Free Practice Questions for IIA IIA-CIA-Part3 Exam

Understanding Capital Budgeting Techniques:

Capital budgeting helps organizations evaluate long-term investment decisions based on expected cash flows.

NPV (Net Present Value) considers total expected net cash flows over the investment’s life and discounts them to present value.

Why Option D (Net Present Value) Is Correct?

NPV calculates the present value of future net cash flows, adjusting for the time value of money.

If NPV is positive, the investment is considered profitable.

IIA Standard 2120 – Risk Management emphasizes financial decision-making tools like NPV for evaluating investment risks.

Why Other Options Are Incorrect?

Option A (Cash Payback):

Measures time to recover initial investment but does not consider total net cash flows.

Option B (Annual Rate of Return):

Uses accounting income, not cash flows, and does not factor in the time value of money.

Option C (Incremental Analysis):

Compares alternative options but does not evaluate total cash flows from an investment.

NPV is the correct method as it evaluates total expected cash flows over time.

IIA Standard 2120 supports financial analysis in investment decision-making.

Final Justification:IIA References:

IPPF Standard 2120 – Risk Management (Capital Budgeting & Investment Risks)

COSO ERM – Financial Risk Management & Decision Analysis

Financial Management Best Practices – NPV Analysis

When reviewing personal data consent and opt-in/opt-out management processes, internal auditors should focus on ensuring compliance with data protection regulations, such as the General Data Protection Regulation (GDPR) and other applicable data privacy laws. The most critical aspect is ensuring that personal data is processed strictly in line with the consent obtained from individuals.

Data Processing in Accordance with Consent (Correct Choice: B)

IIA Standard 2110 – Governance requires internal auditors to assess whether the organization has effective processes for ensuring compliance with laws and regulations, including data privacy obligations.

GDPR Article 5(1)(b) (Purpose Limitation Principle) mandates that personal data must be collected for specified, explicit, and legitimate purposes and must not be further processed in a manner incompatible with those purposes.

Internal auditors should verify that the organization adheres to this principle by ensuring that data is only used for the purpose for which consent was granted.

Why the Other Options Are Incorrect:

Option A: "Whether customers are asked to renew their consent for their data processing at least quarterly." (Incorrect)

GDPR does not mandate a quarterly renewal of consent. Instead, it requires that consent be freely given, specific, informed, and unambiguous. Periodic renewal may be advisable in some cases, but it is not a strict regulatory requirement.

IIA Standard 2120 – Risk Management requires auditors to evaluate compliance risk exposure, but excessive consent renewals could lead to inefficiencies without adding value.

Option C: "Whether the organization has established explicit and entitywide policies on data transfer to third parties." (Incorrect)

While data transfer policies are critical (as required under GDPR Articles 44-50 on international data transfers), they do not directly relate to the opt-in/opt-out process or consent management.

IIA Standard 2201 – Engagement Planning encourages reviewing policies, but the key focus should be on processing data according to the purpose of consent.

Option D: "Whether customers have an opportunity to opt-out the right to be forgotten from organizational records and systems." (Incorrect)

The right to be forgotten (GDPR Article 17) allows individuals to request data deletion, but it is not an opt-out feature in the traditional sense. Organizations must evaluate each request based on legal grounds before erasing data.

IIA Standard 2130 – Compliance requires verifying whether the organization ensures compliance with data privacy rights, but an opt-out for the right to be forgotten is not a primary audit focus.

IIA Standard 2110 – Governance (Ensuring regulatory compliance)

IIA Standard 2120 – Risk Management (Managing data privacy risks)

IIA Standard 2130 – Compliance (Reviewing legal obligations on personal data)

IIA Standard 2201 – Engagement Planning (Evaluating policies and controls)

GDPR Article 5(1)(b) – Purpose Limitation Principle (Processing data as per consent)

GDPR Articles 17, 44-50 (Data protection and right to be forgotten considerations)

Step-by-Step Justification for the Answer:IIA References for This Answer:Thus, Option B is the correct choice as it aligns with the purpose limitation principle and internal audit’s role in assessing compliance with data protection laws.

A one-time password (OTP) is a unique, temporary password that is valid for a single login session or transaction. It is commonly used in multi-factor authentication (MFA) systems to enhance security.

Correct Answer (D - When an Employee Uses a Key Fob to Produce a Token)

Key fobs generate a time-sensitive one-time password (OTP), which is used in conjunction with a traditional password to enhance security.

These devices are part of two-factor authentication (2FA) or multi-factor authentication (MFA) methods.

The IIA GTAG 9: Identity and Access Management discusses OTP tokens as a strong security control to prevent unauthorized access.

Why Other Options Are Incorrect:

Option A (When an employee accesses an online digital certificate):

Digital certificates authenticate users or devices, but they do not generate one-time passwords.

Option B (When an employee's biometrics have been accepted):

Biometric authentication (e.g., fingerprint, facial recognition) grants access based on biological traits, not an OTP.

Option C (When an employee creates a unique digital signature):

Digital signatures authenticate documents and transactions, but they are not time-sensitive one-time passwords.

IIA GTAG 9: Identity and Access Management – Covers OTP tokens as a security measure.

IIA Practice Guide: Auditing IT Security Controls – Recommends OTPs as part of secure authentication.

Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because key fobs generate one-time passwords for secure authentication.

Audit observations should include condition, criteria, cause, and effect. In this case, the condition (delay risk), criteria (schedule), and effect (penalties) are already presented. What is missing is the cause—the underlying reason for the project delay. Identifying the cause ensures recommendations address the root of the problem.

Comprehensive and Detailed In-Depth Explanation:

Password selection is the most dependent on the user, as it involves choosing and setting a secure password that meets organizational security requirements.

Option B (Password aging) – Controlled by system settings, not directly by the user.

Option C (Password lockout) – Automatically triggered after failed login attempts.

Option D (Password rotation) – Enforced by system policies, not the individual user’s decision.

Since password security starts with user selection, Option A is correct.

Under the variable costing method, product costs include only costs that vary with production, such as direct materials, direct labor, and variable manufacturing overhead.

(1) Direct labor costs. ✅

Correct. Direct labor is a variable cost directly tied to production levels, making it a product cost under variable costing.

(2) Insurance on a factory. ❌

Incorrect. Factory insurance is a fixed manufacturing overhead cost, which is not treated as a product cost under variable costing. It is considered a period cost instead.

(3) Manufacturing supplies. ✅

Correct. Manufacturing supplies (e.g., lubricants, small tools) are variable costs that increase with production, making them product costs under variable costing.

(4) Packaging and shipping costs. ❌

Incorrect. Packaging and shipping are selling & distribution costs, which are classified as period costs, not product costs.

IIA GTAG – "Auditing Cost Accounting Systems"

IIA Standard 2130 – Control Activities (Cost Management)

GAAP and IFRS Guidelines on Variable Costing

Analysis of Answer Choices:IIA References:Thus, the correct answer is B (1 and 3 only) because direct labor and manufacturing supplies are considered product costs under the variable costing method.

When developing the annual internal audit plan, the CAE must consider input from senior management, the board, and other internal assurance providers to ensure coordination and avoid duplication of efforts. While operational management, external auditors, and the CEO may also provide input, IIA Standards emphasize coordination with internal assurance providers as a mandatory step.

A high-performance culture is one where employees are motivated to achieve excellence, innovate, and contribute to organizational success. This requires recognition of individual contributions, team collaboration, and strong leadership.

Let's analyze each option:

A. Reiterating the importance of compliance with established policies and procedures.

Incorrect. While compliance is crucial for governance and risk management, simply enforcing policies does not inherently promote high performance. High-performance cultures go beyond compliance to encourage innovation, creativity, and ownership.

B. Celebrating employees' individual excellence. ✅ (Correct Answer)

Correct. Recognizing and rewarding employees for their achievements, innovation, and outstanding performance fosters motivation, engagement, and a culture of continuous improvement.

Examples include employee recognition programs, awards, and performance-based incentives.

C. Periodically rotating operational managers.

Incorrect. While job rotation can provide exposure to different roles, frequent changes in leadership may disrupt continuity and stability, potentially harming long-term performance.

D. Avoiding status differences among employees.

Incorrect. While reducing hierarchical barriers can improve collaboration, completely eliminating status differences is unrealistic. A well-structured leadership framework helps set clear roles, expectations, and accountability.

IIA Standard 2110 – Governance – Encourages fostering a performance-driven culture.

COSO ERM Framework – Performance & Strategy Alignment – Discusses the role of motivation and recognition in achieving organizational goals.

ISO 30414 – Human Capital Reporting – Covers employee engagement and performance culture.

IIA Practice Guide – Evaluating Corporate Culture – Highlights employee recognition as a key factor in high-performance environments.

IIA References:

Earned Value Analysis (EVA) is a project management technique that integrates scope, time, and cost data to measure project performance and progress objectively. EVA allows internal auditors to assess whether a software development project is on track by comparing planned work with completed work and actual costs.

Here’s why EVA is the most appropriate choice:

Evaluates Project Progress and Performance – EVA measures how much work has been completed against the planned schedule and budget, helping auditors analyze project efficiency.

Identifies Deviations – It highlights cost overruns or delays in task completion, which is critical for software development projects.

Uses Key Metrics – EVA includes essential indicators like:

Planned Value (PV) – The budgeted cost of work scheduled.

Earned Value (EV) – The value of actual work performed.

Actual Cost (AC) – The real cost incurred for work completed.

Schedule Variance (SV) and Cost Variance (CV) – Indicators of deviations from planned performance.

Supports Risk-Based Internal Audit Approach – The IIA emphasizes risk-based auditing, and EVA helps auditors assess risks related to project cost overruns, schedule slippage, and performance gaps.

A. A Balanced Scorecard – This measures overall organizational performance across perspectives (financial, customer, internal processes, and learning & growth), but it is not specifically designed for evaluating project task completion.

B. A Quality Audit – This focuses on compliance with quality standards and does not measure project task completion efficiency.

D. Trend Analysis – This evaluates patterns over time but does not provide a structured measurement of project progress in terms of cost, time, and completion percentage.

The IIA’s GTAG (Global Technology Audit Guide) on IT Project Management – Recommends using earned value analysis for project auditing.

IIA’s International Professional Practices Framework (IPPF) – Performance Standard 2120 (Risk Management) – Emphasizes the need for internal auditors to evaluate the effectiveness of project risk management, which EVA supports.

COSO’s Enterprise Risk Management (ERM) Framework – Encourages structured performance measurement techniques like EVA to monitor projects.

Why Not the Other Options?IIA References:Thus, Earned Value Analysis (EVA) is the correct answer because it provides a precise, quantitative way to measure project performance. ✅

A router and a switch serve different functions in a network.

A router is responsible for connecting multiple networks together and directing data packets between them. It determines the best path for data to travel using IP addresses.

A switch, on the other hand, operates within a single network and connects devices like computers, printers, and servers. It uses MAC addresses to forward data within the local network (LAN).

A. A router operates at layer two, while a switch operates at layer three of the OSI model – Incorrect. A switch operates at Layer 2 (Data Link Layer), while a router operates at Layer 3 (Network Layer).

B. A router transmits data through frames, while a switch sends data through packets – Incorrect. Switches use frames at Layer 2, while routers use packets at Layer 3.

C. A router connects networks, while a switch connects devices within a network (Correct Answer) – This correctly differentiates their functions.

D. A router uses a media access control (MAC) address during the transmission of data, while a switch uses an internet protocol (IP) address – Incorrect. A switch uses MAC addresses, and a router uses IP addresses.

IIA GTAG 17 – Auditing IT Governance discusses network security and the role of routers and switches.

COBIT 2019 – DSS01 (Managed Operations) emphasizes secure and efficient network management.

NIST SP 800-53 – Security Controls for IT Systems includes guidelines on network architecture and device functionality.

Explanation of Each Option:IIA References:

According to IIA guidance, if a nonconformance occurs, the CAE must evaluate its impact on the overall scope and operations of the internal audit activity. If the deficiency materially affects internal audit’s overall ability to fulfill its responsibilities, conformance cannot be claimed. If the impact is limited, conformance may still be declared with appropriate disclosure.

Options A and B assume automatic conformance without evaluation. Option C is incorrect because there is no concept of “partial conformance” under the Standards.

A differentiation strategy focuses on creating unique products or services to stand out from competitors. This strategy requires a flexible, decentralized structure that encourages innovation and market responsiveness, which is best achieved through a divisional structure.

Divisional Structure Supports Differentiation:

A divisional structure organizes the company into semi-autonomous business units, each focusing on a specific product, market, or geographic area.

This allows businesses to adapt strategies based on customer needs and competitive positioning.

Enhances Responsiveness and Innovation:

Each division operates independently, making quicker decisions that align with the differentiation strategy.

Fits Competitive Strategies:

Companies using differentiation need flexibility and customer focus, which a divisional structure provides better than rigid structures.

A. Functional structure:

Functional structures group employees by departments (e.g., finance, marketing) and are more suited for cost-leadership strategies, not differentiation.

C. Mechanistic structure:

A mechanistic structure is highly centralized and rigid, making it incompatible with innovation and differentiation.

D. Functional structure with cross-functional teams:

While this adds flexibility, it does not provide the autonomy needed for differentiation like a divisional structure does.

IIA Standard 2110 - Governance: Internal auditors assess business structures and strategies for alignment with organizational objectives.

COSO Framework - Performance Component: Ensures organizational structure supports strategic goals.

Key Reasons Why Option B is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is B. Divisional structure.

The auditor likely omitted the data normalization step, which is crucial when integrating multiple datasets from different sources (e.g., human resources (HR) and payroll). Without normalization, inconsistencies in formatting, naming conventions, or unique identifiers (e.g., employee ID vs. full name) can result in incorrect mismatches.

Standardization of Data Formats:

Employee names or IDs may be stored differently across systems (e.g., "John A. Doe" in HR vs. "Doe, John" in payroll).

Normalization ensures uniform formatting to enable accurate comparisons.

Removal of Duplicates & Inconsistencies:

Employee records could have multiple variations due to typos, abbreviations, or missing fields.

Proper cleaning and transformation of data ensures better accuracy.

Use of Unique Identifiers:

Instead of matching by name, the auditor should have used a unique identifier (e.g., Employee ID), which remains constant across systems.

A. Data analysis (Incorrect)

Reason: The auditor did attempt data analysis (matching employee records) but without proper preparation (normalization), the results were flawed.

B. Data diagnostics (Incorrect)

Reason: Data diagnostics refers to evaluating data quality issues, but it does not involve transforming data to a common format, which was the missing step.

C. Data velocity (Incorrect)

Reason: Data velocity relates to the speed at which data is processed, which is not relevant to the issue of incorrect matching.

IIA Global Technology Audit Guide (GTAG) 16: Data Analysis Technologies – Covers data quality, normalization, and audit data preparation.

IIA GTAG 3: Continuous Auditing – Discusses the importance of accurate data extraction and transformation.

IIA Standard 2320 – Analysis and Evaluation – Ensures appropriate data validation before concluding audit findings.

Why is Data Normalization Important?Analysis of Incorrect Answers:IIA References:Thus, the correct answer is D. Data normalization.