Free Practice Questions for IIA IIA-CIA-Part3 Exam

Database administrators (DBAs) have privileged access, meaning they can make unauthorized or hidden changes to data, database structures, and security settings without detection. This presents a high risk of fraud, data manipulation, and security breaches.

A. The risk that database administrators will disagree with temporarily preventing user access to the database for auditing purposes. (Incorrect)

While resistance from DBAs during an audit can be a challenge, it is not a significant risk compared to the ability to manipulate data unnoticed.

B. The risk that database administrators do not receive new patches from vendors that support database software in a timely fashion. (Incorrect)

Patch management is a security concern but does not directly relate to the unique risk of DBAs abusing privileged access.

C. The risk that database administrators set up personalized accounts for themselves, making the audit time-consuming. (Incorrect)

While personal accounts can complicate audits, the greater risk is that DBAs can make changes without detection.

IIA GTAG 4 – Management of IT Auditing emphasizes the need for controls over privileged access to prevent unauthorized database modifications.

IIA Standard 2110 – Governance requires internal auditors to assess risks related to IT governance and privileged access management.

IIA GTAG 8 – Auditing Application Controls highlights that auditors must review DBA activity logs and ensure segregation of duties.

Explanation of Answer Choices:IIA References:Thus, the correct answer is D. The risk that database administrators could make hidden changes using privileged access.

A flat organizational structure is characterized by fewer hierarchical levels and wider spans of control, meaning that managers oversee a larger number of employees directly.

Definition of a Flat Structure:

A flat structure reduces middle management layers, promoting direct communication between top executives and employees.

According to IIA’s Organizational Governance Guidelines, organizations with a flat structure empower employees and reduce bureaucratic delays.

Key Characteristics of a Flat Structure:

Wide Span of Control: Managers oversee more employees due to fewer hierarchical levels.

Faster Decision-Making: Less bureaucracy allows for quicker responses.

Greater Employee Autonomy: Employees have more decision-making responsibilities.

Why Not Other Options?

A. The structure is dispersed geographically:

A geographically dispersed organization is not necessarily flat; it could be hierarchical or matrix-based.

B. The hierarchy levels are more numerous:

Flat structures have fewer levels, while tall structures have numerous levels.

D. The lower-level managers are encouraged to exercise creativity when solving problems:

While creativity may be encouraged, this is not a defining feature of a flat structure.

IIA Practice Guide: Organizational Governance

IIA Standard 2110 – Governance

Step-by-Step Justification:IIA References:Thus, the correct and verified answer is C. The span of control is wide.

To enable management to receive timely feedback and mitigate unforeseen risks, it is critical to have a performance measurement system in place. Measuring product performance against an established standard is a key control mechanism that allows management to identify deviations, take corrective actions, and mitigate risks proactively.

Performance Monitoring & Timely Feedback: Comparing actual product performance against set standards helps in detecting quality issues, inefficiencies, or process failures early.

Risk Mitigation: Ensures that any deviations from expected performance can be addressed before they become major problems.

Internal Control Best Practices: Measuring against standards aligns with IIA’s risk management principles to ensure continuous monitoring and improvement.

Option B (Develop standard methods for performing established activities): While standardization improves efficiency, it does not provide ongoing feedback or mitigate unforeseen risks in real-time.

Option C (Require the grouping of activities under a single manager): Centralizing activities may improve coordination, but it does not directly provide timely performance feedback.

Option D (Assign each employee a reasonable workload): Managing workloads ensures efficiency but does not provide risk mitigation through performance monitoring.

IIA’s Standard 2120 – Risk Management: Requires internal auditors to assess whether an organization’s risk management processes enable timely risk identification and mitigation.

COSO’s Internal Control Framework (Performance Monitoring Component): Emphasizes measuring actual performance against expected outcomes as a fundamental internal control.

Why Option A is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is A. Measure product performance against an established standard.

User-Developed Applications (UDAs) are software tools, typically spreadsheets or small databases, created by business users rather than IT professionals. These applications often lack formal security, documentation, and control measures, increasing the risk of data errors, unauthorized access, and compliance failures.

UDAs are often created quickly to meet immediate business needs, without following IT governance, security controls, or development standards.

Unlike traditional IT applications, UDAs lack structured testing, change management, and formal documentation.

The IIA’s GTAG 14 – Auditing User-Developed Applications states that UDAs present higher risks because they are not subject to the same controls as IT-managed applications.

A. UDAs and traditional IT applications typically follow a similar development life cycle → Incorrect. Traditional IT applications follow a formal Software Development Life Cycle (SDLC), whereas UDAs are developed informally by end-users.

B. A UDA usually includes system documentation to illustrate its functions, and IT-developed applications typically do not require such documentation. → Incorrect. IT applications require extensive documentation, whereas UDAs often lack documentation entirely.

D. IT testing personnel usually review both types of applications thoroughly to ensure they were developed properly. → Incorrect. IT applications undergo rigorous testing and quality assurance, while UDAs often bypass IT reviews altogether.

IIA GTAG 14 – Auditing User-Developed Applications highlights the risks of UDAs and emphasizes the need for internal controls.

COBIT Framework (Control Objectives for Information and Related Technologies) recommends IT governance measures for all business-critical applications.

ISO 27001 (Information Security Management System) warns against uncontrolled user-developed applications due to security risks.

Why Option C is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is C. Unlike traditional IT applications, UDAs typically are developed with little consideration of controls.

Remote wipe is not always 100% effective: While remote wiping can delete most user data, some residual data may remain on the device, especially in cases where:

The device has built-in storage redundancies.

Deleted data can be recovered using forensic tools.

The remote wipe command fails to execute properly due to network issues or device settings.

Security Risk: This limitation poses a risk for organizations handling sensitive or confidential data, as unauthorized individuals may recover wiped data.

IIA Standard 2110 - Governance: Internal auditors must assess how organizations manage IT security risks, including risks related to mobile devices and data protection.

IIA Practice Guide: Auditing Cybersecurity Risks highlights the need to evaluate mobile security controls and limitations of data removal techniques.

A. Encrypted data cannot be locked to prevent further access (Incorrect)

Encrypted data remains secure even if the device is lost.

Many enterprise security solutions allow organizations to revoke encryption keys remotely, making data inaccessible.

IIA Standard 2120 - Risk Management advises that effective encryption reduces the impact of data loss.

B. Default settings cannot be restored on the device. (Incorrect)

Most remote wipe solutions allow factory reset, restoring the device to default settings.

Many mobile device management (MDM) tools support full device restoration.

D. Mobile device management software is required for a successful remote wipe. (Incorrect)

While MDM enhances remote wiping capabilities, it is not strictly required.

Some consumer and enterprise mobile operating systems (e.g., iOS, Android) provide built-in remote wipe functionality without MDM.

Explanation of Answer Choice C (Correct Answer):Explanation of Incorrect Answers:Conclusion:Remote wipe has limitations, and the inability to completely remove all data from the device (Option C) is a primary concern.

IIA References:

IIA Standard 2110 - Governance

IIA Standard 2120 - Risk Management

IIA Practice Guide: Auditing Cybersecurity Risks

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is the primary control for preventing unauthorized external access to an organization's network, making it the best answer.

A. Firewall (Correct Answer) – Firewalls prevent unauthorized access by filtering traffic, blocking malicious connections, and securing the network perimeter.

B. Encryption – While encryption protects data confidentiality, it does not actively prevent unauthorized access to a network.

C. Antivirus – Antivirus software protects against malware and viruses but does not prevent unauthorized network access.

D. Biometrics – Biometrics controls physical or logical access (e.g., fingerprint authentication) but does not secure a network from external threats.

IIA GTAG 15 – Information Security Governance highlights firewalls as a critical security control for network protection.

IIA IPPF Standard 2110 – Governance emphasizes the need for network security policies that include firewalls.

NIST SP 800-41 Rev. 1 – Guidelines on Firewalls and Firewall Policy states that firewalls are the first line of defense in securing organizational networks.

Explanation of Each Option:IIA References:

When an organization buys equity securities for trading purposes, it means that these securities are classified as trading securities. According to International Financial Reporting Standards (IFRS) and Generally Accepted Accounting Principles (GAAP):

Trading securities are measured at fair value.

Unrealized gains and losses from changes in fair value are recognized in net income, not in shareholders' equity.

A. At fair value with changes reported in the shareholders' equity section. (Incorrect)

This treatment applies to available-for-sale (AFS) securities under previous GAAP rules, but not to trading securities.

Under IFRS 9, AFS classification has been removed, and most equity investments are recorded at fair value through profit or loss (FVTPL).

B. At fair value with changes reported in net income. (Correct)

This is the correct treatment for trading securities, as per IFRS 9 and ASC 320 (FASB).

C. At amortized cost in the income statement. (Incorrect)

Amortized cost is used for held-to-maturity (HTM) debt securities, not for equity securities held for trading.

D. As current assets in the balance sheet. (Partially Correct but Incomplete)

While trading securities are usually classified as current assets, this answer does not address valuation and reporting of changes in fair value.

IIA Practice Guide: Auditing Investments highlights the importance of correctly valuing securities based on accounting standards.

IFRS 9 – Financial Instruments mandates fair value measurement for trading securities with gains/losses reported in profit or loss.

GAAP ASC 320 – Investments – Debt and Equity Securities aligns with IFRS, requiring fair value reporting through net income.

Explanation of Answer Choices:IIA References:Thus, the correct answer is B. At fair value with changes reported in net income.

Accounting Treatment for Investments with Little Influence:

When an investee has little or no influence over an entity, it uses the cost method (or fair value method, if applicable) to account for the investment.

Under the cost method, cash dividends received are recorded as dividend revenue rather than adjusting the investment account.

IIA Standard 2120 - Risk Management:

Internal auditors must ensure that financial reporting aligns with applicable accounting standards.

Applicable Accounting Standards:

IFRS 9 (Financial Instruments) and U.S. GAAP (ASC 320 - Investments in Equity Securities) state that dividends received should be recognized as income in the period received.

A. The cash dividends received increase the investee investment account accordingly. (Incorrect)

This applies to the equity method, used when an entity has significant influence (usually 20-50% ownership).

Under the cost method, dividend income is recognized as revenue, not as an increase in the investment account.

B. The investee must adjust the investment account by the ownership interest. (Incorrect)

Adjusting the investment account for ownership percentage is a feature of the equity method, not the cost method.

C. The investment account is adjusted downward by the percentage of ownership. (Incorrect)

A downward adjustment only occurs under the equity method when dividends exceed earnings, indicating a return of capital.

Under the cost method, dividends are recorded as revenue.

Explanation of Answer Choice D (Correct Answer):Explanation of Incorrect Answers:Conclusion:When an investee has little influence, dividends are recorded as revenue (Option D), following IFRS 9 and U.S. GAAP standards.

IIA References:

IIA Standard 2120 - Risk Management

IFRS 9 - Financial Instruments

U.S. GAAP ASC 320 - Investments in Equity Securities