ACCA AA: Audit Risk vs Business Risk - Stop Losing Easy Marks (June 2026)

The mistake examiners flag every sitting

Open any recent AA examiner's report and you'll see the same line: candidates are identifying business risk when the question asks for audit risk. It's the single most common reason students lose easy marks on Section B.

Business risk is a risk to the company. Audit risk is a risk to the auditor — the chance they sign off financial statements that are materially misstated. Two different concepts, two different answers.

Why students get this wrong

The scenario gives you a company in trouble. Cash is tight, customers are slow to pay, a factory has burned down, a key director has resigned. Your instinct is to describe what this means for the business. That is business risk — and it scores nothing in an audit risk question.

The AA examining team has flagged this repeatedly across recent March/June sittings: the most common mistake is that students write business risk instead of audit risk. The fix is to stop at every scenario detail and ask one question: what line in the financial statements does this affect, and how might it be misstated?

Worked example: slow-paying customers

Wrong answer (business risk): "The company has liquidity problems because customers are not paying on time, which threatens cash flow."

Right answer (audit risk): "Receivables may be overstated if recoverability is doubtful. The allowance for expected credit losses may be understated, so the valuation assertion for receivables is at risk."

Same scenario. The audit risk answer names the balance (receivables), the assertion (valuation), and the direction of misstatement (overstated). That is how you score the mark.

The second trap: auditor response, not management response

The other half of the mark is the response — and examiners flag another classic error here. Candidates describe what management should do ("chase debtors more aggressively") instead of what the auditor should do ("review post-year-end cash receipts from major customers; test the expected credit loss model for reasonableness").

If your response does not produce audit evidence, it is the wrong response. Every response should start with a verb like inspect, enquire, recalculate, obtain, review, confirm, or observe. If it starts with "management should", cross it out.

What to do before June

1. Drill the three-part format. Every audit risk answer must have: the balance or transaction affected, the assertion at risk, and the direction of misstatement. If one of the three is missing, the marker cannot give you the mark.

2. Practise rewriting business risks as audit risks. Take any scenario detail — a new IT system, a bank covenant, a legal dispute — and write both versions side by side. Do this five times and the habit sticks.

3. Test your responses with one question. Does it produce audit evidence? If yes, it scores. If it solves a business problem, it is a management response and scores zero.

The bottom line

AA pass rates sit around 39 to 43 per cent. The gap between a 45 and a 52 is often exactly this: six or seven clean audit risk marks that candidates throw away by writing about the company instead of the audit. Do not be one of them.