← BT: all sections
ACCA · Applied Knowledge

BT: Functions and technology

26 free practice questions on functions and technology, Section C of the ACCA Business and Technology (BT) question bank. Topics include Fraud, Cyber security, Internal controls, Money laundering, AI and automation in accounting, Internal controls vs internal checks. Each question carries its syllabus reference and a worked explanation. Practise them in the quiz with instant feedback, or read every question with its answer further down this page.

→ Full BT question bank and timed mock exam
→ BT Common Mistakes

Explanations shown after each answer. Skip freely. No time limit.
Section:
0
answered
0
correct
—
score
—
remaining
Question 1

Loading questions…

All 26 functions and technology questions

The same questions the quiz above draws on, in syllabus order, each with its answer and worked explanation. All 26 are multiple choice.

Question 1 · Syllabus ref C3d · Fraud — asset misappropriation

An accounts payable clerk creates fictitious supplier accounts and authorises payments to those accounts, which they secretly control. Which type of fraud does this represent?

  1. Financial statement fraud
  2. Asset misappropriation via fictitious payees
  3. Bribery and corruption
  4. Cyber fraud
Show answer and explanation

Answer: B. This is asset misappropriation — the most common category of occupational fraud. By inventing fictitious suppliers and processing payments to them, the employee diverts company funds to themselves. Segregation of duties between supplier creation and payment authorisation is the key preventive control.

Question 2 · Syllabus ref C3i · Money laundering

Which of the following best defines money laundering?

  1. The use of offshore accounts to avoid paying tax on investment income
  2. The falsification of financial statements to overstate a company's profitability
  3. The process by which the proceeds of criminal activity are made to appear as legitimate funds
  4. Bribery of public officials to obtain favourable business contracts
Show answer and explanation

Answer: C. Money laundering is the process of making 'dirty' money — derived from criminal activity such as drug trafficking, fraud, or corruption — appear to be legitimate. It typically involves three stages: placement (introducing cash into the financial system), layering (concealing the trail), and integration (the funds re-enter the economy as apparently legitimate).

Question 3 · Syllabus ref C7b · AI and automation in accounting

Which of the following is most likely to result from increased automation and AI in accounting functions?

  1. Demand increases for accountants performing routine transaction processing
  2. The need for professional judgement in financial reporting is eliminated
  3. Regulatory oversight of financial reporting becomes unnecessary
  4. Accountants shift focus toward higher-value analytical and advisory work
Show answer and explanation

Answer: D. AI and automation excel at high-volume, rule-based tasks such as data entry and reconciliations. This frees accountants from repetitive work, shifting their value toward analysis, interpretation, and business advisory work. Professional judgement and ethical oversight remain essential and cannot be automated.

Question 4 · Syllabus ref C6a · Internal controls vs internal checks

Which of the following best describes the distinction between an internal control and an internal check?

  1. An internal control is the overall system of controls; an internal check is a specific control within it, such as independent verification of work
  2. An internal check is broader and encompasses the entire governance framework
  3. Internal controls apply only to financial systems; internal checks apply to operations
  4. They are different terms for the same concept
Show answer and explanation

Answer: A. Internal control refers to the complete system of controls — policies, procedures and activities — used to manage risk. An internal check is a specific preventive control within that system, typically involving independent verification of one employee's work by another.

Question 5 · Syllabus ref C7a · Cloud computing

Which of the following is a key benefit of cloud computing for an accounting function?

  1. All data security risks are eliminated because data is stored off-site
  2. Authorised users can access financial data in real time from any location
  3. No internal IT expertise or oversight is required by the organisation
  4. Software updates must be managed manually by the organisation's own IT team
Show answer and explanation

Answer: B. Cloud computing enables authorised users to access systems and data via the internet from any device or location. This supports remote working, real-time reporting, and multi-site collaboration. However, it does not eliminate security risks — data breaches remain a concern and require active governance.

Question 6 · Syllabus ref C2e · Internal vs external audit

Which of the following best distinguishes the role of internal audit from external audit?

  1. External audit reports to management; internal audit reports to shareholders
  2. Internal audit is legally required for all companies; external audit is optional
  3. Internal audit serves management and improves operations; external audit provides an independent opinion on financial statements for shareholders
  4. Both internal and external audit serve the same purpose and report to the same stakeholders
Show answer and explanation

Answer: C. Internal audit is an appraisal function within the organisation — it reports to management and the audit committee, focusing on risk management, controls, and operational efficiency. External audit is an independent statutory function — auditors report to shareholders, providing an opinion on whether the financial statements give a true and fair view.

Question 7 · Syllabus ref C7e · Cyber security

Which of the following best defines cyber security in the context of a business organisation?

  1. The process of backing up financial data to an offsite server on a daily basis
  2. The use of encryption software to compress large data files for storage
  3. The monitoring of employee internet usage to ensure compliance with acceptable use policies
  4. The protection of computer systems, networks, and data from digital attacks, damage, or unauthorised access
Show answer and explanation

Answer: D. Cyber security encompasses all measures taken to protect an organisation's digital assets — including hardware, software, networks, and data — from cyber attacks, unauthorised access, damage, or theft. It is increasingly critical as organisations depend on digital systems for financial reporting, operations, and communication.

Question 8 · Syllabus ref C3d · Fraud — separation of duties

An accounts payable clerk has sole authority to create new supplier accounts, approve invoices, and authorise payments. Which of the following best explains why this arrangement creates a high fraud risk?

  1. The clerk is likely to be overworked and therefore prone to making honest errors in the payables records
  2. The arrangement is inefficient because multiple people should be involved in routine transaction processing
  3. Combining these three functions removes the separation of duties that would otherwise prevent or detect fraudulent payments to fictitious suppliers
  4. The arrangement is only risky if the organisation lacks an internal audit function
Show answer and explanation

Answer: C. A fundamental principle of internal control is the separation of duties — key stages of a transaction should be handled by different people so that no single individual can initiate, approve, and complete a transaction without independent verification. When one person can create a supplier, approve an invoice, and authorise payment, they can create a fictitious supplier, approve invoices from that supplier, and pay themselves with no colleague able to detect the fraud. This is a classic fraud risk environment. Option A identifies errors, not fraud risk. Option B is a valid operational concern but misses the specific fraud risk. Option D understates the risk — separation of duties should prevent fraud regardless of audit coverage.

Question 9 · Syllabus ref C6a · Internal controls — definition and purpose

Which of the following best defines 'internal controls' in an organisational context?

  1. The external audit procedures carried out by independent auditors to verify financial statements
  2. The policies, procedures, and systems put in place by management to safeguard assets, ensure reliable financial reporting, and promote compliance with laws and regulations
  3. The regulations issued by government bodies that companies must comply with
  4. The budgeting and forecasting systems used by management to plan future performance
Show answer and explanation

Answer: B. Internal controls are the policies, procedures, and processes that management designs and implements within the organisation to achieve specific objectives: protecting assets from loss or misappropriation, ensuring that financial information is accurate and reliable, and promoting compliance with laws, regulations, and internal policies. They are internal — designed by the organisation for its own governance — not external. Option A describes external audit, which is an independent third-party activity. Option C describes external regulation, which is imposed on the organisation rather than designed by it. Option D describes the planning function rather than control.

Question 10 · Syllabus ref C7b · AI in accounting — effects on the accountant's role

An accountancy firm introduces AI software that can automatically extract data from thousands of supplier invoices, match them to purchase orders, flag anomalies, and produce reconciliation reports in minutes. In relation to the role of the accountant, are the following statements TRUE or FALSE? Statement 1: The AI removes the need for professional judgement entirely, as all decisions are made algorithmically. Statement 2: The accountant's role shifts toward interpreting AI outputs, investigating exceptions, and applying professional judgement to complex cases.

  1. Statement 1 True, Statement 2 False
  2. Statement 1 False, Statement 2 True
  3. Both statements are True
  4. Both statements are False
Show answer and explanation

Answer: B. Statement 1 is FALSE: AI automates routine, repetitive, rule-based tasks but it does not eliminate the need for professional judgement. Complex transactions, unusual circumstances, ethical considerations, and client relationships all require human expertise that AI cannot replicate. Statement 2 is TRUE: AI changes the nature of the accountant's role rather than eliminating it. Accountants increasingly focus on interpreting AI outputs, investigating exceptions that the AI has flagged, providing business insight, and applying professional judgement — a shift from data processing to analysis and advisory work.

Question 11 · Syllabus ref C7e · Cyber security — phishing

A finance director receives an email that appears to be from the company's bank, requesting that she logs in to verify a transaction using a link in the email. The website she is directed to looks identical to the bank's real website but has a slightly different URL. Which type of cyber attack does this describe?

  1. A ransomware attack — malicious software has encrypted the company's data and is demanding payment for its release
  2. A denial of service attack — the attacker is overwhelming the bank's website with traffic
  3. Social engineering through phishing — the attacker creates a fraudulent website to deceive the victim into revealing login credentials
  4. A man-in-the-middle attack — the attacker is intercepting communications between the company and the bank
Show answer and explanation

Answer: C. This describes a phishing attack, a form of social engineering where the attacker uses deception rather than technical exploitation to manipulate the victim into taking a harmful action. The fraudulent email and copycat website are designed to trick the finance director into entering her login credentials, which the attacker then captures. The slightly different URL is a classic indicator of a phishing site. Ransomware (Option A) involves malicious software encrypting files, not credential theft via fake websites. Denial of service (Option B) attempts to overwhelm a system rather than steal credentials. A man-in-the-middle attack (Option D) intercepts real communications in transit rather than directing the victim to a fake site.

Question 12 · Syllabus ref C2a · Accounting function contribution

A management accountant provides monthly performance reports to divisional managers showing actual costs against budget. Which role of the accounting function does this best illustrate?

  1. Stewardship — safeguarding the organisation's assets on behalf of its owners
  2. Control — providing information that enables managers to monitor performance and take corrective action
  3. Decision-making — evaluating alternative courses of action for senior management
  4. Compliance — ensuring the organisation meets its statutory reporting requirements
Show answer and explanation

Answer: B. The accounting function contributes to planning (budgets), control (monitoring actual vs planned performance), and decision-making (providing relevant information for choices). Monthly reports comparing actual costs to budget are a control mechanism — they highlight deviations so managers can investigate and take corrective action. Stewardship relates to protecting assets. Decision-making involves specific one-off analyses. Compliance relates to statutory obligations — management accounts are internal and not a compliance document.

Question 13 · Syllabus ref C2b · Management accounting functions

Which of the following is a management accounting function rather than a financial accounting function?

  1. Preparing the statutory annual report and financial statements
  2. Recording transactions in the general ledger
  3. Preparing budgets and exercising budgetary control
  4. Ensuring compliance with IFRS accounting standards
Show answer and explanation

Answer: C. Management accounting focuses on internal information for decision-making, planning, and control — budgeting and budgetary control is a core management accounting activity. Financial accounting focuses on external reporting: the statutory annual report (A), maintaining records for financial statement preparation (B), and compliance with reporting standards (D) are all financial accounting activities. The distinction is internal versus external focus: management accounts are for managers, financial accounts are for shareholders and other external users.

Question 14 · Syllabus ref C3c · Consequences of failing to maintain records

Which of the following is a potential consequence for a limited company that fails to maintain adequate accounting records as required by law?

  1. The company's external auditors will automatically prepare replacement records
  2. Shareholders will be personally liable for any resulting tax underpayments
  3. The company's bankers will immediately withdraw all credit facilities
  4. Directors may face personal criminal liability and the company may be subject to fines
Show answer and explanation

Answer: D. Company law in most jurisdictions requires directors to maintain adequate accounting records. Failure to do so is a criminal offence — directors can face personal prosecution and the company can be fined. Auditors (A) have no obligation to prepare records — they audit what management prepares. Shareholders enjoy limited liability (B) — they are not personally responsible for company tax. Bankers may review facilities but there is no automatic or immediate withdrawal (C) — that would depend on specific loan covenants.

Question 15 · Syllabus ref C5a · Financial systems — system requirements

When an organisation is selecting a new accounting system, which of the following should be the primary consideration?

  1. Whether the system meets the organisation's specific information needs and supports its objectives
  2. Whether the system is the most technically sophisticated option available on the market
  3. Whether the system has the lowest upfront purchase cost of all available alternatives
  4. Whether the system is used by the majority of competitor organisations in the sector
Show answer and explanation

Answer: A. System selection should be driven by fit with the organisation's specific needs — its size, complexity, reporting requirements, and strategic objectives. Technical sophistication (B) is irrelevant if the features are not needed. Cost (C) matters but is not the primary criterion — a cheap system that fails to meet requirements creates greater long-term cost. Competitor usage (D) is not a reliable indicator of suitability for a specific organisation's circumstances. The right system is the one that best supports what the organisation needs to do.

Question 16 · Syllabus ref C3a · Internal controls — types

A company requires that all purchase orders above £5,000 must be approved by a manager before being placed with a supplier. Which type of internal control does this represent?

  1. Detection control — identifying errors or irregularities after they have occurred
  2. Corrective control — fixing errors identified in the transaction process
  3. Authorisation control — ensuring transactions above a threshold are approved by an appropriate person
  4. Physical control — restricting access to assets and sensitive locations
Show answer and explanation

Answer: C. Authorisation controls require that transactions meet defined criteria and are approved by a person with appropriate authority before proceeding. Requiring manager approval for purchases above £5,000 is a classic authorisation control — it prevents unauthorised commitments before they occur. Detection controls (A) operate after the event (e.g. bank reconciliations). Corrective controls (B) fix identified errors (e.g. reprocessing a rejected payment). Physical controls (D) restrict access to tangible assets or locations.

Question 17 · Syllabus ref C3b · Segregation of duties

Why is segregation of duties considered a fundamental principle of internal control?

  1. It reduces the total number of staff required to process transactions by standardising procedures
  2. It means that all transactions are processed faster because responsibilities are clearly defined
  3. It eliminates the need for supervisory review of individual employee performance
  4. It ensures that no single individual can both initiate and conceal a fraudulent transaction, as collusion between multiple people is harder to achieve
Show answer and explanation

Answer: D. Segregation of duties works by dividing incompatible functions among different people — for example, separating the roles of authorising a payment, processing it, and reconciling the bank account. If one person performs all three, they could commit and conceal fraud alone. Requiring multiple people to collude significantly increases the difficulty and risk of fraud. Option A is incorrect — segregation typically requires more staff, not fewer. Option B is incorrect — speed is not the purpose and may not be the result. Option C is incorrect — supervision remains important.

Question 18 · Syllabus ref C4b · IT systems — data integrity

Which of the following best describes a control designed to maintain data integrity in an accounting system?

  1. Validation checks that prevent entry of data outside defined parameters, such as rejecting negative stock quantities
  2. Daily backup of all accounting data to an offsite server
  3. Encryption of data transmitted between the accounting system and remote users
  4. Restricting system access to authorised users through password protection
Show answer and explanation

Answer: A. Data integrity controls ensure data entered into a system is accurate, complete, and valid. Validation checks — such as range checks, format checks, or rejecting illogical entries — prevent bad data entering the system at the point of input. Backup (B) is a recovery control protecting against data loss, not an integrity control. Encryption (C) protects data in transit from interception but does not validate accuracy. Access controls (D) prevent unauthorised users but do not prevent authorised users from entering incorrect data.

Question 19 · Syllabus ref C1b · The relationship between accounting and other functions

A sales director argues that the finance team's credit control policies are too restrictive and are losing customers. Which of the following best describes how this conflict should ideally be resolved?

  1. By deferring to the sales director's judgement as revenue generation takes precedence over credit risk
  2. By having the finance director make the final decision as financial control is the primary objective of any business
  3. By creating separate credit policies for each department based on their own priorities
  4. Through cross-functional discussion that balances the revenue objectives of sales against the risk management objectives of finance, seeking a solution aligned with overall company strategy
Show answer and explanation

Answer: D. Conflicts between functions are best resolved through cross-functional dialogue that considers all perspectives in the context of overall organisational objectives. Credit control balances revenue growth against bad debt risk — neither function's view is automatically correct. Option A ignores the real risk of bad debts. Option B incorrectly elevates financial control above all other objectives. Option C — separate policies per department — would undermine consistency and could create significant financial risk.

Question 20 · Syllabus ref C3f · Bribery and corruption

An employee of a construction company makes a payment to a local government official to secure a planning approval that would otherwise be delayed. Which of the following correctly describes this situation?

  1. This is bribery — an illegal act in most jurisdictions that creates criminal liability for both the individual and potentially the organisation
  2. This is a facilitation payment which is a legitimate business practice in international commerce
  3. This is an example of normal commercial negotiation and does not raise ethical concerns
  4. This is only illegal if the payment is made in cash rather than through a business account
Show answer and explanation

Answer: A. Making a payment to a public official to obtain a favourable decision is bribery — a criminal offence in most jurisdictions including the UK (under the Bribery Act 2010). Both the individual making the payment and the organisation may face criminal liability. Facilitation payments (B) are small payments to speed up routine processes — even these are illegal under UK law, and in any case, securing a planning approval goes well beyond a routine administrative function. Options C and D reflect dangerous misconceptions that students must be disabused of.

Question 21 · Syllabus ref C3g · Computer fraud and cybercrime

An employee receives an email purporting to be from their company's bank, asking them to click a link and re-enter their online banking credentials. This is an example of which type of cyber attack?

  1. Malware — malicious software installed on the company's network without authorisation
  2. Phishing — a social engineering attack designed to trick individuals into revealing sensitive information
  3. A denial of service attack — designed to overwhelm the bank's systems and prevent legitimate access
  4. Ransomware — software that encrypts company data and demands payment for its release
Show answer and explanation

Answer: B. Phishing involves fraudulent communications (typically emails) that impersonate a trusted entity to trick the recipient into revealing sensitive information such as passwords or banking credentials. Malware (A) involves malicious software installed on systems — not described here. Denial of service (C) attacks overwhelm servers — this is a targeted individual attack, not a server attack. Ransomware (D) encrypts data and demands payment — not what is described. Recognising phishing is a key element of cyber awareness training.

Question 22 · Syllabus ref C2c · Finance function — working capital

Which of the following best describes the working capital cycle of a manufacturing business?

  1. The process by which a business obtains long-term finance to fund capital investment in non-current assets
  2. The cycle of annual budgeting, performance monitoring, and variance reporting that supports management control
  3. The process by which the finance function prepares and publishes statutory financial statements each year
  4. The process by which cash is used to purchase materials, materials are converted into finished goods, goods are sold on credit, and the resulting receivables are collected to return to cash
Show answer and explanation

Answer: D. The working capital cycle describes the flow of cash through the short-term operating cycle: cash → raw materials → work in progress → finished goods → receivables → cash. Managing this cycle efficiently — minimising the time cash is tied up — is a key treasury function. Option A describes long-term capital financing, not working capital. Option B describes the management accounting cycle. Option C describes financial reporting — all distinct from working capital management.

Question 23 · Syllabus ref C6b · Internal audit

Which of the following best describes the scope of the internal audit function?

  1. Internal audit can review any area of the organisation including financial controls, operational processes, IT systems, and risk management
  2. Internal audit is restricted to reviewing the accuracy of financial statements and accounting records
  3. Internal audit only operates when external auditors request assistance with their annual statutory audit
  4. Internal audit reports exclusively to the external auditors who commission and direct its work
Show answer and explanation

Answer: A. Internal audit has a broad remit — it can review financial controls, operational effectiveness, IT governance, risk management frameworks, and any other area where the audit committee or management require assurance. It is not restricted to financial reporting (B). It operates independently of the external audit — it does not exist to assist external auditors (C) and does not report to them (D). Internal audit reports to the audit committee or senior management, maintaining independence from the activities it reviews.

Question 24 · Syllabus ref C3h · Ethical responsibilities of the accountant in detecting fraud

An accountant performing a routine review of the petty cash account notices a pattern of small, round-sum withdrawals with minimal supporting documentation, consistent with possible misappropriation. What is the most appropriate immediate response?

  1. Ignore the pattern as petty cash amounts are immaterial to the overall financial statements
  2. Document the observation, apply professional scepticism, and escalate to an appropriate level within the organisation for further investigation
  3. Immediately contact the police as suspected fraud must be reported to law enforcement without delay
  4. Confront the employee responsible for petty cash directly and demand an explanation
Show answer and explanation

Answer: B. When an accountant notices indicators of possible fraud, the appropriate response is to apply professional scepticism, document findings, and escalate internally through appropriate channels (line management, internal audit, or the audit committee). Ignoring potential fraud because amounts are small (A) is inappropriate — patterns of small amounts can indicate systematic misappropriation. Going directly to police (C) is premature — internal investigation should normally precede external reporting. Direct confrontation (D) risks alerting the suspect, destroying evidence, and prejudging the outcome.

Question 25 · Syllabus ref C7c · Big data and data analytics

Which of the following best describes how big data analytics can benefit the finance function of a large organisation?

  1. It replaces the need for professional judgement by automating all financial analysis and reporting
  2. It eliminates the risk of fraud by monitoring all transactions in real time with 100% accuracy
  3. It enables analysis of large volumes of structured and unstructured data to identify patterns, trends, and anomalies that support better decision-making
  4. It reduces the volume of data the finance function needs to manage by compressing historical records
Show answer and explanation

Answer: C. Big data analytics allows finance functions to process and analyse vast amounts of data — from multiple internal and external sources — to surface insights, identify unusual patterns (including potential fraud indicators), and support strategic decisions. It augments rather than replaces professional judgement (A) — humans interpret and act on analytical outputs. It reduces fraud risk but cannot guarantee elimination with 100% accuracy (B). It does not compress or reduce data volumes (D) — it typically involves managing and analysing much larger data sets.

Question 26 · Syllabus ref C4c · E-business and e-commerce

Which of the following best distinguishes e-commerce from e-business?

  1. E-business is a subset of e-commerce — it refers only to business-to-business transactions
  2. E-commerce and e-business are interchangeable terms describing the same concept
  3. E-commerce refers specifically to buying and selling transactions conducted online; e-business encompasses all business processes that use internet technologies, including internal operations
  4. E-business refers only to social media marketing activities that drive online sales
Show answer and explanation

Answer: C. E-commerce is the buying and selling of goods and services over the internet — the transactional component. E-business is broader, encompassing all business activities that leverage internet and digital technologies, including internal processes (supply chain management, HR systems, finance systems), customer relationship management, and communications, in addition to e-commerce. Option A reverses the relationship — e-commerce is the subset, not e-business. They are not interchangeable (B). Option D is too narrow (D).

Other BT topics

Advertisement