Free Practice Questions for IIA IIA-CIA-Part3 Exam

Logging at the database and application levels is a critical security control that enables monitoring, detecting, and investigating potential security incidents. The absence of logging significantly increases cybersecurity risks and can leave an organization vulnerable to undetected attacks.

Incident Response & Forensics: Without logs, the organization will be unable to determine the cause, origin, and impact of cyber incidents or system intrusions.

Compliance Requirements: Many regulatory frameworks (e.g., ISO 27001, NIST 800-53, GDPR, PCI-DSS, SOX) require logging for security monitoring and auditability.

Threat Detection: Logs help in identifying malicious activities, unauthorized access, and data breaches.

Accountability: Ensures that actions taken within the system can be traced back to specific users or administrators.

Option A (The organization will be unable to develop preventative actions based on analytics): While logging helps in analytics, its primary function is incident detection and forensic investigation.

Option B (The organization will not be able to trace and monitor the activities of database administrators): This is partially correct, but logging is not just for administrators—it is essential for monitoring all system activities, including unauthorized access attempts.

Option D (The organization will be unable to upgrade the system to newer versions): Logging does not impact system upgrades; upgrades are related to software lifecycle management, not logging practices.

IIA’s Global Technology Audit Guide (GTAG) – Information Security Controls recommends logging as a fundamental security control.

IIA Standard 2110 – IT Governance: Emphasizes the need for adequate IT risk management, including logging.

COSO Framework (Monitoring Component): Highlights the importance of system monitoring, which includes logging.

Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is C. The organization will be unable to determine why intrusions and cyber incidents took place.

The primary goal of a business impact analysis is to identify critical business processes, key assets, required resources, supporting technology, dependencies, and the impact of disruption. This analysis allows the organization to determine recovery priorities and later define recovery time objectives and recovery point objectives. Option D describes an important output or communication activity, but it is not the primary goal compared with identifying what is critical and what resources are needed. Option A describes governance and risk management, which support the continuity program but are broader than BIA. Option C relates to testing, which occurs after continuity strategies and plans are developed. Internal audit should verify that the BIA is comprehensive, current, approved, and linked to recovery planning. Therefore, Option B is correct.

A management action plan should include: (1) corrective action, (2) responsible personnel, and (3) implementation timeline. In this case, while the corrective action and due date are included, the responsible personnel is missing, which is critical for accountability.

Option B (status) is tracked later during follow-up. Option C (policy reference) is not mandatory. Option D (risk level) belongs to the observation, not the action plan.

The CAE should first discuss the risk and its implications with the responsible management. This provides management the opportunity to reassess, take corrective action, or explain their position. If the issue remains unresolved and the risk is still deemed excessive, then escalation to senior management or the board may follow.

Option A (designing response) is management’s role. Option C (scheduling an audit) may be relevant later, but immediate discussion is the first step. Option D is premature without first engaging management.

The arrangement described is a cold recovery plan because the organization has an agreement to obtain equipment and restore data from off-site tapes, but the recovery site is not already fully configured and operational. A hot site would have systems, infrastructure, and data ready for rapid failover, often with real-time or near-real-time synchronization. A warm site would typically have some configured hardware and infrastructure already available, although not fully current. “No recovery plan” is incorrect because management has at least arranged for equipment rental and off-site backup restoration. Internal auditors should evaluate whether the selected recovery approach meets recovery time objectives, recovery point objectives, and business impact analysis requirements. Therefore, Option C is correct.

The auditor should not simply accept management’s comfort with the risk when data analytics show an unusual controlled-drug pattern. The appropriate next step is to investigate further by obtaining pharmacy policies, procedures, prescription reports, dispensing records, exception reports, and control documentation. Option A is premature because management’s belief does not provide sufficient evidence. Option B may be useful if data reliability is doubtful, but the question does not indicate the analysis was unreliable. Option D delays needed follow-up and may leave a serious compliance or diversion risk unaddressed. Internal audit should use data anomalies to focus risk assessment and obtain sufficient evidence before concluding whether controls are adequate. Therefore, Option C is correct.

When a company finances through bonds (debt) instead of issuing common stock (equity), it increases earnings per share (EPS) because bond financing does not dilute ownership, whereas issuing new stock does.

Impact on Earnings Per Share (EPS):

EPS formula: EPS=Net Income−Preferred DividendsNumber of Outstanding Shares\text{EPS} = \frac{\text{Net Income} - \text{Preferred Dividends}}{\text{Number of Outstanding Shares}}EPS=Number of Outstanding SharesNet Income−Preferred Dividends​

Since bond financing does not increase the number of shares outstanding, net income is distributed among fewer shareholders, increasing EPS.

If the company issues more stock instead of bonds, EPS decreases because the same earnings are divided among more shares.

Why Bond Financing Affects EPS Favorably:

Interest on bonds is tax-deductible, reducing taxable income and increasing net profits.

Unlike dividends, which are paid on common stock and reduce retained earnings, bondholders receive fixed interest payments that do not dilute equity ownership.

A. Lower shareholder control: ❌

Bondholders do not get voting rights, whereas issuing more stock reduces existing shareholders’ control.

This statement would be true for stock financing, not bond financing.

B. Lower indebtedness: ❌

Bonds increase a company’s debt obligations, not reduce them.

If a company uses stock financing instead of bonds, it avoids taking on debt.

D. Higher overall company earnings: ❌

While bonds increase EPS, they do not necessarily increase total earnings.

The company must pay interest on bonds, which could reduce net income if not managed properly.

IIA Standard 2110 (Governance): Ensures management selects financing strategies that align with financial stability.

COSO ERM Framework – Financial Risk Management: Evaluates how financing choices impact shareholder value and risk exposure.

IFRS & GAAP Accounting Standards on Debt vs. Equity Financing: Explain how bond financing increases EPS compared to issuing new shares.

Step-by-Step Justification:Why Not the Other Options?IIA References:

During a period of rising material costs, FIFO assigns the oldest and lower costs to cost of goods sold, while the newer and higher costs remain in ending inventory. This produces a lower cost of goods sold and therefore a higher gross profit and net income compared with average-cost methods. Specific identification depends on the actual units sold and does not necessarily produce the highest profit unless management selects lower-cost units. Weighted average smooths cost changes and usually produces profit between FIFO and newer-cost methods. Internal auditors should understand inventory valuation because it affects profitability, taxes, inventory carrying value, financial ratios, and management incentives. Since FIFO produces the highest profit in a rising-cost environment, Option C is correct.

Indirect labor costs incurred in the production process are treated as part of manufacturing overhead. Since the cost was incurred on the last day of the year, it is likely that the related products are still in inventory rather than being sold.

Under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS), indirect labor costs associated with manufacturing should be included in the cost of inventory until the related goods are sold.

Once the goods are sold, the cost will be transferred to the cost of goods sold (COGS) in the income statement.

A. It should be reported as an administrative expense on the income statement. (Incorrect)

Indirect labor related to manufacturing is classified as part of manufacturing overhead, not an administrative expense.

B. It should be reported as a period cost other than a product cost on the management accounts. (Incorrect)

Indirect labor in production is a product cost (i.e., a cost that is included in inventory and matched with revenues when the product is sold).

Period costs refer to expenses like selling and administrative costs, which are expensed immediately.

C. It should be reported as cost of goods sold on the income statement. (Incorrect)

Since the cost was incurred on the last day of the year, the related products have likely not yet been sold, meaning the cost remains in inventory.

D. It should be reported on the balance sheet as part of inventory. (Correct)

Manufacturing overhead, including indirect labor, is included in inventory (work-in-process or finished goods) on the balance sheet until the goods are sold.

IIA Practice Guide: Auditing Inventory Management emphasizes that manufacturing costs, including indirect labor, should be allocated properly to inventory.

IIA Standard 2330 – Documenting Information requires auditors to ensure proper financial reporting of costs in accordance with GAAP/IFRS inventory valuation principles.

IFRS (IAS 2 – Inventories) and GAAP (ASC 330 – Inventory) state that indirect production costs must be capitalized as inventory until sold.

Explanation of Answer Choices:IIA References:Thus, the correct answer is D. It should be reported on the balance sheet as part of inventory.

Project governance refers to a broad collection of integrated policies, standards, and procedures that provide a framework for planning and executing projects. It establishes decision-making processes, accountability, and risk management controls to ensure that projects align with organizational objectives.

(A) Project portfolio. ❌

Incorrect. A project portfolio refers to a collection of projects managed together to achieve strategic objectives. It does not specifically define the policies, standards, and procedures for project execution.

(B) Project development. ❌

Incorrect. Project development focuses on designing, building, and testing a project, but it does not encompass governance structures like policies, standards, and oversight.

(C) Project governance. ✅

Correct. Project governance includes integrated policies, standards, and procedures that guide project planning, execution, and oversight.

IIA GTAG " Auditing IT Projects " emphasizes project governance as the primary control framework for managing project risks and ensuring alignment with organizational goals.

(D) Project management methodologies. ❌

Incorrect. Project management methodologies (e.g., Agile, Waterfall, PRINCE2) provide structured approaches for executing projects but do not encompass the full governance framework.

IIA GTAG – " Auditing IT Projects "

IIA Standard 2110 – Governance (Project Risk Management)

COSO ERM Framework – Project Oversight and Risk Governance

Analysis of Answer Choices:IIA References:Thus, the correct answer is C (Project governance), as it provides the integrated policies, standards, and procedures needed for effective project oversight.

When management agrees to address audit issues, the CAE must ensure that the final report documents management’s agreement and corrective action plan, including implementation timelines. This ensures accountability and enables proper follow-up monitoring.

Option B (follow-up engagement) may happen later, but the first step is proper documentation. Option C is unnecessary since management already agreed to corrective action. Option D is inappropriate because it is management’s responsibility to develop and own the action plan, not internal audit’s.

Comprehensive and Detailed In-Depth Explanation:

Big data is commonly characterized by the " Three Vs " :

Volume: The vast amount of data generated and collected.

Velocity: The speed at which new data is generated and the pace at which data moves.

Variety: The diverse types and sources of data, including structured, semi-structured, and unstructured formats.

These characteristics highlight the challenges and considerations in managing and analyzing big data. Options A, C, and D list attributes that, while relevant in certain contexts, do not encapsulate the core defining features of big data as effectively as option B.

Comprehensive and Detailed In-Depth Explanation:

A matrix organization combines functional and product-based structures, allowing employees to work across multiple departments and report to multiple managers. This enables businesses to utilize expertise from various areas efficiently.

Option A (Unity of command) does not apply to matrix organizations, as employees often report to multiple supervisors.

Option C (Variable authority and accountability) is a secondary characteristic but does not define matrix structures.

Option D (Best for scattered locations/multi-line firms) applies more to divisional rather than matrix structures.

Thus, the correct answer is B, as matrix structures enable collaboration across functional and product teams.

Enterprise Resource Planning (ERP) systems integrate various business processes into a unified system, offering numerous benefits. Here ' s an analysis of the provided options:

A. Real-time Processing of Transactions and Elimination of Data Redundancies:

ERP systems centralize data and standardize processes across an organization. This centralization enables real-time processing of transactions, allowing immediate updates and access to data. By maintaining a single database for all business functions, ERPs eliminate data redundancies, ensuring consistency and accuracy across departments. This integration enhances decision-making and operational efficiency. According to Investopedia, ERP systems facilitate the free flow of communication between business areas, providing a single source of information and accurate, real-time data reporting.

Investopedia

B. Fewer Data Processing Errors and More Efficient Data Exchange with Trading Partners:

While ERP systems can reduce data processing errors through automation and standardized processes, efficient data exchange with trading partners often requires additional tools or modules, such as Electronic Data Interchange (EDI) systems. Therefore, this benefit is not solely attributable to ERP systems.

C. Exploitation of Opportunities and Mitigation of Risks Associated with E-Business:

ERP systems provide a robust infrastructure that can support e-business initiatives. However, effectively exploiting opportunities and mitigating risks in e-business also depend on strategic planning, market analysis, and additional technologies beyond the ERP system itself.

D. Integration of Business Processes into Multiple Operating Environments and Databases:

ERP systems aim to integrate business processes into a single operating environment with a unified database. Integrating into multiple operating environments and databases would contradict the primary purpose of an ERP, which is to provide a centralized platform.

In summary, the most significant benefit of an ERP system among the options provided is the real-time processing of transactions and the elimination of data redundancies, making option A the correct answer.