EPSO Auditors | Field-related MCQ resources

EU Training

Audit professionals working in an EU office environment. They are most likely EU permanent officials who passed the EPSO exams.

Preparing for the EPSO AD7 Audit competition is not just about knowing audit terminology.

At this level, EPSO is likely to test whether you can apply audit judgement in realistic situations: choosing the right audit response, recognising weak evidence, identifying control failures, understanding public-sector accountability, and deciding what conclusion is actually supported by the facts.

This guide accompanies EU Training’s field-related Audit practice questions for EPSO/AD/428/26 – Administrators AD7 in the field of audit. It explains the main knowledge areas covered in the question set and lists the official or openly accessible resources used when creating the questions.

Remember - this is not official EPSO material. Always use the Notice of Competition as your primary source for the rules, eligibility criteria, test format, pass marks and language arrangements.

What is covered in the EPSO Auditors field-related test?

The EPSO Auditor field-related MCQ is a technical exam designed to assess a candidate’s knowledge of internal and external auditing standards for the EPSO/AD/411/24 competition.

According to the Notice of Competition, the field-related multiple-choice test for the AD7 Audit competition:

  • is taken in language 2
  • contains 30 questions
  • lasts 40 minutes
  • has a pass mark of 15/30
  • is used for ranking among candidates who pass the threshold

Your goal should not be to scrape past the minimum. You need to aim comfortably above it.

The standard to aim for is not:

“Can I define this audit term?”

It is closer to:

“Can I recognise the best audit judgement under time pressure when several answer options look plausible?”

The questions in this practice set are therefore not limited to textbook definitions. They cover applied audit reasoning, evidence quality, controls, audit planning, reporting, performance audit, IT audit, fraud risk and the EU public-sector context.

How to use this guide

Do not try to read every resource from beginning to end. That would be slow, frustrating and probably unnecessary.

Start with the core resources, then use the topic sections below to focus on your weaker areas.

A good study cycle is:

  1. Read the short introduction to a topic.
  2. Answer a block of 15–20 related practice questions.
  3. Review only the questions you missed or guessed.
  4. Go back to the listed resources selectively.
  5. Keep a short error log: topic, mistake, rule to remember.

The aim is to build an audit reasoning habit:

objective → risk → criteria → evidence → conclusion → recommendation → follow-up

That chain appears again and again in good audit judgement.

Core resources to start with

These are the most important resources to keep open while studying.

EPSO/AD/428/26 Notice of Competition

This is the legally binding document for the competition. Use it to confirm the test format, language arrangements, pass marks and typical duties in Annex II. 

The practice questions are built around the duties listed in the Notice, not around a generic private-sector accounting syllabus.

URL: https://eur-lex.europa.eu/eli/C/2026/1979/oj

EU Careers open competitions page

Use this page to access the live competition entry, EPSO updates and practical candidate information.

It is also useful for remembering one basic but important point: EPSO competitions lead to reserve lists, not automatic recruitment.

URL: https://eu-careers.europa.eu/en/open-competition-permanent-staff

European Court of Auditors guide to methodology

This is probably the most useful EU-specific audit methodology source.

It explains how the European Court of Auditors approaches planning, examination and reporting, and how it distinguishes financial, compliance and performance audit objectives in an EU public-audit context.

URL: https://www.eca.europa.eu/Lists/ECADocuments/ECA_methodology_guide/ECA_methodology_guide-EN.pdf

INTOSAI professional pronouncements

INTOSAI standards are central to public-sector audit. The portal gives access to ISSAIs and GUIDs used by supreme audit institutions.

For this competition, focus especially on ISSAI 100, 200, 300, 400 and 140.

URL: https://www.issai.org/professional-pronouncements/

IIA Global Internal Audit Standards

These are especially useful for internal audit, engagement planning, independence, assurance, advisory work, quality, communication and audit management.

URL: https://www.theiia.org/globalassets/site/standards/globalinternalauditstandards_2024january9.pdf

European Commission internal control framework

This is directly relevant to governance, risk management, control activities, monitoring and the EU institutional control environment.

URL: https://commission.europa.eu/publications/internal-control-framework_en

EU Financial Regulation

Use this for the principles and procedures governing the EU budget, including legality, regularity, sound financial management, grants, procurement, internal control and protection of the Union’s financial interests.

URL: https://commission.europa.eu/publications/eu-financial-regulation_en

OLAF and anti-fraud resources

These are useful for fraud-risk questions, irregularities, red flags, conflicts of interest and escalation.

URL: https://anti-fraud.ec.europa.eu/index_en

Main study areas

Audit team discussing risk-based planning and audit priorities in a professional office setting.

Risk-based audit planning

Risk-based planning is about deciding where audit work is most needed.

At AD7 level, you should be able to compare possible audit topics and explain why one deserves priority over another. This is not as simple as choosing the biggest budget line or the most visible political issue.

You may need to consider:

  • inherent risk
  • residual risk
  • likelihood and impact
  • control maturity
  • management discretion
  • fraud indicators
  • financial and reputational exposure
  • changes in systems or processes
  • previous audit coverage
  • assurance gaps

A good answer usually links the audit objective to the risk exposure and the organisation’s priorities. A weak answer often focuses on one attractive factor in isolation.

Typical traps

Watch out for answers that:

  • treat high expenditure as automatically high risk
  • ignore control maturity
  • remove a topic from the audit plan only because it had a clean audit recently
  • follow management preference without independent risk assessment
  • choose a topic before checking whether it is actually auditable
  • confuse inherent risk with residual risk

Best resources

Internal and external audit logic

Internal and external auditors may examine similar systems, but they do not serve exactly the same purpose.

Internal audit is part of the organisation’s assurance and advisory structure. It must remain independent and objective, but it still operates within the organisation.

External audit provides independent assurance or scrutiny to external stakeholders, such as legislatures, discharge authorities or the public.

For EPSO-style questions, the key is usually not the definition. The key is recognising the boundary.

Internal audit may advise, recommend and help management think through risks. But management owns the controls and decisions. External auditors may use internal audit work, but they remain responsible for their own conclusions.

Typical traps

Watch out for answers that:

  • make internal audit responsible for management decisions
  • suggest external auditors can simply adopt internal audit conclusions without review
  • treat all advisory work as automatically forbidden
  • assume cooperation between internal and external auditors always compromises independence
  • ignore reporting lines and safeguards

Best resources

Audit types: financial, compliance and performance audit

You need to be able to recognise which audit logic applies in a given situation.

A financial audit asks whether financial information is fairly presented or free from material misstatement.

A compliance audit asks whether activities, expenditure or decisions comply with applicable rules, contracts, grant conditions, procurement requirements or other authorities.

A performance audit asks whether resources have been used with economy, efficiency and effectiveness.

EPSO can test this indirectly. For example, a question may ask which evidence supports a value-for-money conclusion, or why compliance with eligibility rules does not prove that a programme was effective.

Typical traps

Watch out for answers that:

  • treat legal compliance as proof of effectiveness
  • treat high expenditure absorption as proof of good performance
  • confuse financial accuracy with regularity
  • use performance-audit language for a compliance issue
  • ignore the criteria needed for the audit conclusion

Best resources

Governance, risk management and internal control

Auditor reviewing digital audit evidence and system access controls on a laptop.

This is one of the most important areas for the AD7 Audit competition.

A control is not good just because it exists on paper. It must address the relevant risk, operate at the right point in the process, be performed by someone with the right authority and competence, and leave evidence that can be reviewed.

You should be comfortable with:

  • segregation of duties
  • approval controls
  • reconciliations
  • ex ante and ex post checks
  • delegated authority
  • management supervision
  • conflict-of-interest controls
  • monitoring
  • control design versus operating effectiveness
  • risk registers
  • audit trails

A useful way to think is:

objective → risk → control → evidence → residual risk

If the control does not reduce the risk, it is not relevant. If it reduces the risk but cannot be evidenced, it may not be auditable. If it operates too late, it may detect but not prevent. If management overrides it frequently, its operating effectiveness is weak.

Typical traps

Watch out for answers that:

  • praise a control without asking whether it addresses the risk
  • ignore segregation of duties
  • treat a checklist as a control even when no one reviews it
  • focus on administrative neatness rather than risk reduction
  • confuse control design with operating effectiveness
  • propose more reporting when the real issue is lack of review or accountability

Best resources

IT systems audit and digital evidence

This part of the practice set approaches IT from an auditor’s perspective. It is not a technical cybersecurity exam.

The key question is usually:

Can the auditor rely on the system, the automated control, or the data produced by it?

You should understand:

  • user access rights
  • privileged access
  • segregation of duties in systems
  • change management
  • audit trails
  • interface controls
  • automated controls
  • dashboard reliability
  • spreadsheet risks
  • backup and recovery
  • logging
  • management-generated data

A basic distinction matters a lot:

IT general controls support the wider IT environment. These include access management, change management, operations, backups and incident handling.

Application controls operate inside a system. These include validations, authorisations, completeness checks, exception reports and automated calculations.

If general controls are weak, it becomes harder to rely on application controls or system-generated reports without extra testing.

Typical traps

Watch out for answers that:

  • rely on a dashboard without checking the source data
  • ignore privileged access rights
  • treat an automated control as reliable without considering change management
  • focus on cybersecurity buzzwords rather than audit evidence
  • overlook spreadsheet risks
  • ignore whether system changes were approved, tested and logged

Best resources

Audit evidence and methodology

Audit conclusions are only as strong as the evidence behind them.

This area tests whether you can judge whether evidence is sufficient and appropriate. You may need to decide which source is more reliable, whether more testing is needed, or whether a conclusion goes beyond what the evidence supports.

You should be familiar with:

  • relevance and reliability of evidence
  • inspection, observation, inquiry, recalculation and reperformance
  • analytical procedures
  • sampling risk
  • management-generated information
  • contradictory evidence
  • materiality
  • audit trails
  • working papers
  • documentation quality

Independent evidence is often more reliable, but it is not automatically more relevant. Management evidence can be usable, but its reliability may need to be tested. Inquiry alone is usually weak if the conclusion is important.

The best answer is often the one that is most directly linked to the audit objective.

Typical traps

Watch out for answers that:

  • confuse “some evidence” with “enough appropriate evidence”
  • rely only on management explanations
  • choose independent evidence even when it does not answer the audit question
  • ignore contradictory evidence
  • draw a broad conclusion from a weak or narrow sample
  • treat a working paper as adequate when it would not support review

Best resources

Reporting, findings and recommendations

A good audit finding is not just a statement that something went wrong.

It normally connects:

  • criteria
  • condition
  • cause
  • consequence or risk
  • evidence
  • conclusion
  • recommendation

A good recommendation is specific, proportionate, within the auditee’s control and possible to follow up later.

This area tests whether you can spot weak conclusions, unsupported wording, vague recommendations and overclaims. You may also need to judge how to handle management replies or disagreement with the auditee.

Typical traps

Watch out for answers that:

  • make a conclusion stronger than the evidence allows
  • recommend something outside the auditee’s control
  • ask for “better monitoring” without saying what should change
  • address symptoms rather than root causes
  • confuse observation with conclusion
  • use dramatic wording where careful audit language is needed

Best resources

Audit engagement management

The AD7 profile is not a junior audit role.

Candidates should be able to think like someone managing or contributing significantly to an audit engagement. That means planning work, supervising others, reviewing files, dealing with delays, managing scope, protecting quality and escalating problems when needed.

You may see questions about:

  • engagement planning
  • work allocation
  • review notes
  • audit-file quality
  • auditee delays
  • scope creep
  • late-emerging risks
  • evidence gaps
  • team supervision
  • time pressure
  • coordination with other assurance providers

The correct answer is rarely “finish at all costs” or “expand the audit endlessly”. The better approach usually protects audit quality while staying proportionate.

Typical traps

Watch out for answers that:

  • ignore unsupported conclusions in junior staff work
  • accept auditee delays without considering evidence risk
  • expand the scope without documenting why
  • treat deadlines as more important than audit quality
  • fail to escalate material constraints
  • overlook the need to update the work plan

Best resources

Quality assurance and audit standards

Audit quality is not just about one careful auditor. It depends on standards, methodology, independence, competence, supervision, review, documentation and feedback.

The Notice of Competition refers to quality assurance and peer review assignments, so this area should not be treated as optional.

You should understand:

  • independence
  • objectivity
  • competence
  • due professional care
  • quality review
  • audit documentation
  • conflicts of interest
  • consistency of methodology
  • peer review
  • remedial action
  • quality management systems

A quality issue is not always a dramatic failure. Sometimes it is an unsupported conclusion, inconsistent methodology, weak review evidence, or a conflict that has not been properly safeguarded.

Typical traps

Watch out for answers that:

  • treat quality review as a full re-performance of the audit
  • focus only on formatting issues
  • correct one file without addressing the wider quality risk
  • ignore independence safeguards
  • underplay unsupported conclusions
  • fail to distinguish minor issues from systemic weaknesses

Best resources

Public-sector and EU audit context

EU public-sector audit documents and budget reports in an institutional office setting.

This competition is not a general private-sector audit exam. The EU public-sector context matters.

Candidates should understand public accountability, sound financial management, EU budget implementation, grants, procurement, financial regulation, conflicts of interest, irregularities, fraud risk and the protection of the Union’s financial interests.

You do not need to memorise article numbers from the Financial Regulation. But you should understand the principles behind EU spending and control.

Public-sector audit often asks more than:

“Was the money spent?”

It also asks:

Was it spent legally, properly, economically, efficiently and effectively?

Typical traps

Watch out for answers that:

  • apply private-sector client logic to a public accountability setting
  • ignore sound financial management
  • confuse irregularity, error, suspected fraud and poor value for money
  • treat legal spending as automatically good spending
  • overlook conflicts of interest
  • ignore the audit trail in grants and procurement

Best resources

Performance audit and value for money

Performance audit deserves special attention because many AD7-level questions require evaluative reasoning.

Performance audit is not about checking whether money was spent according to the rules. It asks whether a programme, process or intervention achieved economy, efficiency and effectiveness.

You should be comfortable with:

  • intervention logic
  • inputs, outputs, results, outcomes and impact
  • economy, efficiency and effectiveness
  • indicators
  • cost-effectiveness
  • attribution
  • unintended effects
  • causal claims
  • monitoring versus evaluation
  • value for money

A common EPSO-style issue is whether the evidence supports the conclusion. For example, a programme may have spent its budget and delivered many outputs, but that does not automatically prove it achieved meaningful outcomes.

Typical traps

Watch out for answers that:

  • treat output delivery as proof of effectiveness
  • confuse monitoring with evaluation
  • confuse correlation with attribution
  • ignore unintended effects
  • choose indicators that are easy to measure but not meaningful
  • draw causal conclusions without enough evidence

Best resources

Fraud, irregularities and conflicts of interest

Audit candidates do not need to act like investigators. But they do need to understand how auditors should respond to red flags.

This area covers:

  • suspected fraud versus error
  • irregularities
  • conflicts of interest
  • procurement manipulation
  • double funding
  • unsupported costs
  • unusual data patterns
  • management override
  • segregation weaknesses
  • escalation and referral
  • evidence preservation

A red flag is not proof of fraud. But it does change the audit response. The auditor may need to perform further procedures, document the facts carefully, protect evidence and follow the relevant reporting channels.

In an EU context, suspected fraud may also require OLAF-related escalation, depending on the institutional rules.

Typical traps

Watch out for answers that:

  • conclude fraud when there is only a red flag
  • ignore a credible fraud indicator
  • treat fraud risk as an ordinary administrative weakness
  • investigate criminal intent beyond the audit role
  • fail to protect evidence
  • overlook conflicts of interest where no financial loss has yet been proven

Best resources

An EPSO candidate using a timer and EU Training Audit Field-Related MCQ practice questions to revise for the EPSO test.

How to revise with the practice questions

The field-related MCQ test is time-limited. You have to choose the best answer quickly, even when several options sound technically correct.

The best way to practise is not passive reading. Work in blocks.

After each block of questions, record:

  • the topic
  • why you missed the question
  • the rule, distinction or judgement point you need to remember

For example:

Topic Mistake Rule to remember
Audit evidence Chose the more independent source, but it did not answer the audit question Evidence must be relevant as well as reliable
Performance audit Treated outputs as proof of effectiveness Outputs show delivery, not necessarily outcomes
Internal control Focused on the existence of a control, not whether it was reviewed A control must operate effectively and leave evidence
Fraud risk Treated a red flag as proof of fraud A red flag changes audit response; it is not proof by itself

When reviewing explanations, ask yourself:

  • What was the audit objective?
  • What was the main risk?
  • What criteria applied?
  • Which evidence was most relevant and reliable?
  • Which option overstated the conclusion?
  • Which option understated the risk?
  • Which recommendation would actually fix the problem?

Many AD7-level questions include more than one true statement. The task is to choose the answer that best fits the audit objective, the available evidence and the auditor’s role.

Final advice

Audit candidate reviewing practice questions and study notes before an EPSO field-related test.

For this competition, do not prepare as if you are learning a glossary.

Prepare as if you are stepping into an audit assignment and need to make defensible professional decisions.

Focus on:

  • risk-based planning
  • audit objectives
  • evidence quality
  • internal controls
  • audit types
  • reporting logic
  • EU public-sector accountability
  • performance audit
  • fraud-risk response
  • audit quality

Start with the Notice of Competition, the ECA methodology guide, the relevant ISSAI standards, the Commission internal-control and Financial Regulation resources, the IIA standards and the anti-fraud materials.

Then use the more specialised resources only where you need them.

The purpose of this practice set is to make audit concepts operational: to train you to identify the audit objective, test the evidence, assess the controls, choose a proportionate response and recognise the answer that would be defensible in an EU institutional audit environment.

 

 

Field-related MCQ resources