Free Practice Questions for IIA IIA-CIA-Part3 Exam

A lump-sum contract (also known as a fixed-price contract) is a contract type where the vendor agrees to complete a project for a predetermined price. In this scenario, the organization agreed to pay the vendor $3,000,000 to design, procure, and construct a power substation.

Lump-Sum Contract (Correct Answer: B)

A lump-sum contract (also called a fixed-price contract) is an agreement where the contractor is responsible for completing the entire project at a set price.

This type of contract transfers cost risk to the contractor since they must manage expenses within the agreed budget.

IIA Standard 2120 – Risk Management states that internal auditors should assess contract risks, including financial and performance risks in vendor contracts.

The contract price is predefined, which aligns with the scenario given in the question.

Why the Other Options Are Incorrect:

A. Cost-Reimbursable Contract (Incorrect)

A cost-reimbursable contract involves reimbursing the vendor for actual costs incurred, plus a fee or profit.

This is not applicable because the contract specifies a fixed price.

C. Time and Material Contract (Incorrect)

This contract type is based on actual time spent and materials used, typically used when scope is uncertain.

The given scenario clearly defines the project and budget, making this option unsuitable.

D. Bilateral Contract (Incorrect)

A bilateral contract refers to a mutual agreement between two parties where both have obligations.

While most contracts are bilateral in nature, this is not a specific contract type like lump-sum or cost-reimbursable contracts.

IIA Standard 2120 – Risk Management (Evaluating contract risks)

IIA Standard 2210 – Engagement Objectives (Assessing vendor contracts)

IIA Standard 2130 – Compliance (Ensuring contract compliance)

Step-by-Step Justification:IIA References for This Answer:Thus, the correct answer is B. A lump-sum contract because the contract is based on a predefined, fixed price of $3,000,000.

When an internal auditor calculates the mean (average), median (middle value), and range (difference between highest and lowest values) of a data population, the primary purpose is to assess the distribution of data and detect anomalies. Let’s analyze the answer choices:

Option A: To inform the classification of the data population.

Incorrect. Classification typically involves categorizing data into specific groups, which requires different statistical or analytical techniques like clustering or decision trees. Mean, median, and range are more useful for identifying distribution patterns.

Option B: To determine the completeness and accuracy of the data.

Incorrect. While summary statistics can highlight extreme values, completeness and accuracy are usually assessed through data reconciliation, validation checks, and comparison with source records.

Option C: To identify whether the population contains outliers.

Correct.

The range (difference between the largest and smallest values) helps to detect extreme values.

The mean and median can show whether the data is symmetrical or skewed (which may indicate outliers).

If the mean is significantly different from the median, it suggests potential outliers pulling the average in one direction.

IIA Reference: Internal auditors use data analytics to detect anomalies and potential fraud by identifying outliers. (IIA GTAG: Auditing with Data Analytics)

Option D: To determine whether duplicates in the data inflate the range.

Incorrect. Duplicates may affect the data set, but range calculations alone do not determine whether duplicates exist. Duplicate identification usually involves checking for repeated entries, not just extreme values.

A useful performance standard should be clear, measurable, objective, and capable of consistent evaluation. “All customer inquiries should be answered within seven days of receipt” is specific and testable. Internal audit can select inquiries, compare receipt dates with response dates, and determine compliance. Option A is weak because “kept to a minimum” is vague and does not define an acceptable benchmark. Option B is also vague because “promptly” is subjective unless a time requirement is defined. Option C describes desired behavior, but “positive attitude” is difficult to measure objectively without additional criteria. In evaluating performance, auditors should prefer standards that support evidence-based testing and reliable conclusions. Therefore, Option D is the most useful standard.

A key benefit of data analytics is reduced audit risk because auditors can focus risk assessment more precisely, stratify populations, identify anomalies, test larger data sets, and direct procedures toward higher-risk transactions. This improves the relevance and depth of audit testing. Option A is not a benefit by itself; more data extracts may increase complexity if not controlled. Option C incorrectly links analytics to increased staff. Analytics may broaden coverage, but not because more staff are added. Option D is too broad because analytics may support planning, but its primary value is improved risk focus and testing precision. Internal auditors should use analytics to identify outliers, trends, duplicates, unusual relationships, and control exceptions. Therefore, Option B is correct.

Comprehensive and Detailed In-Depth Explanation:

Jailbreaking a locked smart device (removing manufacturer-imposed restrictions) increases the risk of infringing on copyright and privacy laws, as it allows unauthorized access to software and applications.

Option A (Not installing anti-malware software) – Increases security risks but does not directly violate regulations.

Option B (Haphazard OS updates) – Can lead to vulnerabilities but is not a legal issue.

Option C (Weak passwords) – Poses a security threat but does not impact compliance with laws.

Since jailbreaking often violates software licenses and may lead to illegal use of software, Option D is the correct answer.

Vertical integration occurs when an organization expands into earlier or later stages of its value chain, such as acquiring suppliers or distributors. A major disadvantage is reduced flexibility to change partners. Once the organization owns or controls a supply or distribution stage, it may be locked into specific technologies, capacity levels, cost structures, or operational relationships. Option B is less convincing because vertical integration often reduces supplier or buyer bargaining power. Option C is not generally true because integration may support differentiation through quality or supply control. Option D is also incorrect because vertical integration may increase control over proprietary knowledge. Internal audit should assess integration risks, including fixed-cost exposure, reduced flexibility, and operational complexity. Therefore, Option A is correct.

An internal auditor ' s primary concern in evaluating third-party help desk services is ensuring that the provider meets Service-Level Agreement (SLA) requirements, particularly regarding response times, issue resolution, and service quality.

Correct Answer (D - Whether the provider ' s responses and resolutions were well defined according to the SLA)

The SLA defines expected service levels, including:

Response and resolution times.

Performance metrics (e.g., first-call resolution rate).

Escalation procedures.

Compliance with contractual obligations.

The IIA Practice Guide: Auditing Third-Party Relationships states that internal auditors must assess SLA compliance as a key control in outsourcing arrangements.

Why Other Options Are Incorrect:

Option A (Whether every call was logged):

While logging all calls is good practice, the focus should be on meeting SLA requirements, not just documentation.

The IIA GTAG 7: Continuous Auditing emphasizes measuring performance, not just recording activities.

Option B (Whether a unique ID was assigned to each issue):

Issue tracking is important, but an ID alone does not guarantee service quality or SLA compliance.

Option C (Whether the provider used its own facilities):

The location of the service provider’s facilities does not impact SLA compliance.

IIA Practice Guide: Auditing Third-Party Relationships – Outlines how auditors should evaluate SLAs and vendor performance.

IIA GTAG 7: Continuous Auditing – Highlights the importance of performance measurement in outsourced services.

Step-by-Step Explanation:IIA References for Validation:Thus, ensuring the provider meets SLA-defined response and resolution times (D) is the internal auditor ' s greatest concern.

The phrase “confidentiality of different records within the database” points to authorization and access restrictions. The best control is restricting access permissions when mobile devices are used, because users should only access records required for their role and business purpose. Encryption protects data in transit, but it does not control which database records an authenticated user can view. Remote wiping helps after a device is lost but does not manage record-level confidentiality during normal use. Two-factor authentication strengthens login security, but after authentication, confidentiality still depends on authorization rules. Internal audit should evaluate least privilege, role-based access, mobile access restrictions, logging, and periodic access reviews. Therefore, Option C is correct.

Before internal audit information is released outside normal internal channels, legal representation should be consulted. Internal audit reports and workpapers may contain sensitive findings, confidential business information, legal exposure, personal data, fraud indicators, privileged communications, or regulatory implications. Releasing such information to other assurance providers without proper review can create legal and confidentiality risk. Option A is too broad because interactions with nongovernmental organizations vary by context and jurisdiction. Option B is false because disclosure laws differ significantly across countries. Option C may be relevant in specialized donor-funded environments, but it is not the strongest general rule. Internal audit must control dissemination of results and protect confidentiality. Therefore, Option D is correct.

Audit observations should include condition, criteria, cause, and effect. In this case, the condition (delay risk), criteria (schedule), and effect (penalties) are already presented. What is missing is the cause—the underlying reason for the project delay. Identifying the cause ensures recommendations address the root of the problem.

The first step in pricing is to develop pricing objectives. Management must decide what the price is intended to achieve, such as profit maximization, market penetration, market skimming, survival, target return, market share growth, or product positioning. Once objectives are clear, the organization can assess demand, estimate costs, analyze competitors, select a pricing method, and set the final price. Determining product cost is important, but cost alone does not define the pricing strategy. Competitor prices must be evaluated, but only after the organization understands its own pricing purpose and market position. Selecting a pricing method is also premature until objectives, demand, cost, and competition have been considered. Internal auditors reviewing pricing controls should test whether pricing decisions align with approved strategy. Therefore, Option B is correct.

Subjective factors are based on judgment or opinion, whereas objective factors rely on measurable data. The quality of staff supervision is a judgment-based assessment, making it subjective.

Options A, C, and D are measurable, quantitative factors and thus objective.

In a bring-your-own-device environment, employees use personally owned devices for work activities. The most relevant privacy risk is that employees may believe the organization can intrusively monitor personal information, location data, browsing activity, personal applications, photos, or communications on their devices. Option B is a confidentiality and intellectual property risk, not the best privacy risk. Option A is a patching and security compliance risk. Option D is a malware and information security risk. Internal audit should verify that BYOD policies clearly define monitoring scope, employee consent, data separation, remote wipe rights, privacy protections, and acceptable use. Privacy risk is strongest when personal and business data coexist on the same device and monitoring controls are not transparent.

A business continuity and disaster recovery plan does not prevent natural disasters, predict when they will occur, or eliminate the threat. Its value is that it reduces the likelihood that such events will severely disrupt operating activities by preparing recovery strategies, alternate procedures, communication protocols, backup arrangements, and restoration priorities. Natural disasters may still occur, but an effective plan helps the organization continue critical services or recover them within acceptable timeframes. Option A is too absolute because economic impact may still occur. Option B is incorrect because continuity planning does not forecast disasters. Option D is also incorrect because threats cannot be eliminated. Internal audit should assess whether continuity and recovery plans align with business impact analysis, recovery time objectives, and recovery point objectives. Therefore, Option C is correct.