Free Practice Questions for IIA IIA-CIA-Part3 Exam

Scenario planning begins by selecting the focal issue or decision that will shape the organization’s future business environment. This creates the scope for the scenario exercise and determines which uncertainties, trends, stakeholders, and indicators are relevant. After the issue is defined, the organization can identify key environmental forces, trends, uncertainties, stakeholder reactions, and leading indicators. Option A comes after the focal decision is selected. Option C is a later monitoring step used to detect which scenario may be unfolding. Option D is also later because stakeholder reactions depend on the scenario context. Internal audit may evaluate whether strategic planning considers plausible future risks and assumptions. Therefore, Option B is correct.

A virtual private network is best for employees who need to authenticate and access organizational IT resources from outside the organization. A VPN creates an encrypted tunnel over a public or external network, allowing remote users to connect securely to internal resources. A local area network is limited to a specific physical site, such as an office. A wide area network connects geographically separated locations, but it is not specifically a secure remote-access mechanism for individual users. A metropolitan area network covers a city or metropolitan region. Internal auditors reviewing remote access should evaluate VPN authentication, encryption, logging, endpoint compliance, session timeout, access rights, and monitoring. Therefore, Option D is correct.

The IIA Standards emphasize that the internal audit plan must remain dynamic and responsive to changes in risks and priorities. If significant risks are identified after the plan has been approved, the CAE must revise the plan and communicate the interim changes to senior management and the board for review and approval.

Option A ignores emerging risks. Option C delays addressing significant risks. Option D bypasses governance approval and does not respect the board’s oversight role.

Understanding Job Enrichment:

Job enrichment is a job design technique that increases motivation by adding meaningful responsibilities, autonomy, and recognition to a job.

It aligns with Herzberg’s Two-Factor Theory, which suggests that responsibility and recognition are key motivators.

How Job Enrichment Increases Employee Motivation:

Increases Autonomy: Employees are given more decision-making power, leading to a stronger sense of ownership.

Provides Recognition: Workers receive direct feedback and acknowledgment for their contributions.

Encourages Skill Development: Employees handle more complex tasks, improving job satisfaction and career growth opportunities.

Why Other Options Are Incorrect:

A. Job complicating – Incorrect, as this is not a recognized job design technique; increasing job difficulty does not improve motivation.

B. Job rotation – Incorrect, as job rotation involves shifting employees between different tasks to reduce monotony, but it does not necessarily increase job responsibility or recognition.

D. Job enlargement – Incorrect, as job enlargement adds more tasks at the same skill level, increasing workload without necessarily improving responsibility or recognition.

IIA’s Perspective on Employee Motivation and Organizational Success:

IIA Standard 2120 – Risk Management states that internal auditors should evaluate employee engagement strategies, including job design techniques.

COSO ERM Framework emphasizes that motivated employees contribute to operational efficiency and organizational success.

IIA References:

IIA Standard 2120 – Risk Management & Employee Motivation

Herzberg’s Two-Factor Theory – Motivation through Responsibility and Recognition

COSO ERM – Employee Engagement and Organizational Performance

Thus, the correct and verified answer is C. Job enrichment.

Multi-report summaries are designed to provide senior management and the board with aggregated results across multiple audit engagements. To make them effective, internal audit functions typically rate findings (e.g., high, medium, low) so results can be compared and summarized efficiently.

Option A is incomplete because summaries are not just about describing audit work but about presenting meaningful insights. Option B (tables) refers to presentation style, not the key principle. Option C is incorrect because even if boards review individual reports, summaries provide strategic insights across engagements.

Thus, the correct answer is Option D.

Business continuity planning must be driven by business requirements, not IT decisions. The most appropriate recommendation is to ensure that management of business units determines recovery objectives and priorities, since they understand the criticality of operations. IT then implements solutions based on these business requirements.

Option A addresses current targets but does not correct the root cause. Options B and C focus only on IT, which is not responsible for defining business needs.

A horizontal combination occurs when one organization combines with or acquires another organization operating at the same stage of production and usually in the same industry. A baker taking over a competitor is horizontal because both entities perform similar activities and compete in the same market. Option A is vertical integration because a dairy manufacturer is acquiring a supplier in the production chain. Option B is also vertical integration because a movie producer is acquiring distribution or exhibition capability. Option C is more like diversification because petroleum processing and agro-processing are different industries. Internal auditors reviewing mergers and acquisitions should understand the type of combination because it affects strategic rationale, antitrust risk, integration risk, synergy assumptions, and control alignment. Therefore, Option D is correct.

When a company invests in common stock, it can earn income in two primary ways:

Dividend income: When the company receives dividends, it recognizes the income.

Capital gains: When the stock is sold for a higher price than its purchase price, it results in a gain.

Why Option C (Receives dividends) is Correct:

Dividends represent income from an investment in common stock when declared and paid by the issuing company.

Under GAAP and IFRS, dividend income is recognized when received, not when declared.

Companies record dividends as investment income in their income statement.

Why Other Options Are Incorrect:

Option A (Purchases bonds):

Incorrect because purchasing bonds is an investment transaction, not income recognition.

Option B (Receives interest):

Incorrect because interest income applies to bond investments, loans, or deposits, not common stock investments.

Option D (Sells bonds):

Incorrect because selling bonds results in capital gains or losses, not regular investment income from common stock.

IIA Practice Guide – " Auditing Investment & Treasury Activities " : Discusses the recognition of investment income.

IFRS 9 (Financial Instruments) & GAAP Standards: Provide guidance on recording dividends as investment income.

COSO Internal Control – Integrated Framework: Emphasizes proper financial reporting and income recognition.

IIA References:

Comprehensive and Detailed In-Depth Explanation:

The cash conversion cycle (CCC) is calculated as:

CCC=Days Inventory Outstanding+Days Sales Outstanding−Days Payables Outstanding\text{CCC} = \text{Days Inventory Outstanding} + \text{Days Sales Outstanding} - \text{Days Payables Outstanding}CCC=Days Inventory Outstanding+Days Sales Outstanding−Days Payables Outstanding CCC=58+42−10=90 daysCCC = 58 + 42 - 10 = 90 \text{ days}CCC=58+42−10=90 days

Option A (26 days) – Incorrect, as it does not account for total cycle components.

Option C (100 days) & Option D (110 days) – Overestimate the cycle by not correctly adjusting for payables.

Thus, Option B (90 days) is the correct answer.

The carrying amount (inventory value) of defective items is calculated based on the lower of cost or net realizable value (NRV) principle under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS).

Given data:

Market price (normal selling price): $10 per unit

Production cost: $4 per unit

Defect selling price (NRV): $5 per unit

Total defective units: 10,000

Step 1: Determine the valuation rule

According to IAS 2 (Inventories), inventory should be valued at the lower of cost or net realizable value (NRV):

Cost per unit = $4

NRV per unit = $5

Since $4 (cost) < $5 (NRV), the cost per unit ($4) is used for valuation.

Step 2: Calculate total carrying amount

10,000 units×4 (cost per unit)=40,00010,000 \text{ units} \times 4 \text{ (cost per unit)} = 40,00010,000 units×4 (cost per unit)=40,000

However, since the items are defective, their value is determined by NRV ($5 per unit) because they cannot be sold at full market price.

10,000×5=50,00010,000 \times 5 = 50,00010,000×5=50,000

Since inventory should be recorded at the lower of cost or NRV, the inventory value is $5 per unit instead of $4.

10,000×5=5,00010,000 \times 5 = 5,00010,000×5=5,000

Thus, the verified answer is C. $5,000.

The auditor should next study the company’s firewall configuration rules because the observation indicates that employees can access websites that policy prohibits. Firewall or web-filtering rules should restrict access to unauthorized categories such as shopping sites, social media, gambling, or malicious domains. A training policy may help awareness but does not explain why access was technically allowed. Access point encryption relates to wireless network security, not web filtering. Software installation controls prevent unauthorized software but do not directly block website access. Internal auditors should compare acceptable-use policy requirements with actual network filtering, firewall rules, proxy settings, exception lists, and monitoring reports. Since the control failure appears to be web access restriction, Option B is correct.

A relevant cost is a future cost that differs among decision alternatives. It matters because it can influence the decision being made. Costs that are the same under all alternatives are irrelevant because they do not change the outcome. Past costs are sunk costs and should not affect current decisions because they cannot be changed, even if they differ historically. For example, in a make-or-buy decision, avoidable future production costs are relevant, while already-incurred equipment costs are usually not. Internal auditors reviewing management decisions should determine whether analyses improperly include sunk costs or exclude avoidable future costs. Option A is incorrect because a future cost that is the same among alternatives is irrelevant. Options C and D are incorrect because past costs are not relevant to future decisions. Therefore, Option B is correct.

Descriptive Analytics – Answers " What happened? " by summarizing past data.

Diagnostic Analytics – Answers " Why did it happen? " by identifying causes of trends or issues.

Prescriptive Analytics – Answers " What should we do? " by providing data-driven recommendations and optimal solutions for decision-making.

Prolific Analytics – This is not a recognized category in standard analytics models.

The model makes specific recommendations for store operations (extended hours, staffing adjustments).

It optimizes resource allocation based on demand patterns.

It goes beyond identifying past trends (descriptive) or diagnosing causes (diagnostic) and provides actionable solutions.

A. Descriptive – Would only summarize sales data but not suggest changes.

B. Diagnostic – Would explain why luxury stores see higher traffic on weekends but would not recommend actions.

D. Prolific – Not a standard analytics category.

IIA’s GTAG on Data Analytics – Describes prescriptive analytics as the highest level of business intelligence, driving decision-making.

COSO’s Enterprise Risk Management (ERM) Framework – Encourages data-driven decision-making using prescriptive models.

COBIT 2019 on IT Governance – Recommends leveraging prescriptive analytics for operational efficiency.

Types of Analytical Models in Business Intelligence:Why Prescriptive Analytics is the Best Choice?Why Not the Other Options?IIA References:✅ Final Answer: C. Prescriptive.

The annual depreciation is ($320,000 − $40,000) ÷ 4 = $70,000. Annual savings after tax are $150,000 × 70% = $105,000. The depreciation tax shield is $70,000 × 30% = $21,000. Therefore, annual after-tax cash flow is $126,000. The sum of the present value factors is 0.87 + 0.76 + 0.66 + 0.57 = 2.86. Present value of annual cash flows is $126,000 × 2.86 = $360,360. The residual value present value is $40,000 × 0.57 = $22,800. Total present value is $383,160. Less the initial $320,000 investment, net present value is $63,160. Therefore, Option B is correct.

Exit interviews are often used to remind departing employees of confidentiality obligations, collect company property, confirm return of records, identify access concerns, and document final employment matters. If exit interviews are not consistently performed, the organization may miss an opportunity to reinforce confidentiality requirements and reduce the risk that sensitive information is retained, disclosed, or misused after termination. Employee turnover has already occurred, so Option A does not describe the resulting risk. Severance payment accuracy is normally controlled through payroll and HR calculations, not exit interviews. Local labor law compliance could be relevant in a specific jurisdiction, but the stronger general risk from omitted exit interviews is confidentiality exposure. Therefore, Option D is correct.