There will be only a few marks in any one exam for “quoting” knowledge of ISAs – e.g. definitions of components of audit risk – but these don’t have to be verbatim as long as they correctly convey the meaning of the term. Everything else is application. E.g. the audit risk question will ask for auditor’s response to each risk – but that doesn’t require anything to be lifted from ISA 330 you just have to answer the question set to the examiner’s expectations (as specified in any examiner’s report).