matrix for one process such as public procurement.
Presenting a finding as an observation without the four elements: condition (what is), criteria (what should be), cause (why it happened) and effect or risk (why it matters), often omitting cause and effect entirely.
Candidates describe what they saw and assume the significance is obvious, but examiners award marks for the complete finding structure and for linking each element explicitly.
What to do instead
Write every practice finding in a fixed four-sentence template, labelling each element. If you cannot state a cause, the finding is not yet developed; if you cannot state an effect, reconsider whether it is a finding or just a fact.
Producing a recommendation that repeats the finding ('improve compliance with the Public Procurement Act') rather than stating a specific, actionable, costed and assigned corrective measure with an owner and a deadline.
Candidates treat the recommendation as a summary of the problem, and they also forget that in the Bulgarian system the audited entity drafts the action plan while the auditor agrees and monitors it.
What to do instead
Write recommendations in the form: who does what, by when, to what standard. Then state the follow-up mechanism: the action plan submitted by the entity, the monitoring dates, and the escalation route to the head of the institution and the audit committee for overdue actions.
Confusing the roles in the public finance chain: authorising officer, accounting officer, and the separate internal control and internal audit functions, and attributing audit responsibility to the wrong actor.
The Bulgarian public finance framework assigns distinct accountability for commitment, payment, control and audit, and candidates collapse these into a generic 'management is responsible' answer that fails specific questions.
What to do instead
Draw a role map for one institution: who authorises expenditure, who executes the budget, who operates ex-ante control, who performs internal audit, and to whom each reports. Test yourself by assigning a described failure to the accountable role.
Ignoring the quality assurance framework beyond the periodic external review, and being unable to state the elements of the internal quality assessment, the supervision and review of working papers, and the required reporting lines.
Candidates reduce quality assurance to 'an external evaluation every five years' and miss ongoing and periodic internal assessments, engagement supervision and the documentation standards that the exam tests.
What to do instead
Learn the three layers: ongoing supervision during the engagement, periodic internal assessments, and external assessment. For each, note who performs it, how often, what is documented, and to whom results are reported. Link this to the working paper review requirements.