Quick answer: To score in an ACCA AA audit risk question, turn each scenario fact into a possible misstatement of a specific balance, name the assertion at risk, then describe a specific auditor action that produces evidence. Business risks and management actions score nothing.
Reading about audit risk is easy. Writing it under time pressure is the hard part. So in this guide, we skip the theory-heavy approach and work through a full exam-style question, then break down why the model answer scores, and finish with a revision table you can use in your last week before the exam.
At Abeel School of Accountancy, this is how we teach audit risk in our live AA sessions: attempt first, compare second, fix the pattern third. Try the question below before you read the answer.
Key Takeaways
After working through the examples, test your technique with ACCA mock practice.
Start from the scenario, not from memory. Every risk begins with a fact in the question.
Use the chain: fact, account, over or understated, assertion, response.
Responses must produce evidence, using specific verbs and documents.
Examiners repeat the same warnings about business risk, missing assertions and management responses.
AA becomes E3 Audit, Risk and Control from September 2027.
What ACCA Says Goes Wrong
ACCA’s technical article on audit risk uses a typical requirement: “Describe the audit risks and explain the auditor’s response to each risk in planning the audit of XYZ Co.” It then lists the usual mistakes:
Giving business risks instead of audit risks.
Not tying risks to the financial statement assertions affected.
Offering management’s responses instead of the auditor’s.
It also reminds students that auditor responses should focus on how the audit team will obtain evidence to reduce the risk to an acceptable level. Tuition providers reading recent examiner’s reports add that stating a scenario fact is not the same as identifying an audit risk. Keep those three points in mind as you attempt the question.
Practice Question
Scenario. Fresh Basket Co is a supermarket chain with a 31 December year end. You are planning the audit and have gathered the following information.
Fresh Basket is a new audit client. The previous auditor issued an unmodified opinion.
In June, the company launched an online ordering platform, linked to the accounting system through a new interface.
Fresh Basket runs a loyalty scheme: customers earn points on purchases and redeem them for discounts later.
During the year, the company opened three new stores and capitalised the fit-out costs, including some refurbishment work on the head office.
Requirement (8 marks). Describe four audit risks and explain the auditor’s response to each in planning the audit.
Pause here and write your answer, then compare.
Model Answer
Risk 1: Opening balances (new client)
Risk. This is a first-year audit, so the auditor has not previously audited the opening balances. There is a risk that opening balances are materially misstated, which could affect the current year’s closing balances and profit. This affects all balances, with a particular risk to valuation and completeness.
Response. Review the previous auditor’s report and, with permission, their working papers. Perform procedures on opening balances, such as agreeing them to last year’s audited financial statements and testing key items, such as inventory and non-current assets, where the opening position affects the current year.
Why it scores: it ties the risk to the audit (not to the company), names the assertions, and gives a specific response using real documents.
Risk 2: Online platform and the new interface
Risk. Sales are processed through a new platform and transferred to the ledger through a new interface. Errors in the interface could cause online revenue to be incomplete, inaccurate or recorded in the wrong period. The change mid-year also increases control risk.
Response. Use an IT specialist to test the interface, reconcile online sales per the platform to the sales ledger for the whole year, test a sample of orders through to cash receipt, and perform cut-off testing at the year end.
Why it scores: fact (new interface), balance (revenue), assertions (completeness, accuracy, cut-off), and an evidence-based response.
Risk 3: Loyalty points
Risk. Points earned must be treated as a liability or deferred revenue. This relies on estimates, such as how many points will be redeemed, so liabilities may be understated and revenue overstated (completeness and valuation).
Response. Obtain management’s calculation of the points liability, recalculate it, compare the assumed redemption rate to historical redemption data, and review post year-end redemptions to test reasonableness.
Why it scores: it names the account and direction (liability understated), explains why (estimate), and tests the assumption with evidence.
Risk 4: Capitalised fit-out and refurbishment costs
Risk. Some of the capitalised costs relate to refurbishing the head office, which may be repairs and not capital improvements. Non-current assets and profit may therefore be overstated (classification and valuation).
Response. Obtain a schedule of additions, vouch a sample to invoices and contracts, inspect one of the new stores, and review the nature of the head office work to see whether it enhances the asset or restores it. Check that depreciation starts when each store opens.
Why it scores: the risk is to the balance sheet and profit, the assertion is named, and the response is something an auditor does, not management.
Revision Table: Common Triggers, Risks and Responses
Use this as a quick-reference list. The wording is an example, so always adapt it to the case.
Scenario trigger | Likely risk and assertion | Typical auditor response |
|---|---|---|
New client | Opening balances misstated (completeness, valuation) | Review previous auditor’s report and files, test opening balances |
New or changed IT system | Errors in data transfer, revenue or inventory (completeness, accuracy) | IT specialist, reconcile systems, test the transfer |
Complex estimate or provision | Understated liability or overstated asset (valuation) | Recalculate, test assumptions against history, review post year-end events |
Bonus linked to targets | Overstated revenue or profit (occurrence, cut-off) | Test year-end sales to despatch records, review credit notes after year end, use less predictable procedures |
Customer in difficulty | Receivables overstated (valuation) | Review post year-end receipts, correspondence and the loss allowance calculation |
Slow-moving or obsolete stock | Inventory overstated (valuation) | Compare net realisable value to cost using post year-end sales and ageing reports |
Breached covenant or poor cash flow | Going concern basis may be inappropriate (presentation and disclosure) | Review forecasts and assumptions, bank correspondence and subsequent events |
Related party transactions | Incomplete disclosure (completeness, presentation) | Review minutes, enquire of management, check disclosures against records |
Legal claim | Provision or disclosure incomplete (completeness) | Obtain lawyer’s letter, review correspondence and minutes |
Capitalised development costs | Assets overstated (valuation, existence) | Review project plans, test costs to invoices, assess recoverability criteria |
How to Plan Your Answer in the Exam
Read the requirement. Note how many risks are required and whether responses are also needed.
Highlight scenario facts that hint at misstatement.
Write a mini plan: fact, account, direction, assertion.
Write the risk, then the response, in separate sentences.
Keep to the marks. In many AA planning questions, tuition providers report that marks are split between identifying the risk and describing the response, so cover both for every item.
Check your responses. Ask: does this produce evidence?
For the timing guide, remember a three-hour paper gives roughly 1.8 minutes per mark. Our guide to how to pass ACCA AA covers the exam format.
The Five Most Common Mistakes
1. Business risk. “The company may lose customers” belongs in a business risk answer, not here.
2. No assertion. End every risk with the assertion affected.
3. Management responses. “Improve controls” is management’s job. The auditor tests controls.
4. Vague procedures. “Check” and “review” mean little without saying what and why.
5. Repeating the same risk. Three risks about inventory still count as one idea if they all say the same thing.
ACCA AA and the 2027 Changes
AA continues as E3 Audit, Risk and Control in ACCA’s redesigned Expertise level. According to ACCA’s qualification timeline, June 2027 is the final sitting of the current Applied Skills exams and September 2027 is the first sitting of the new Expertise exams.
What this means for you:
A pass is protected. ACCA’s transition rules give credit for completed equivalents. Check yours in the Transition Tool.
Finishing the level matters. ACCA says students with passes or exemptions for the whole Applied Skills level receive credit for the Digital Tech and Innovation module.
The skill carries over. Linking risk to evidence is central to audit, whichever exam version you sit.
Check the E3 syllabus. ACCA says syllabi and specimen exams are published for the redesigned qualification, so compare E3 with the current AA study guide. We do not assume changes beyond what ACCA states.
Plan your sittings, leaving room for a resit. See our guides to ACCA exam dates 2027 and ACCA transition 2027.
How Abeel School of Accountancy Helps
Practice only works if someone reviews it. Abeel School of Accountancy is the only institute with weekly live revision sessions, where you write risk and response answers and get corrections on missing assertions and vague procedures. Our Smart Course Completion approach fits AA into your overall exam plan so you sit it at the right session with enough timed practice behind you. We teach online, so you can join from anywhere.
Explore our ACCA online courses or talk to an adviser, and Abeel School of Accountancy will help you build an AA plan that fits your schedule.
Frequently Asked Questions About Audit Risks and Auditor Responses
What is an audit risk in ACCA AA?
It is a risk that the financial statements contain a material misstatement that the auditor fails to detect, so they give an inappropriate opinion. In answers, it appears as a possible over or understatement linked to an assertion.
How do I link a risk to an assertion?
Decide what could be wrong with the balance (for example, overstated receivables) and name the assertion that covers it, such as valuation, existence, completeness, accuracy, cut-off or classification.
What is the difference between a risk and a response?
The risk is what could go wrong in the financial statements. The response is what the auditor will do to obtain evidence about it.
Can I use the same response for different risks?
Avoid it. Each response should fit its risk, using the specific documents and tests that address it.
How many risks should I write?
Match the number in the requirement. If it asks for four, write four strong ones, not seven weak ones.
Do marks go to risks and responses separately?
Often they do, so cover both in every item. Check the mark allocation in each question.
Will this skill matter after the 2027 changes?
Yes. AA becomes E3 Audit, Risk and Control from September 2027, and audit risk assessment remains central. Check ACCA’s E3 syllabus for any updates.
How can Abeel School of Accountancy help me practise?
We offer live online classes, weekly live revision sessions with feedback on your written answers, and Smart Course Completion planning to fit AA into your timeline.
Final Thoughts
Audit risk questions become predictable once you practise the chain: fact, account, direction, assertion, response. Try the practice question again from memory in a week, and aim to improve the specificity of every response. That habit alone can move a borderline script into the pass zone.
If you want expert feedback on your answers, Abeel School of Accountancy is ready to help. Book your free counselling session today.