ACCA AA 2026: How to Answer an Audit Risk Question (Sep/Dec 2025 Examiner Report)

The audit risk question is the biggest single block of marks in AA — and most candidates hand half of it back by describing a business problem instead of an audit risk. The Sep/Dec 2025 examiner report is blunt about it: identifying that something looks wrong in the scenario earns you almost nothing. The marks are for what that thing does to the financial statements.

Audit risk is not business risk

In Sep/Dec 2025 a scenario mentioned that the internal audit team only visited each store every 24 months. A significant number of candidates flagged this on its own as an audit risk. It isn't. Infrequent internal audit visits are an operational observation — they only become an audit risk when you say what could be misstated as a result. The same trap catches candidates when a company breaks its own controls: invoices not authorised, purchase orders bypassed. Writing "the company didn't follow its procedures" describes a control weakness. The mark is for the consequence — which balance is now at risk, and in which direction.

The three-part structure that scores

Every audit risk point has a fixed shape. Identify the risk factor from the scenario (½ mark). Explain it by naming the specific account affected and stating whether it is overstated or understated, ideally with the assertion — valuation, cut-off, existence, completeness (½ mark). Then, where the requirement asks for the auditor's response, describe one specific procedure to address it (1 mark). Miss the middle step and you've capped yourself at half marks across the whole question.

Don't hedge over versus under

This one quietly drains marks. The examiner will only credit "misstated" when the balance could genuinely go either way. If the scenario points clearly to an overstatement, writing "receivables could be misstated" scores nothing — you have to commit to "overstated." You cannot cover both directions to be safe. Pick the direction the evidence supports and say it.

Worked example

Wrong answer (0 marks): "The internal audit department only visits each store every 24 months. This is an audit risk."

Correct answer (full marks): "Inventory is held across many stores and internal audit visits each only every two years, so counting errors and theft may go undetected. Inventory could therefore be overstated (existence and valuation). The auditor should attend the year-end count at a sample of stores and perform test counts in both directions." Same fact. One names the balance, the direction and a procedure; the other just repeats the scenario.

What to do

1. After every risk you spot, finish the sentence "...so [account] is [over/under]stated." If you can't complete it, it isn't an audit risk — it's background.

2. Commit to a direction. Only use "misstated" when the balance could truly be either way. Otherwise state over- or understated and move on.

3. Pair each risk with one tailored procedure. A generic "review the balance" earns nothing — name the source document and what it confirms.

Bottom line

AA pass rates have sat in the low 40s to around 50% for years, and audit risk is where the exam is won or lost because of how many marks ride on it. Half the candidates can spot the issues in the scenario. The ones who pass are the ones who say what those issues do to the numbers. Complete the sentence, commit to a direction, and attach a procedure — that's the whole game.