ACCA AAA December 2026: Business Risk vs Risk of Material Misstatement (Stop Losing These Marks)

In ACCA AAA, a business risk is not a risk of material misstatement. Examiners keep marking them as the same thing, and it costs students the easiest marks on the paper.

What the examining team keeps seeing

Recent AAA examiner feedback repeats the same weak-answer pattern: generic responses disconnected from the scenario, business risks confused with risks of material misstatement (RMM), and risks listed with no prioritisation or reasoning.

The distinction matters because the marks sit in the link. A business risk is something that threatens the client's objectives. An RMM is what that threat could do to a specific figure or disclosure in the financial statements. Stop at the first and you have described the client. Get to the second and you have planned the audit.

The same report flags related slips: materiality calculated on the wrong benchmark (operating profit where profit before tax was the sensible choice), ethical threats named without explaining the implication, and controls testing muddled with walkthrough procedures.

Wrong answer vs correct answer

Scenario: a client has lost its largest customer, which was 30% of revenue, and has a bank covenant based on interest cover.

Weak: "The loss of the customer is a significant business risk. The company may struggle to survive. Auditors should be careful."

Strong: "Loss of the customer is a business risk. The RMM is that revenue and receivables from that customer are overstated at the year end, and that management has an incentive to avoid breaching the interest cover covenant. This also puts going concern disclosures at risk. Response: test post year-end credit notes and cash receipts, and review the covenant forecast."

The second answer names the assertion, the incentive, the account and the response. That is what the markers are looking for.

What to do

1. Use a two-step sentence. "The business risk is X. The RMM is that [specific balance] is [overstated/understated/misclassified] because Y." Every risk, every time.

2. Prioritise out loud. Rank your risks and say why the top one is top, using the numbers in the scenario against materiality.

3. Tie every procedure to a source and a purpose. Say what evidence you get, from where, and which assertion it addresses. If you cannot name the assertion, the procedure is generic.

The bottom line

AAA rewards application over recall, and the examiner reports say so every sitting. The students who pass are not the ones who know more risks. They are the ones who connect each risk to a balance, a number and a response.

One sentence, every risk: business risk, then RMM. Do it by habit.