Free IIA IIA-CIA-Part3 Practice Exam with Questions & Answers | Set: 6

The internal audit plan should be risk-based. To achieve this, the CAE should develop an audit universe that lists all auditable units (processes, functions, systems, etc.) and use it as the foundation for risk assessment and prioritization.

Option B is too narrow (monetary value is just one factor). Option C is incomplete since senior management’s input is important but not the sole basis. Option D is incorrect because eliminating units not mandated by law ignores risk-based planning requirements.

Thus, the most appropriate approach is Option A: establishing an audit universe.

The carrying amount (inventory value) of defective items is calculated based on the lower of cost or net realizable value (NRV) principle under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS).

Given data:

Market price (normal selling price): $10 per unit

Production cost: $4 per unit

Defect selling price (NRV): $5 per unit

Total defective units: 10,000

Step 1: Determine the valuation rule

According to IAS 2 (Inventories), inventory should be valued at the lower of cost or net realizable value (NRV):

Cost per unit = $4

NRV per unit = $5

Since $4 (cost) < $5 (NRV), the cost per unit ($4) is used for valuation.

Step 2: Calculate total carrying amount

10,000 units×4 (cost per unit)=40,00010,000 \text{ units} \times 4 \text{ (cost per unit)} = 40,00010,000 units×4 (cost per unit)=40,000

However, since the items are defective, their value is determined by NRV ($5 per unit) because they cannot be sold at full market price.

10,000×5=50,00010,000 \times 5 = 50,00010,000×5=50,000

Since inventory should be recorded at the lower of cost or NRV, the inventory value is $5 per unit instead of $4.

10,000×5=5,00010,000 \times 5 = 5,00010,000×5=5,000

Thus, the verified answer is C. $5,000.

The discussion between the internal auditor and the database administrator is most likely centered around the security risk present in the period between account creation and password change. When a system generates a default password such as " 123456, " it introduces a temporary vulnerability until the user changes it.

Understanding Default Password Security Risks:

Default passwords, especially predictable ones (e.g., " 123456 " ), pose a security threat because they are easy to guess.

If an unauthorized user gains access before the legitimate user changes the password, data confidentiality and integrity may be compromised (IIA GTAG - Global Technology Audit Guide).

Evaluating the Window of Exposure:

The primary concern is the time between account creation and password reset.

During this time, an attacker could exploit the default password to gain unauthorized access to sensitive systems.

Why Other Options Are Less Relevant:

Option A (Replacing numbers with characters) – While this improves security, it does not directly address the risk of an attacker exploiting the default password before the user resets it.

Option B (Users continuing to use the initial password) – This is a security issue, but it is mitigated by requiring a password reset upon first login. The primary concern is the time before the reset happens.

Option D (User training on password management) – While training is crucial for long-term security, it does not directly address the immediate vulnerability of default passwords before they are changed.

IIA Global Technology Audit Guide (GTAG) 16: Data Management and Security

IIA Standard 2110 – Governance: Recommends addressing IT security risks, including credential management.

IIA Practice Advisory 2130.A1-1: Internal auditors should assess whether management has identified, assessed, and mitigated IT security risks, such as weak authentication practices.

Step-by-Step Analysis:Relevant IIA References:

A relevant cost is a future cost that differs among decision alternatives. It matters because it can influence the decision being made. Costs that are the same under all alternatives are irrelevant because they do not change the outcome. Past costs are sunk costs and should not affect current decisions because they cannot be changed, even if they differ historically. For example, in a make-or-buy decision, avoidable future production costs are relevant, while already-incurred equipment costs are usually not. Internal auditors reviewing management decisions should determine whether analyses improperly include sunk costs or exclude avoidable future costs. Option A is incorrect because a future cost that is the same among alternatives is irrelevant. Options C and D are incorrect because past costs are not relevant to future decisions. Therefore, Option B is correct.

Comprehensive and Detailed In-Depth Explanation:

A globalization strategy focuses on standardizing products and marketing campaigns across all international markets. This ensures consistent branding and messaging, achieving economies of scale while maintaining a uniform customer experience.

Option A (Export strategy) primarily refers to selling domestic products abroad without a significant focus on global marketing.

Option B (Transnational strategy) balances global standardization and local adaptation, but does not emphasize a single advertising approach.

Option C (Multi-domestic strategy) tailors marketing and product offerings to each local market, making it less suitable for a uniform advertising campaign.

Thus, the globalization strategy (Option D) is the best approach for a unique yet standardized advertising campaign across markets.

The most effective control for temporary third-party access is to create user accounts with defined expiration dates and access rights based only on the services provided. This applies least privilege and automatically limits access duration, reducing the risk that accounts remain active after work ends. Manager approval is necessary, but approval alone does not technically restrict access. Providing administrator access, even for a limited period, is excessive unless absolutely required and tightly monitored. Deleting accounts after work is completed is useful but depends on timely manual action and may fail if completion is not communicated. Internal audit should verify that third-party access is approved, time-bound, role-based, monitored, and promptly revoked. Therefore, Option B is correct.

An investment center is evaluated not only on revenues and costs but also on how effectively it uses invested capital. Residual income is appropriate because it measures profit after deducting a required return on the investment base. This makes it suitable for assessing whether management generated returns above the organization’s minimum required rate. Cost centers are evaluated mainly on cost control, revenue centers on revenue generation, and profit centers on revenues minus expenses; none of these centers is directly responsible for invested capital. Flexible budgets and variance analysis can apply to many responsibility centers. Contribution margin reporting is useful for segment profitability but does not fully evaluate investment use. Therefore, residual income is uniquely suited to investment center evaluation, making Option D correct.

Test marketing is the controlled introduction of a product into a limited, representative market before a full-scale launch. It allows management to evaluate customer response, pricing, packaging, advertising, distribution, and sales potential under realistic conditions. The results help reduce the risk of a costly national launch failure. Experimentation is a broader research method and may not involve a market trial of the product. Segmentation refers to dividing the market into groups of customers with similar needs or characteristics. Positioning concerns how the product is intended to be perceived by customers relative to competitors. Internal auditors reviewing new-product launch controls may evaluate whether test marketing results were objectively analyzed before major spending decisions. Therefore, Option A is correct.

The failed control is reauthorization. The employee’s job responsibility changed when another accountant became responsible for one of the business units, but the senior payroll accountant’s access rights remained unchanged. A reauthorization or access recertification control should periodically confirm that existing access is still appropriate based on current job duties. Authorization controls are involved when access is initially approved, but this scenario concerns access that should have been reviewed and adjusted after responsibilities changed. Authentication controls verify identity, not whether access remains appropriate. Segregation of duties may be relevant to payroll access design, but the specific failure described is the unchanged access rights attestation. Therefore, Option A is correct.

Comprehensive and Detailed In-Depth Explanation:

A cold site is a disaster recovery location that provides only basic infrastructure (e.g., power, cooling, and space) but does not have pre-installed IT systems. Organizations must procure and install servers before recovery can begin.

Option A (Real-time data synchronization) applies to hot sites, which maintain fully operational backup systems.

Option B (Recovery time under one week) is more characteristic of warm or hot sites, as cold sites require longer setup times.

Option D (Defined recovery processes) applies to all disaster recovery plans and does not differentiate cold sites.

Since a cold site lacks pre-installed servers, Option C is the correct answer.

A data dictionary stores metadata about a database, including definitions, structure, tables, fields, relationships, formats, constraints, and sometimes configuration-related information about database objects. It helps users, developers, administrators, and auditors understand what data exist, how they are organized, and how they should be interpreted. A database table stores actual data records, not the overall metadata repository. Program files contain application or system logic. A backup system stores copies of data for recovery, not the definitions and metadata of the database. Internal auditors use data dictionaries when validating data extracts, performing analytics, reviewing system interfaces, and assessing data governance. Because it stores metadata about database objects and structure, Option D is correct.

The question refers to an internal auditor evaluating IT controls and suggesting an improvement in the process where results are compared against the input. This indicates a focus on verifying the accuracy, completeness, and validity of processed data, which falls under processing controls.

Definition of IT Controls Categories:

Input Controls: Ensure data accuracy before processing but do not compare input to results.

Processing Controls: Ensure that data is processed correctly and that the output matches the expected results.

Output Controls: Verify the accuracy of the final output but do not directly compare results against input.

Integrity Controls: Ensure data integrity across systems but do not specifically focus on input-output validation.

Why Processing Controls?

Processing controls are designed to detect and correct errors during data processing.

According to the IIA’s Global Technology Audit Guide (GTAG) on Information Technology Risks, processing controls ensure data consistency, accuracy, and completeness by validating input data against expected output.

Examples of processing controls include:

Reconciliation controls (comparing input and output).

Validation and verification checks (ensuring correct processing logic).

Why Not Other Options?

A. Output Controls: Focus on final reports and user access, not comparing input with output.

B. Input Controls: Ensure valid data entry but do not verify processing results.

D. Integrity Controls: Protect data consistency but do not specifically involve input-output reconciliation.

IIA GTAG – Information Technology Risks and Controls

IIA Standard 2110 – IT Governance and Risk Management

COBIT 2019 – Control Objectives for Information and Related Technologies

Step-by-Step Justification:IIA References:Thus, the correct and verified answer is C. Processing controls.

The failed recovery element is the offline backup retrieval process. The organization needed physical backup hard drives from a third-party service provider, but the plan did not account for how to retrieve them when communication channels were disrupted and the provider’s office was closed. Online backup recovery is not the issue because the scenario involves physical backup hard drives. Mobile connection recovery is part of the crisis context, but the test failed because the backups could not be obtained. Onsite backup preservation is also not applicable because the backup hard drives were offsite. Internal auditors reviewing recovery tests should assess whether plans address practical logistics, contact alternatives, access arrangements, operating hours, custody, and emergency retrieval. Therefore, Option A is correct.

Liquidity refers to an organization’s ability to meet short-term obligations as they come due. The current ratio is a standard liquidity measure calculated as current assets divided by current liabilities. It helps indicate whether the organization has sufficient short-term resources to cover short-term debts. Earnings per share measures profitability attributable to shareholders, not liquidity. Asset turnover measures efficiency in using assets to generate sales. Net income measures profitability but does not necessarily show whether cash or current assets are available to meet immediate obligations. Internal auditors reviewing liquidity should consider current ratio, quick ratio, working capital, cash conversion cycle, receivable collection, inventory movement, and short-term borrowing. Therefore, Option D is correct.

The equity method is used when an investor owns between 20% and 50% of another company’s stock, indicating significant influence over the investee. Since the investor organization is purchasing 40% of the stock, it qualifies for this method.

(A) Cost method.

Incorrect: The cost method is used when the investor has less than 20% ownership and no significant influence.

(B) Equity method. (Correct Answer)

The equity method is required when the investor has significant influence over the investee (typically between 20% and 50% ownership).

Under this method, the investor records a proportional share of the investee’s profits and losses in its financial statements.

IIA Standard 2330 – Documenting Information recommends accurate financial reporting and appropriate accounting method selection.

(C) Consolidation method.

Incorrect: The consolidation method is used when the investor owns more than 50% of the stock, granting control over the investee.

(D) Fair value method.

Incorrect: The fair value method applies when investments are traded in active markets and do not grant significant influence.

IIA Standard 2330 – Documenting Information: Requires appropriate classification of financial investments.

GAAP & IFRS Accounting Standards: Mandate the equity method for ownership between 20% and 50% with significant influence.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) Equity method, as 40% ownership implies significant influence, requiring the use of this method.