Free IIA IIA-CIA-Part3 Practice Exam with Questions & Answers | Set: 10

In accounting, the terms debit (Dr.) and credit (Cr.) refer to the two sides of an account in the double-entry accounting system.

Definition of Debit and Credit in Accounting:

Every financial transaction affects at least two accounts in a double-entry system: one account is debited, and another is credited.

Debits (Dr.) appear on the left side, while credits (Cr.) appear on the right side of an account.

Accounting Equation:

Step-by-Step Justification:Assets=Liabilities+Equity\text{Assets} = \text{Liabilities} + \text{Equity}Assets=Liabilities+Equity

Debits increase assets and expenses.

Credits increase liabilities, equity, and revenues.

Why the Other Options Are Incorrect:

A. Debit indicates the right side of an account and credit the left side ❌

Incorrect, as debits are always recorded on the left side, and credits are always on the right side.

B. Debit means an increase in an account and credit means a decrease. ❌

Partially incorrect; it depends on the type of account:

For assets and expenses, debits increase and credits decrease.

For liabilities, equity, and revenues, credits increase and debits decrease.

D. Credit means an increase in an account and debit means a decrease. ❌

Also incorrect because increases and decreases depend on the type of account (e.g., debits increase assets but decrease liabilities).

IIA Standard 1210.A1: Internal auditors must be familiar with fundamental accounting principles.

IIA Practice Guide: Auditing Financial Statements: Ensures proper understanding of debits and credits in financial reporting.

GAAP & IFRS Accounting Standards: Define how debits and credits are recorded in financial statements.

IIA References:Thus, the correct answer is C. Credit indicates the right side of an account and debit the left side. ✅

Understanding a Man-in-the-Middle (MITM) Attack:

A Man-in-the-Middle (MITM) attack occurs when a cybercriminal intercepts, alters, or steals data while it is being transmitted between two parties.

The attacker can modify messages, inject malicious content, or eavesdrop on sensitive communications without the knowledge of the sender or receiver.

How MITM Attacks Work:

Attackers position themselves between two communicating parties (e.g., a user and a banking website) and intercept the data exchange.

This allows them to steal login credentials, financial information, or confidential communications.

Common MITM attack methods include:

Wi-Fi eavesdropping (public network interception).

Session hijacking (stealing active user sessions).

HTTPS spoofing (tricking users into thinking they are on a secure website).

Why Other Options Are Incorrect:

A. The perpetrator is able to delete data on the network without physical access to the device – Incorrect.

This describes a remote cyberattack, such as malware or ransomware, rather than MITM, which focuses on data interception.

B. The perpetrator is able to exploit network activities for unapproved purposes – Incorrect.

This is too broad and could refer to insider threats, malware, or privilege escalation attacks, rather than specifically MITM.

D. The perpetrator is able to disable default security controls and introduce additional vulnerabilities – Incorrect.

This describes a system exploitation attack, such as a rootkit or backdoor installation, not an MITM attack.

IIA’s Perspective on Cybersecurity and IT Risk Management:

IIA Standard 2110 – Governance requires organizations to implement cybersecurity controls to mitigate risks like MITM attacks.

IIA GTAG (Global Technology Audit Guide) on Cybersecurity Risks advises organizations to use encryption (e.g., TLS, VPNs) to protect data in transit.

NIST Cybersecurity Framework recommends multi-factor authentication (MFA) and secure protocols to prevent MITM attacks.

IIA References:

IIA Standard 2110 – IT Security and Cyber Risk Governance

IIA GTAG – Cybersecurity Controls and Threat Mitigation

NIST Cybersecurity Framework – Secure Data Transmission

Thus, the correct and verified answer is C. The perpetrator is able to take over control of data communication in transit and replace traffic.

Comprehensive and Detailed Step-by-Step Explanation with all IIA References:

Understanding the Concern:

Internal auditors must assess risks when using free software for data analysis, particularly regarding data security, confidentiality, and integrity.

When analyzing third-party vendor data, the primary risk is data compromise, unauthorized access, or data loss due to inadequate security controls in free software.

Why Data Security is the Biggest Concern:

Free software often lacks robust security measures, making sensitive vendor data susceptible to breaches, cyberattacks, or loss.

Ensuring compliance with data protection regulations (e.g., GDPR, CCPA) and contractual obligations with third-party vendors is critical.

Why Other Options Are Incorrect:

A. The ability to use the software with ease → While usability is important, security risks outweigh ease of use in an internal audit context.

B. The ability to purchase upgraded features → Upgrades may improve analysis capabilities but do not address security concerns.

D. The ability to download the software → Installing software is a technical issue, not a major audit concern compared to security.

IIA Standards and References:

IIA Standard 2110 – Governance: Internal auditors should ensure data security risks are addressed in technology use.

IIA Standard 2120 – Risk Management: Auditors must evaluate the organization’s ability to safeguard data.

IIA GTAG (Global Technology Audit Guide) on Data Analytics (2017): Recommends ensuring security of third-party data when using analytical tools.

Thus, the correct answer is C: The ability to ensure that big data entered into the software is secure from potential compromises or loss.

Managerial accounting differs from financial accounting in that it focuses on internal decision-making, cost control, and performance evaluation based on predetermined standards. Unlike financial accounting, which follows GAAP (Generally Accepted Accounting Principles) for external reporting, managerial accounting sets internal benchmarks to guide operational efficiency and strategic planning.

Use of Predetermined Standards:

Managerial accounting often uses standard costing, budgets, and variance analysis to compare actual performance against pre-set benchmarks.

This helps management make data-driven decisions and improve efficiency.

Internal Decision-Making:

Managerial accounting reports are used by internal stakeholders (e.g., managers, executives) rather than external entities.

Control and Performance Measurement:

It focuses on variance analysis (actual vs. expected performance) to highlight areas requiring corrective action.

Not Governed by GAAP:

Unlike financial accounting, managerial accounting does not require compliance with GAAP or IFRS since it is meant for internal use only.

A. Managerial accounting uses double-entry accounting and cost data:

While cost data is relevant to managerial accounting, double-entry accounting is a fundamental principle of all accounting systems, including financial accounting.

B. Managerial accounting uses generally accepted accounting principles (GAAP):

GAAP is required for financial accounting (external reporting), but managerial accounting does not follow GAAP since it focuses on internal decision-making.

C. Managerial accounting involves decision making based on quantifiable economic events:

While managerial accounting analyzes economic data, its distinguishing feature is using predetermined standards to evaluate and improve performance, which makes Option D the best choice.

IIA Standard 2110 - Governance: Internal auditors should assess decision-making processes, including managerial accounting techniques.

IIA Standard 2120 - Risk Management: Cost control and budget variance analysis are key components of risk management.

COSO Framework - Performance Monitoring: Emphasizes variance analysis, which aligns with predetermined standards in managerial accounting.

Key Reasons Why Option D is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is D. Managerial accounting involves decision making based on predetermined standards.

Logging at the database and application levels is a critical security control that enables monitoring, detecting, and investigating potential security incidents. The absence of logging significantly increases cybersecurity risks and can leave an organization vulnerable to undetected attacks.

Incident Response & Forensics: Without logs, the organization will be unable to determine the cause, origin, and impact of cyber incidents or system intrusions.

Compliance Requirements: Many regulatory frameworks (e.g., ISO 27001, NIST 800-53, GDPR, PCI-DSS, SOX) require logging for security monitoring and auditability.

Threat Detection: Logs help in identifying malicious activities, unauthorized access, and data breaches.

Accountability: Ensures that actions taken within the system can be traced back to specific users or administrators.

Option A (The organization will be unable to develop preventative actions based on analytics): While logging helps in analytics, its primary function is incident detection and forensic investigation.

Option B (The organization will not be able to trace and monitor the activities of database administrators): This is partially correct, but logging is not just for administrators—it is essential for monitoring all system activities, including unauthorized access attempts.

Option D (The organization will be unable to upgrade the system to newer versions): Logging does not impact system upgrades; upgrades are related to software lifecycle management, not logging practices.

IIA’s Global Technology Audit Guide (GTAG) – Information Security Controls recommends logging as a fundamental security control.

IIA Standard 2110 – IT Governance: Emphasizes the need for adequate IT risk management, including logging.

COSO Framework (Monitoring Component): Highlights the importance of system monitoring, which includes logging.

Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is C. The organization will be unable to determine why intrusions and cyber incidents took place.

A lump-sum contract (also known as a fixed-price contract) is a contract type where the vendor agrees to complete a project for a predetermined price. In this scenario, the organization agreed to pay the vendor $3,000,000 to design, procure, and construct a power substation.

Lump-Sum Contract (Correct Answer: B)

A lump-sum contract (also called a fixed-price contract) is an agreement where the contractor is responsible for completing the entire project at a set price.

This type of contract transfers cost risk to the contractor since they must manage expenses within the agreed budget.

IIA Standard 2120 – Risk Management states that internal auditors should assess contract risks, including financial and performance risks in vendor contracts.

The contract price is predefined, which aligns with the scenario given in the question.

Why the Other Options Are Incorrect:

A. Cost-Reimbursable Contract (Incorrect)

A cost-reimbursable contract involves reimbursing the vendor for actual costs incurred, plus a fee or profit.

This is not applicable because the contract specifies a fixed price.

C. Time and Material Contract (Incorrect)

This contract type is based on actual time spent and materials used, typically used when scope is uncertain.

The given scenario clearly defines the project and budget, making this option unsuitable.

D. Bilateral Contract (Incorrect)

A bilateral contract refers to a mutual agreement between two parties where both have obligations.

While most contracts are bilateral in nature, this is not a specific contract type like lump-sum or cost-reimbursable contracts.

IIA Standard 2120 – Risk Management (Evaluating contract risks)

IIA Standard 2210 – Engagement Objectives (Assessing vendor contracts)

IIA Standard 2130 – Compliance (Ensuring contract compliance)

Step-by-Step Justification:IIA References for This Answer:Thus, the correct answer is B. A lump-sum contract because the contract is based on a predefined, fixed price of $3,000,000.

A Cold Site is a remote disaster recovery facility that provides physical space and basic utilities such as electricity, internet, and telecommunications but does not include pre-installed servers, networking equipment, or other IT infrastructure. It requires a longer recovery time since the organization must procure, install, and configure necessary hardware and software before resuming operations.

A. Frozen Site – This is not a recognized term in IT disaster recovery planning.

C. Warm Site – A warm site has some pre-installed hardware and infrastructure but requires additional setup before full operation.

D. Hot Site – A hot site is a fully functional duplicate of the original site, with real-time data replication, allowing for immediate recovery.

The IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management emphasizes that organizations should classify recovery sites based on risk tolerance and recovery time objectives (RTO).

The IIA’s International Professional Practices Framework (IPPF) – Practice Advisory 2110-2 discusses IT continuity and disaster recovery as a critical element of internal audit assessments.

NIST Special Publication 800-34 (Contingency Planning Guide for Information Technology Systems) defines and categorizes disaster recovery sites, aligning with the cold site definition.

Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Cold Site.

Understanding Net Income Overstatement:

Net Income (NI) = Revenue - Expenses

If net income is overstated, then expenses must be understated or revenue must be overstated.

Cost of Goods Sold (COGS) is an expense that directly affects net income.

Why Understated COGS Causes Overstated Net Income:

COGS = Beginning Inventory + Purchases - Ending Inventory

If COGS is understated, expenses are lower than they should be, resulting in a higher net income.

Why Other Options Are Incorrect:

A. Beginning inventory overstated: This would increase COGS (not decrease it), leading to a lower net income.

C. Ending inventory understated: This would increase COGS, reducing net income.

D. COGS overstated: This would result in a lower net income, not an overstatement.

IIA Standards and References:

IIA Standard 2120 – Risk Management: Internal auditors must assess financial misstatements and risks.

IIA Practice Guide: Auditing Financial Statement Close Processes (2018): Emphasizes accuracy in inventory and expense reporting.

COSO Internal Control – Integrated Framework: Supports accuracy in financial reporting and controls over misstated financial data.

Thus, the correct answer is B: Cost of goods sold was understated for the year.

Indirect labor costs incurred in the production process are treated as part of manufacturing overhead. Since the cost was incurred on the last day of the year, it is likely that the related products are still in inventory rather than being sold.

Under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS), indirect labor costs associated with manufacturing should be included in the cost of inventory until the related goods are sold.

Once the goods are sold, the cost will be transferred to the cost of goods sold (COGS) in the income statement.

A. It should be reported as an administrative expense on the income statement. (Incorrect)

Indirect labor related to manufacturing is classified as part of manufacturing overhead, not an administrative expense.

B. It should be reported as a period cost other than a product cost on the management accounts. (Incorrect)

Indirect labor in production is a product cost (i.e., a cost that is included in inventory and matched with revenues when the product is sold).

Period costs refer to expenses like selling and administrative costs, which are expensed immediately.

C. It should be reported as cost of goods sold on the income statement. (Incorrect)

Since the cost was incurred on the last day of the year, the related products have likely not yet been sold, meaning the cost remains in inventory.

D. It should be reported on the balance sheet as part of inventory. (Correct)

Manufacturing overhead, including indirect labor, is included in inventory (work-in-process or finished goods) on the balance sheet until the goods are sold.

IIA Practice Guide: Auditing Inventory Management emphasizes that manufacturing costs, including indirect labor, should be allocated properly to inventory.

IIA Standard 2330 – Documenting Information requires auditors to ensure proper financial reporting of costs in accordance with GAAP/IFRS inventory valuation principles.

IFRS (IAS 2 – Inventories) and GAAP (ASC 330 – Inventory) state that indirect production costs must be capitalized as inventory until sold.

Explanation of Answer Choices:IIA References:Thus, the correct answer is D. It should be reported on the balance sheet as part of inventory.

Penetration testing is a security practice used to identify vulnerabilities in an organization's information systems by simulating cyberattacks. It is an essential component of IT risk management and internal auditing under The Institute of Internal Auditors (IIA) standards, particularly in the context of IT governance, cybersecurity risk management, and control assurance.

Focus on Preventive Controls:

Penetration testing evaluates how well preventive controls (e.g., firewalls, encryption, authentication mechanisms) work against potential cyberattacks.

According to the IIA Global Technology Audit Guide (GTAG) 11: Developing an IT Audit Plan, testing should emphasize preventive security measures to minimize risks.

Management’s Response Assessment:

The effectiveness of an organization's incident response plan is also evaluated.

Management's reaction to simulated cyber threats ensures that detection and response mechanisms are functional and aligned with IIA Standard 2120 – Risk Management and IIA GTAG 1: Information Security Governance.

A. Testing should not be announced to anyone within the organization to solicit a real-life response. (Incorrect)

Reason: While unannounced tests (e.g., red team exercises) can provide real-world insights, penetration testing should be coordinated with IT and security personnel.

IIA GTAG 11 emphasizes structured and ethical testing approaches, ensuring that necessary stakeholders are informed to prevent operational disruptions.

B. Testing should take place during heavy operational time periods to test system resilience. (Incorrect)

Reason: While resilience testing is important, penetration testing is typically performed in controlled conditions to avoid disrupting business operations.

IIA Standard 2130 – Control supports minimizing business risks during testing.

C. Testing should be wide in scope and primarily address detective management controls for identifying potential attacks. (Incorrect)

Reason: While detection controls (e.g., intrusion detection systems) are important, penetration testing focuses primarily on preventive controls.

IIA GTAG 1 and IIA GTAG 11 stress proactive security strategies over purely detective measures.

IIA Global Technology Audit Guide (GTAG) 11: Developing an IT Audit Plan – Covers IT security testing, including penetration testing.

IIA GTAG 1: Information Security Governance – Emphasizes the role of security assessments.

IIA Standard 2120 – Risk Management – Highlights the importance of testing preventive security measures.

IIA Standard 2130 – Control – Discusses ensuring operational effectiveness during testing.

Explanation of the Correct Answer (D):Analysis of Incorrect Answers:IIA References:Thus, D is the most accurate choice as per IIA guidance.

Debt investments refer to financial instruments where an investor lends money to an entity (corporation, government, or institution) in exchange for periodic interest payments and the repayment of the principal amount at maturity. These include:

Government bonds (such as U.S. Treasury bonds, municipal bonds, and sovereign bonds)

Corporate bonds

Certificates of deposit (CDs)

Commercial paper

A. Investments in the capital stock of a corporation → Incorrect. Capital stock represents ownership (equity investments), not debt investments.

C. Contents of an investment portfolio → Incorrect. A portfolio may contain both equity and debt investments, making this too broad to classify specifically as debt.

D. Acquisition of common stock of a corporation → Incorrect. Common stock is an equity investment, not a debt investment.

The IIA’s Global Internal Audit Standards on Investment Management and Risk Assessment highlight debt instruments as fixed-income securities.

International Financial Reporting Standards (IFRS 9 – Financial Instruments) classify bonds and loans as debt investments, distinct from equity instruments.

The Generally Accepted Accounting Principles (GAAP) – FASB ASC 320 specifies how to account for debt securities.

Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Acquisition of government bonds.

Information access management is the component of an organization’s cybersecurity risk assessment framework that allows management to implement user controls based on a user’s role. This principle, often referred to as Role-Based Access Control (RBAC), ensures that individuals have access only to the data and systems necessary for their job responsibilities.

Definition of Role-Based Access Control (RBAC):

RBAC assigns permissions based on an individual's role within the organization.

For example, a finance employee may access financial records, but not HR data.

Minimization of Insider Threats:

By limiting access to sensitive data, information access management helps reduce the risk of fraud, data breaches, and unauthorized modifications.

Regulatory Compliance:

Many regulations (e.g., GDPR, SOX, HIPAA) require companies to implement access control measures to protect sensitive information.

Internal auditors assess whether access management policies are enforced properly.

Alignment with Cybersecurity Risk Frameworks:

NIST Cybersecurity Framework – Access Control (AC) Family: Establishes guidelines for restricting access based on user identity and role.

ISO/IEC 27001 – Information Security Management System (ISMS): Requires organizations to implement access control policies to protect data integrity.

A. Prompt response and remediation policy: Focuses on incident response rather than proactive access control.

B. Inventory of information assets: Important for tracking IT assets but does not define access privileges.

D. Standard security configurations: Enforce security settings but do not manage access based on user roles.

IIA GTAG (Global Technology Audit Guide) on Information Security: Recommends implementing access control policies to restrict unauthorized access.

IIA Standard 2110 – Governance: Emphasizes the importance of cybersecurity governance, including role-based access management.

COBIT Framework – DSS05.04 (Manage User Identity and Access): Defines best practices for controlling user access based on organizational roles.

Step-by-Step Justification:Why Not the Other Options?IIA References:

To ensure security when employees use their own smart devices to access organizational applications, the best approach is to allow only pre-approved devices that meet the organization’s security standards.

Device Security & Compliance: Approved devices are verified for security measures like encryption, mobile device management (MDM), and antivirus protection.

Risk Management: Restricting access to pre-approved devices reduces the risk of malware, unauthorized access, and vulnerabilities.

IT Control & Monitoring: IT can enforce security updates, compliance policies, and access control mechanisms on pre-approved devices.

Option A (Using a jailbroken or rooted smart device feature): Jailbroken or rooted devices remove security protections and create severe security vulnerabilities.

Option C (Obtaining written assurance from the employee that security policies and procedures are followed): Written assurances alone are not a security measure; technical controls must be enforced.

Option D (Introducing a security question known only by the employee): Security questions are weak authentication measures and do not verify the legitimacy of a device.

IIA's GTAG on Information Security Management stresses the importance of device security and requiring IT-approved devices.

NIST Special Publication 800-124 (referenced in IIA’s IT Audit Guidance) highlights best practices for securing mobile devices in an enterprise setting, recommending pre-approved devices.

Why Option B is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is B. Using only smart devices previously approved by the organization.

A periodic inventory system calculates cost of goods sold (COGS) using the formula:

COGS=Beginning Inventory+Purchases−Ending InventoryCOGS = \text{Beginning Inventory} + \text{Purchases} - \text{Ending Inventory}COGS=Beginning Inventory+Purchases−Ending Inventory

If beginning inventory is understated, it causes COGS to be understated, which in turn overstates net income because expenses are lower than they should be.

Understated Beginning Inventory → Understated COGS

Since COGS is too low, fewer expenses are deducted from revenue.

Understated COGS → Overstated Net Income

If COGS is too low, the company's profit (net income) is artificially inflated.

(A) COGS will be understated and net income will be overstated (Correct Answer):

Since the beginning inventory was understated, COGS is lower than it should be, making net income higher than it should be.

(B) COGS will be overstated and net income will be understated:

This would be true if beginning inventory was overstated, but in this case, it was understated, making this incorrect.

(C) COGS will be understated and there will be no impact on net income:

Since COGS affects net income, this statement is incorrect. Understated COGS overstates net income.

(D) There will be no impact on COGS and net income will be overstated:

This is incorrect because COGS is directly affected by an inventory misstatement.

IIA GTAG 3: Continuous Auditing – Discusses the importance of accurate financial reporting in preventing misstatements.

COSO Internal Control Framework – Financial Reporting Component – Highlights the impact of inventory errors on financial accuracy.

IIA Standard 2330 – Documenting Information – Requires auditors to evaluate financial calculations for accuracy and completeness.

Step-by-Step Impact on Financial Statements:Analysis of Each Option:IIA References:Conclusion:Since COGS is understated and net income is overstated, option (A) is the correct answer.