OCAM Auditores common mistakes
OCAM Auditores · Understand the traps and how to avoid them.
Treating the audit as a checklist of procedures and concluding 'the accounts give a true and fair view' without first explicitly determining whether the applicable financial reporting framework (e.g., PGC, PGC-PYMES, or IFRS-EU) is acceptable in the circumstances.
Candidates memorise the wording of the opinion paragraph but skip the prior step of evaluating the acceptability of the framework; exam items often hide a non-acceptable or inapplicable framework (e.g., PGC-PYMES used when the entity is not eligible).
What to do instead
Before drafting any opinion, write one line stating the framework identified, whether the entity is eligible to apply it, and whether it is acceptable; only then select the opinion type. Practise framing questions as: framework → acceptability → evidence → opinion.
Confusing the roles of ISAs (NIA-ES) issued by ICAC, the technical auditing standards, and internal control quality standards, and citing the wrong body as the source of an obligation in a justification.
The Spanish regulatory layering (Ley 22/2015 de Auditoría de Cuentas, Reglamento, NIA-ES adaptadas, Normas de Control de Calidad) is dense, and candidates study them as a block rather than as a hierarchy.
What to do instead
Build a one-page hierarchy map: law → regulation → adopted ISAs → quality control standards, and for each rule note which level imposes the requirement. When answering, name the level explicitly (e.g., 'NIA-ES 700 requires…', 'the Reglamento establishes the rotation period…').
Describing independence only as 'the auditor must be independent' and failing to apply the specific threats-and-safeguards analysis (self-interest, self-review, advocacy, familiarity, intimidation) to the concrete facts given.
Candidates learn the definition but not the operational test; exam scenarios deliberately present a fee dependency, a long association, or a non-audit service and expect a threat identified plus a conclusion on whether safeguards suffice.
What to do instead
For every ethics scenario, write four lines: identify the threat type, identify whose independence is affected (firm/partner/engagement team), state whether the threat is at an acceptable level and why, and state the safeguard or the required action (decline, rotate, remove the service).
Confusing prohibited non-audit services with permitted ones, and confusing the prohibition rules for public-interest entities (EIP) with those for non-EIP clients.
The Reglamento and Ley 22/2015 impose stricter prohibitions for EIPs (e.g., certain tax and internal-audit outsourcing services, and fee caps), and candidates apply the EIP rule set to all clients or vice versa.
What to do instead
Make a two-column table (EIP / non-EIP) listing each service category (bookkeeping, tax, valuation, internal audit, IT design, legal) with the rule and the required safeguard. Rehearse by classifying the client first, then applying the column.
Setting materiality once at planning and never revising it, or computing a single percentage benchmark without justifying the benchmark choice against the users and the entity's nature.
Candidates treat materiality as a formula to be calculated rather than a judgement to be documented and revisited; scenario questions often require showing that materiality changes after a revised profit or a new user group.
What to do instead
Always state: benchmark used, why that benchmark suits the users, the percentage applied, the resulting overall materiality, performance materiality, and the threshold for clearly trivial misstatements. Add a sentence on when it would be revised (e.g., actual profit differs materially from plan).
Confusing inherent risk, control risk, and detection risk, and asserting that detection risk can be reduced by the client's controls.
The audit risk model is memorised as a formula, but candidates do not track which risks belong to the entity and which are under the auditor's control, so they misassign the response.
What to do instead
Write out the model as: audit risk = inherent risk × control risk × detection risk, and annotate each factor as 'entity-controlled' or 'auditor-controlled'. Every time you assess a risk, state the planned response (nature, timing, extent of procedures) that lowers detection risk.
Choosing the sample selection method or sample size without linking it to the purpose of the test, and then extrapolating a misstatement found in a sample to the population without considering whether the population is homogeneous or whether the misstatement is an anomaly.
Candidates learn sampling terminology (statistical vs non-statistical, MUS, attribute sampling) but not the decision logic that connects purpose, population, method, and projection.
What to do instead
Before answering a sampling question, state: the objective (test of controls vs substantive), the population definition, the sampling unit, the method (e.g., monetary unit sampling for overstatement risk), the basis for sample size, and the projection logic. Explicitly say whether an anomaly can be excluded and require the client to correct the population.
Relying on the client's internal controls as audit evidence without first testing their design and operating effectiveness, or accepting an oral representation in place of corroborating evidence.
Candidates want to reduce substantive work and conflate 'the control exists' with 'the control operates effectively'; exam items often show a control described in a narrative that has never been tested.
What to do instead
Apply the rule: controls can only reduce substantive testing after tests of controls show they operate effectively throughout the period. For every representation, ask 'what corroborating evidence exists?' and state the additional procedure needed if none does.
Writing an unmodified opinion when a material but not pervasive misstatement exists, or issuing a qualified opinion for a scope limitation that is actually pervasive (which requires a disclaimer).
Candidates memorise the four opinion types but not the two-dimensional decision (nature of the issue × pervasiveness), and the pervasiveness judgement is the hardest part.
What to do instead
Use a 2×2 grid: material but not pervasive → qualified; material and pervasive → adverse (misstatement) or disclaimer (scope limitation). For every scenario, explicitly state the nature of the issue and then justify the pervasiveness conclusion in one sentence.
Omitting or misplacing the required elements of the auditor's report: the Key Audit Matters section (required for EIPs), the 'Basis for Opinion' section placement, the going-concern material uncertainty paragraph, and the statement on the auditor's responsibilities, or failing to update the report date and subsequent-events procedures.
Candidates draft the opinion paragraph only and forget the surrounding mandatory structure; KAM and going-concern sections have specific placement and wording rules that are easy to blur.
What to do instead
Memorise the report skeleton in order: title, addressee, opinion, basis for opinion, (going concern material uncertainty, if any), KAM (EIPs), responsibilities of management, responsibilities of the auditor, other reporting obligations, signature, date and place. Practise by writing the full skeleton for two scenarios: one EIP with a KAM and one with a going-concern uncertainty.