Free IIA IIA-CIA-Part3 Practice Exam with Questions & Answers | Set: 13

A privacy and data protection risk assessment should begin by identifying what private or personal data the organization collects and maintains. The auditor must first understand the data inventory before evaluating legal obligations, processing purposes, access controls, retention, sharing, breach response, or pseudonymization. Potential fines are important, but they cannot be assessed properly without knowing what data exists and which regulations apply. Cybersecurity investigation procedures are relevant later, especially for incident response. Pseudonymization is a specific privacy control, not the starting point. Internal audit should first determine data types, data subjects, locations, systems, owners, sensitivity, third-party transfers, and processing purposes. Therefore, Option C is correct.

Efficiency indicators measure how well resources are used to produce outputs. The number of audits completed reflects efficiency because it shows how effectively the internal audit function utilizes available resources to deliver its plan.

Option B (observations) reflects risk exposure, not efficiency. Option C measures effectiveness (impact of audit work), not efficiency. Option D reflects investment in staff development, not operational efficiency.

Comprehensive and Detailed In-Depth Explanation:

Data analytics in internal auditing provides quantitative, evidence-based insights, enhancing audit conclusions and decision-making.

Option B (Reduces report preparation time) – While efficiency is a benefit, the main advantage is improved accuracy and factual support.

Option C (Prevents overlooking risks) – While true, data analytics primarily strengthens evidence collection.

Option D (Monitoring controls) – Auditors assess controls, but data analytics enhances findings through data-driven validation.

Thus, Option A is correct, as data analytics strengthens audit conclusions with factual evidence.

Among the options, monitored closed circuit television is most likely to support corrective action because security personnel can observe an incident and respond to it. Although CCTV is often classified as a detective control, when actively monitored it can trigger real-time intervention, dispatch of guards, incident response, or corrective follow-up. Doors that lock automatically, biometric locks, and identification badges are primarily preventive controls because they restrict access before unauthorized entry occurs. Internal auditors should distinguish between preventive, detective, and corrective control characteristics, recognizing that some controls may support more than one function depending on how they are used. Since monitored CCTV can support response to physical security incidents, Option A is the best answer.

The chief risk officer typically coordinates enterprise risk management by establishing risk language, supporting risk categories, defining ERM roles, facilitating risk reporting, and integrating ERM into management activities. However, providing the board with an independent, objective risk perspective on financial reporting is more closely aligned with internal audit or external audit assurance responsibilities, not the CRO’s typical management role. The CRO is part of management and may provide risk reporting, but independence and objectivity in assurance over financial reporting are not typical CRO responsibilities. Internal audit should preserve independence by evaluating risk management processes without owning them. Therefore, Option C is not a typical chief risk officer responsibility.

Comprehensive and Detailed In-Depth Explanation:

Transfer pricing refers to the pricing of goods, services, and intangibles transferred between related entities. In international transactions, companies often adjust transfer prices to minimize tax liabilities and import tariffs.

Decreasing the transfer price (Option A) results in a lower declared customs value, reducing import tariffs paid to the foreign country.

Increasing the transfer price (Option B) would raise import tariffs, making it less favorable.

Charging the arm’s length price (Option C) ensures compliance with tax regulations but does not necessarily reduce import tariffs.

Optimal transfer pricing (Option D) is a general term that does not specifically focus on reducing tariffs.

Thus, decreasing the transfer price is the best approach.

Just-in-time inventory systems aim to minimize inventory levels by receiving materials close to the time they are needed in production or sale. Because inventory buffers are reduced, the organization has less room to absorb defects, delivery failures, or poor-quality inputs. Therefore, JIT systems rely heavily on high-quality materials, dependable suppliers, accurate demand information, and strong production scheduling. Option A is incorrect because JIT seeks to reduce safety stock, not depend on users determining large safety stock levels. Option B is wrong because JIT principles can be used by organizations of different sizes if supplier reliability and process discipline exist. Option C is overly negative and inaccurate; while JIT may affect supply chain inventory distribution, it can improve efficiency when properly managed. Therefore, Option D is correct.

The most effective way to prevent the unauthorized disclosure of confidential information is to limit access based on employee roles and duties. This follows the principle of least privilege (PoLP), ensuring that employees only access the data necessary for their job functions.

(A) Nondisclosure agreements between the firm and its employees. ❌

Incorrect. While NDAs help deter leaks, they do not prevent unauthorized access to information. An employee who signs an NDA can still access and leak data.

(B) Logs of user activity within the information system. ❌

Incorrect. Activity logs help detect and investigate breaches but do not actively prevent unauthorized disclosure.

(C) Two-factor authentication for access into the information system. ❌

Incorrect. While two-factor authentication enhances system security, it does not prevent employees with authorized access from leaking confidential data.

(D) Limited access to information, based on employee duties. ✅

Correct. Role-based access control (RBAC) ensures that employees only access the information necessary for their job responsibilities, reducing the risk of leaks.

IIA GTAG " Identity and Access Management " highlights restricted access as the most effective control for preventing unauthorized disclosure of confidential data.

IIA GTAG – " Identity and Access Management "

IIA Standard 2120 – Risk Management (Data Protection Controls)

COBIT Framework – Information Security and Access Control

Analysis of Answer Choices:IIA References:Thus, the correct answer is D (Limited access to information, based on employee duties), as restricting access is the most effective preventive control against data disclosure.

Debt investments refer to financial instruments where an investor lends money to an entity (corporation, government, or institution) in exchange for periodic interest payments and the repayment of the principal amount at maturity. These include:

Government bonds (such as U.S. Treasury bonds, municipal bonds, and sovereign bonds)

Corporate bonds

Certificates of deposit (CDs)

Commercial paper

A. Investments in the capital stock of a corporation → Incorrect. Capital stock represents ownership (equity investments), not debt investments.

C. Contents of an investment portfolio → Incorrect. A portfolio may contain both equity and debt investments, making this too broad to classify specifically as debt.

D. Acquisition of common stock of a corporation → Incorrect. Common stock is an equity investment, not a debt investment.

The IIA’s Global Internal Audit Standards on Investment Management and Risk Assessment highlight debt instruments as fixed-income securities.

International Financial Reporting Standards (IFRS 9 – Financial Instruments) classify bonds and loans as debt investments, distinct from equity instruments.

The Generally Accepted Accounting Principles (GAAP) – FASB ASC 320 specifies how to account for debt securities.

Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Acquisition of government bonds.

Comprehensive and Detailed In-Depth Explanation:

The discounted payback period is a capital budgeting technique that determines how long it takes for a project to recover its initial investment, accounting for the time value of money.

Option A (Calculates the overall project value) describes Net Present Value (NPV), not the payback period.

Option B (Ignores the time value of money) applies to the simple payback period, but the discounted payback period does account for the time value of money.

Option D (Begins at time zero) is true for all capital budgeting methods, not specific to this one.

Thus, option C is correct because the discounted payback period measures the break-even time while considering the present value of cash flows.

Understanding Project Cost Overruns and Controls

Cost overruns occur when actual project costs exceed the budgeted or planned costs. Effective controls are required to prevent, detect, and correct deviations from the cost baseline.

The most effective way to control cost overruns is through continuous monitoring and comparison of project costs against the approved cost baseline.

Why Option D is Correct?

A formal process to monitor the project status and compare it to the cost baseline ensures that deviations are identified early and corrective actions are taken.

This aligns with the IIA ' s International Standards for the Professional Practice of Internal Auditing (IPPF), specifically:

Standard 2120 – Risk Management: Internal auditors must evaluate how organizations manage risks, including financial risks related to project cost overruns.

Standard 2500 – Monitoring Progress: Ensures that corrective actions are implemented when issues arise.

IIA Practice Advisory 2130-1: Stresses the importance of monitoring activities to mitigate financial risks.

The Project Management Body of Knowledge (PMBOK) also supports cost monitoring as a key control to prevent overruns.

Why Other Options Are Incorrect?

Option A: Reviewing and approving scope change requests is important, but it does not directly monitor or control cost overruns. Scope creep is a risk, but cost monitoring is a more direct control.

Option B: Having a control committee review overruns after they occur is a reactive measure. Proactive monitoring (option D) is more effective.

Option C: A quality assurance process for scope changes is valuable but does not directly prevent cost overruns. It focuses on project quality rather than financial control.

Effective internal controls for cost management emphasize real-time monitoring and comparison against the cost baseline to prevent and mitigate cost overruns.

IIA Standards 2120, 2500, and 2130-1 support proactive risk management and monitoring as essential best practices for internal auditors.

Final Justification:IIA References:

IPPF Standard 2120 – Risk Management

IPPF Standard 2500 – Monitoring Progress

IIA Practice Advisory 2130-1 – Internal Control and Risk Management

PMBOK – Cost Monitoring and Control

c

Understanding Predictive Analytics:

Predictive analytics involves using historical data, statistical algorithms, and machine learning techniques to forecast future trends and behaviors.

It applies assumptions and models patterns to predict outcomes, helping businesses make proactive decisions.

Why Option B is Correct:

Predictive analytics is forward-looking and uses assumptions (e.g., weather conditions) to predict where stock levels would decrease more quickly.

This aligns with the goal of predictive analytics: forecasting potential events before they occur.

Why Other Options Are Incorrect:

A. Analyzed instances where parts were out of stock before scheduled deliveries: This is descriptive analytics, as it looks at past data without making future predictions.

C. Analyzed past stockouts and found a correlation with stormy weather: This is diagnostic analytics, as it identifies past correlations but does not predict future trends.

D. Modeled different scenarios for stock reordering and delivery decisions: This is prescriptive analytics, which focuses on decision-making rather than predictions.

IIA Standards and References:

IIA GTAG on Data Analytics (2017): Highlights predictive analytics as a tool for forecasting risks and operational inefficiencies.

IIA Standard 1220 – Due Professional Care: Encourages auditors to use analytical techniques to anticipate potential issues.

COSO ERM Framework: Supports the use of predictive models to improve risk management and strategic planning.

Thus, the correct answer is B: A supplier of electrical parts analyzed sales, applied assumptions related to weather conditions, and identified locations where stock levels would decrease more quickly.

Remote wipe is a security feature used in mobile device management (MDM) that allows an organization to erase data from a device remotely. This is critical in cases where a device is lost, stolen, or compromised, ensuring that sensitive corporate data is protected.

(A) It can restore default settings and lock encrypted data when necessary.

Partially correct but not the best answer. Remote wipe does erase data but does not necessarily lock encrypted data unless additional security features are enabled.

(B) It enables the erasure and reformatting of secure digital (SD) cards.

Incorrect. Many remote wipe solutions do not erase external SD cards due to hardware limitations. Users often need separate encryption for SD card data.

(C) It can delete data backed up to a desktop for complete protection if required.

Incorrect. Remote wipe only affects the device itself; it cannot erase backups stored on a desktop or local drives.

(D) It can wipe data that is backed up via cloud computing. ✅

Correct. Many MDM solutions offer the ability to remove access to corporate cloud data, revoke credentials, and remotely erase cloud-stored business files (such as OneDrive, Google Drive, or iCloud backups).

IIA GTAG " Auditing Cybersecurity Risk " emphasizes the importance of managing remote access and cloud-based data protection.

IIA GTAG – " Auditing Cybersecurity Risk "

IIA Practice Guide – " Assessing Mobile Device Security "

IIA Standard 2110 – Governance (IT security controls)

Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as modern remote wipe features allow organizations to remove data from cloud backups, reducing data leakage risks.

 Understanding the Attributes of Data Analytics (The Four Vs of Big Data):

Volume: Refers to the massive amount of data generated.

Velocity: Refers to the speed at which data is created and processed.

Variety: Refers to the different types and sources of data.

Veracity: Refers to data accuracy and reliability.

 Why Variety is the Correct Answer:

Variety represents the increasing number of data sources (e.g., social media, IoT devices, cloud storage, structured/unstructured data, etc.).

As data sources grow, internal auditors must evaluate data integrity, consistency, and reliability across multiple formats and systems.

 Why Other Options Are Incorrect:

A. Volume: Refers to the size of data, not the number of sources.

B. Velocity: Refers to how fast data is generated and processed, not its diversity.

D. Veracity: Refers to data accuracy, not the number of sources.

 IIA Standards and References:

IIA GTAG on Data Analytics (2017): Highlights the role of variety in managing data from multiple sources.

IIA Standard 1220 – Due Professional Care: Auditors must assess data variety when using analytics for decision-making.

COSO ERM Framework: Addresses the importance of integrating diverse data sources for risk management.

Comprehensive and Detailed In-Depth Explanation:

Big data is commonly characterized by the " Three Vs " :

Volume: The vast amount of data generated and collected.

Velocity: The speed at which new data is generated and the pace at which data moves.

Variety: The diverse types and sources of data, including structured, semi-structured, and unstructured formats.

These characteristics highlight the challenges and considerations in managing and analyzing big data. Options A, C, and D list attributes that, while relevant in certain contexts, do not encapsulate the core defining features of big data as effectively as option B.