Free IIA IIA-CIA-Part3 Practice Exam with Questions & Answers | Set: 5

Bonds are debt instruments through which an organization borrows money from investors. In a typical bond arrangement, the issuer pays periodic interest to bondholders and repays the principal, or face value, at maturity. Bondholders generally do not receive voting rights or corporate control; they are creditors, not owners. Debenture bonds are unsecured bonds backed by the issuer’s general creditworthiness, so Option D is incorrect. Organizations with strong credit ratings often issue debentures because investors are willing to lend without specific collateral, making Option B incorrect. Internal auditors reviewing financing should understand bond terms, interest obligations, maturity, covenants, collateral, and financial statement classification. Therefore, Option C is correct.

Integrity controls are application controls designed to monitor data being processed to ensure that it remains accurate, consistent, and valid throughout its lifecycle. These controls help detect and prevent data corruption, unauthorized modifications, and inconsistencies in transactional systems.

Integrity controls enforce data validation, consistency checks, and reconciliation procedures to prevent errors during processing.

Examples include checksum validation, referential integrity constraints, and automated reconciliations to ensure data accuracy.

The IIA’s Global Technology Audit Guide (GTAG) 8 – Auditing Application Controls highlights integrity controls as a key measure in maintaining data reliability.

A. Management trail controls → Incorrect. These refer to audit trails and logs that track changes and actions within a system but do not actively monitor or correct data integrity.

B. Output controls → Incorrect. These focus on ensuring final reports, documents, or processed data outputs are accurate but do not monitor data during processing.

D. Input controls → Incorrect. These verify the accuracy and completeness of data at the point of entry, but they do not continuously monitor data throughout processing.

IIA GTAG 8 – Auditing Application Controls recommends integrity controls to maintain data accuracy.

IIA Standard 2120 – Risk Management states that internal auditors should assess data integrity risks in business processes.

ISACA’s COBIT Framework identifies data integrity as a key IT control objective.

Why Option C is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is C. Integrity controls.

Definition of Rooting:

Rooting (on Android) or Jailbreaking (on iOS) is the process of bypassing manufacturer and administrative security controls on a smart device.

This allows users to gain full control (root access) over the operating system, which can override security restrictions and allow installation of unauthorized applications.

How Rooting Increases Data Security Risks:

Bypassing Security Measures: Rooting removes built-in security protections, making the device more vulnerable to malware, unauthorized access, and data breaches.

Exposure to Malicious Apps: Rooted devices can install third-party applications that are not vetted by official app stores, increasing the risk of data theft, spyware, and ransomware attacks.

Circumventing Enterprise Security Policies: Many organizations use Mobile Device Management (MDM) to enforce security policies, but rooted devices can bypass these controls, exposing corporate data to cyber threats.

Increased Risk of Privilege Escalation Attacks: Attackers can exploit root access to take full control of the device, leading to unauthorized access to sensitive information.

IIA’s Perspective on Cybersecurity Risks:

IIA Standard 2110 – Governance emphasizes the importance of protecting sensitive data and ensuring compliance with IT security policies.

IIA’s GTAG (Global Technology Audit Guide) on Information Security warns against the dangers of rooted or jailbroken devices, as they compromise cybersecurity defenses.

NIST Cybersecurity Framework and ISO 27001 Information Security Standards identify unauthorized modifications to devices as a critical security risk.

Eliminating Incorrect Options:

B. Eavesdropping: This refers to intercepting communications (e.g., listening in on phone calls or network traffic) but does not involve circumventing administrative restrictions.

C. Man-in-the-Middle (MITM) Attack: This is an attack where an attacker intercepts and alters communication between two parties but does not involve rooting a device.

D. Session Hijacking: This attack involves stealing session tokens to impersonate a user but is unrelated to bypassing security controls on devices.

IIA References:

IIA Standard 2110 – Governance and IT Security

IIA GTAG – Information Security Risks

NIST Cybersecurity Framework

ISO 27001 Information Security Standards

Internal audit has a mandatory assurance responsibility to assess whether IT governance supports the organization’s strategies and objectives. IT governance remains the responsibility of the board and senior management, but internal audit must evaluate and provide assurance over its effectiveness. Therefore, Statement 1 is incorrect. Statement 2 is correct because it reflects internal audit’s required role. Statement 3 is too weak because the responsibility is not merely optional. Statement 4 is also correct because internal audit may perform advisory services related to IT governance, provided independence and objectivity are protected and management retains decision-making responsibility. Internal audit should evaluate IT strategy alignment, value delivery, risk management, resource management, and performance measurement. Therefore, the accurate combination is 2 and 4, making Option C correct.

Duplicate testing is an analytical technique used to detect fraudulent payments, errors, or inefficiencies by identifying repeated transactions within financial records. In this case, an internal auditor would use duplicate testing to ensure that employees are not receiving fraudulent invoice payments by verifying that no invoice has been paid multiple times.

Detecting Duplicate Payments: Fraudulent employees may submit the same invoice multiple times with slight modifications to avoid detection. Duplicate testing helps find identical or similar transactions.

Identifying Unusual Patterns: By analyzing payment records, auditors can detect repeat payments to the same vendor, same invoice number, or similar amounts within a short time frame.

Aligns with Fraud Prevention Practices: As per IIA Standard 2120 - Risk Management, internal auditors must identify and assess fraud risks, including duplicate invoice payments.

Supports Data Analytics in Auditing: IIA GTAG (Global Technology Audit Guide) 16 - Data Analysis Techniques recommends using duplicate testing to identify fraud, control weaknesses, and errors in financial transactions.

A. Perform gap testing: Gap testing is used to identify missing data or transactions in a sequence (e.g., missing invoice numbers), but it does not specifically target duplicate or fraudulent payments.

B. Join different data sources: This method is useful for cross-checking information across multiple databases, but it is not directly related to identifying duplicate invoice payments.

D. Calculate statistical parameters: Statistical analysis provides summary insights about data (e.g., mean, median), but it does not specifically detect duplicate payments.

IIA Standard 2120 - Risk Management: Internal auditors must evaluate fraud risks, including duplicate payments.

IIA Standard 1220 - Due Professional Care: Requires auditors to apply appropriate data analytics techniques.

IIA GTAG 16 - Data Analysis Techniques: Recommends duplicate testing as an effective fraud detection method.

Key Reasons Why Option C is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is C. Perform duplicate testing.

VAT payable is calculated on value added, which in this simplified case equals sales less purchases of materials. Sales are $2,300,000 and purchases are $700,000, so value added is $1,600,000. Applying the VAT rate of 20 percent gives VAT payable of $320,000. Profit before interest and tax and corporate income tax are irrelevant to the VAT calculation because VAT is a transaction-based tax, not a tax on profit. Interest expense is also irrelevant here because it is not part of the taxable value-added computation given in the question. Internal auditors reviewing tax controls should verify that VAT calculations use the correct tax base, rate, input credits, and reporting period. Therefore, Option D is correct.

Decreased employee productivity after data loss is most directly caused by lack of data backup. If business data stored or accessed through mobile devices is lost and cannot be restored, employees may need to recreate work, delay tasks, repeat transactions, or wait for recovery. Malware, sensitive data exposure, and lack of encryption are serious security and privacy concerns, but they do not directly explain productivity loss from unrecoverable data. Backup controls support availability and recovery by ensuring data can be restored after deletion, corruption, device theft, or system failure. Internal auditors should evaluate mobile backup requirements, synchronization, cloud storage controls, recovery testing, encryption, and incident response. Therefore, Option D is correct.

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is the primary control for preventing unauthorized external access to an organization ' s network, making it the best answer.

A. Firewall (Correct Answer) – Firewalls prevent unauthorized access by filtering traffic, blocking malicious connections, and securing the network perimeter.

B. Encryption – While encryption protects data confidentiality, it does not actively prevent unauthorized access to a network.

C. Antivirus – Antivirus software protects against malware and viruses but does not prevent unauthorized network access.

D. Biometrics – Biometrics controls physical or logical access (e.g., fingerprint authentication) but does not secure a network from external threats.

IIA GTAG 15 – Information Security Governance highlights firewalls as a critical security control for network protection.

IIA IPPF Standard 2110 – Governance emphasizes the need for network security policies that include firewalls.

NIST SP 800-41 Rev. 1 – Guidelines on Firewalls and Firewall Policy states that firewalls are the first line of defense in securing organizational networks.

Explanation of Each Option:IIA References:

Biometric authentication is the strongest control listed for preventing unauthorized access to data on a stolen mobile device. It relies on a physical characteristic of the authorized user, such as fingerprint, face, or retina recognition, making it harder for a thief to bypass than a passcode, swipe pattern, or security question. Passcodes and swipe patterns can be guessed, observed, shared, or captured. Security questions are often weak because answers may be discoverable or predictable. Internal audit should also expect supporting controls such as encryption, remote wipe, mobile device management, automatic lockout, and incident reporting. However, among the options provided, biometric authentication provides the strongest access prevention control. Therefore, Option A is correct.

Cybersecurity controls are primarily designed to protect the Confidentiality, Integrity, and Availability (CIA) of data. These are the three fundamental principles of cybersecurity and are essential for protecting organizational information assets. Let’s analyze each option:

Option A: Veracity, velocity, and variety.

Incorrect. These attributes are commonly associated with big data and data analytics rather than cybersecurity. Cybersecurity controls focus on ensuring that data is secure, rather than on its volume, speed, or diversity.

IIA Reference: Cybersecurity risk management frameworks emphasize the CIA triad over big data attributes. (IIA GTAG: Auditing Cybersecurity Risk)

Option B: Integrity, availability, and confidentiality.

Correct. These three principles are at the core of cybersecurity:

Confidentiality: Ensures that sensitive information is only accessible to authorized individuals.

Integrity: Protects data from unauthorized modifications or corruption.

Availability: Ensures that data and systems are accessible when needed.

IIA Reference: The IIA’s guidance on IT governance highlights the CIA triad as the foundation of cybersecurity. (IIA GTAG: Information Security Governance)

Option C: Accessibility, accuracy, and effectiveness.

Incorrect. While these attributes are important in data management and usability, they do not directly define cybersecurity controls.

Option D: Authorization, logical access, and physical access.

Incorrect. While these are essential security components, they fall under broader IT security measures rather than forming the fundamental principles of cybersecurity.

Option C illustrates natural bias because management is relying on tradition and past success rather than objectively reassessing current conditions, risks, technology, customer needs, and market changes. This reflects status quo bias and potentially anchoring on historical performance. Option A shows a willingness to revise a prior decision, which may be appropriate if facts changed. Option B reflects temporary uncertainty caused by a recent crisis, not necessarily bias. Option D may be a rational risk response to uncertainty. Internal auditors should recognize bias in decision-making because it can affect strategy, capital investments, risk assessment, and control judgments. When management defends old methods only because they worked before, poor decisions may result. Therefore, Option C is correct.

In a vertically centralized organization, decision-making authority is concentrated at the top levels of management. As a company rapidly expands, maintaining tight control by a small management team can lead to inefficiencies, delays, and suboptimal decision-making due to limited input from operational and frontline staff.

Let’s analyze each option:

Option A: Lack of coordination among different business units

Incorrect. While coordination challenges can exist in a large, decentralized organization, a tightly controlled, centralized structure typically ensures strong coordination but at the cost of slower decision-making.

Option B: Operational decisions are inconsistent with organizational goals

Incorrect. In a centralized structure, top management closely controls decision-making, making goal misalignment less likely.

Option C: Suboptimal decision making

Correct.

Decentralized decision-making allows managers closer to operations to make informed, timely decisions.

A small centralized team may lack specialized knowledge about different departments, leading to inefficient or outdated decisions.

As the company expands, delays in decision-making and lack of responsiveness to market conditions increase risk exposure.

IIA Reference: Internal auditors assess organizational structures to identify risks associated with inefficient decision-making and control bottlenecks. (IIA Standard 2110: Governance)

Option D: Duplication of business activities

Incorrect. Duplication of activities is more common in decentralized structures, where different departments operate independently. A tightly controlled, centralized structure reduces redundancy but at the cost of decision-making efficiency.

Thus, the verified answer is C. Suboptimal decision making.