Free IIA IIA-CIA-Part3 Practice Exam with Questions & Answers | Set: 9

Under the periodic inventory method, closing inventory is calculated using goods available for sale less cost of goods sold. Goods available for sale equals opening inventory of $300,000 plus purchases of $980,000, totaling $1,280,000. Gross margin is 40 percent of sales, so cost of goods sold is 60 percent of sales. Sales of $1,850,000 × 60 percent = $1,110,000 cost of goods sold. Closing inventory is therefore $1,280,000 − $1,110,000 = $170,000. Option B, C, and D do not follow the gross margin calculation correctly. Internal auditors reviewing inventory balances should verify the relationship between sales, gross margin, cost of goods sold, purchases, and ending inventory. Therefore, Option A is correct.

The CAE must ensure the internal audit activity has the knowledge, skills, and competencies needed to address significant risks facing the organization. In this scenario, IT risks have not been audited due to a skills gap. The best response is to identify and provide training resources to strengthen the team’s IT audit capabilities.

Option A (data analytics) is a tool, not a competency solution. Option B (listening sessions) helps planning but does not address the skill deficiency. Option C (succession planning) is future-focused but does not solve the current IT knowledge gap.

The going concern assumption means financial statements are prepared on the basis that the organization will continue operating for the foreseeable future and will not be forced to liquidate or significantly curtail operations. The note described in the question directly reflects this assumption. The monetary unit assumption means transactions are measured in a stable currency. The time period assumption means financial performance is reported over defined accounting periods. The economic entity assumption means the organization’s activities are separate from those of owners or other entities. Internal auditors reviewing financial reporting should understand going concern because it affects asset valuation, liability classification, disclosure, impairment analysis, and audit risk. Therefore, Option B is correct.

Understanding Financial Statements:

Income Statement (Option A) shows a company ' s revenues and expenses over a period but does not detail cash movements.

Owner ' s Equity Statement (Option B) tracks changes in the ownership interest but does not explain cash usage comprehensively.

Balance Sheet (Option C) provides a snapshot of financial position (assets, liabilities, and equity) at a given time, but not the flow of cash.

Statement of Cash Flows (Option D) details where cash comes from and how it is spent during a specific period, making it the best disclosure of money movement.

Why the Statement of Cash Flows is the Best Answer:

It categorizes cash flows into operating, investing, and financing activities to explain how cash is generated and utilized.

It is critical for assessing liquidity, solvency, and overall financial health.

Investors, auditors, and management use this statement to evaluate a company ' s ability to generate cash and meet obligations.

IIA Standard 2120 – Risk Management: Internal auditors assess financial risks, including cash management.

IIA GTAG (Global Technology Audit Guide) on Business Continuity and Liquidity: Emphasizes the importance of cash flow analysis for financial stability.

COSO’s Internal Control Framework: Highlights the role of financial reporting, including cash flows, in risk management.

Relevant IIA References:✅ Final Answer: Statement of Cash Flows (Option D).

The internal audit strategy must be aligned with the organization’s business objectives. This ensures that the internal audit function provides assurance and advisory services that support the achievement of strategic goals. While risk assessment (Option B), controls (Option C), and compliance (Option A) are important inputs, they are secondary to aligning with organizational objectives, which is the foundation of strategy.

A small organization producing standard products is most likely to use functional departmentalization. This structure groups employees by common functions such as production, sales, purchasing, accounting, and administration. It is efficient for smaller, stable organizations because it promotes specialization, clear reporting lines, and economies of expertise without unnecessary complexity. Product departmentalization is more likely when an organization has multiple distinct product lines requiring separate management. A matrix structure is more complex and is generally used where employees report across both functional and project or product lines. A divisional structure is normally used by larger organizations with multiple products, regions, or markets. Internal audit should understand organizational structure because it affects accountability, segregation of duties, communication, and control design. Therefore, Option A is correct.

A capital lease (now referred to as a finance lease under IFRS 16 and ASC 842) is a leasing arrangement where an organization records the leased asset and liability on its balance sheet as if it were owned. Organizations enter into capital leases to improve financial metrics, including free cash flow from operations.

Let’s analyze each option:

Option A: To increase the ability to borrow additional funds from creditors

Incorrect. A capital lease creates a liability on the balance sheet, which may reduce borrowing capacity rather than increase it.

Option B: To reduce the organization ' s free cash flow from operations

Incorrect.

Operating leases impact operating cash flow because lease payments are treated as operating expenses.

Capital leases (finance leases) shift payments to financing activities, improving operating cash flow since lease obligations are classified as debt.

Option C: To improve the organization ' s free cash flow from operations

Correct.

Capital lease payments are classified under financing activities rather than operating activities, which increases free cash flow from operations.

This improves financial ratios and liquidity metrics, making the organization appear more attractive to investors.

IIA Reference: Internal auditors assess lease accounting and financial reporting impacts under IFRS 16 (Leases) and ASC 842 (Leases). (IIA Practice Guide: Auditing Financial Reporting Risks)

Option D: To acquire the asset at the end of the lease period at a price lower than the fair market value

Incorrect. While some capital leases include a bargain purchase option, the primary reason for entering into a capital lease is financial reporting benefits, not necessarily acquiring the asset.

Thus, the verified answer is C. To improve the organization ' s free cash flow from operations.

The best method of compensation to align senior management incentives with the long-term health of the organization is stock options. Stock options encourage executives to focus on sustained growth and profitability rather than short-term gains, ensuring that their interests align with those of shareholders and stakeholders.

Long-Term Value Creation:

Stock options reward executives only if the company’s stock price appreciates over time.

This encourages leadership to focus on long-term profitability, operational efficiency, and sustainability.

Alignment with Shareholder Interests:

If the company performs well, stock prices rise, benefiting both shareholders and executives.

Poor decision-making that harms long-term value results in devalued stock options, discouraging risky short-term strategies.

Retention of Key Executives:

Stock options typically have a vesting period (e.g., 3-5 years), which helps retain top management and ensures commitment to long-term objectives.

Risk Management Considerations:

Unlike cash bonuses or short-term commissions, stock options require executives to consider risks and ethical decision-making over an extended period.

This supports the governance principles outlined by IIA’s International Standards for the Professional Practice of Internal Auditing (IPPF) – Standard 2110 (Governance), which emphasizes aligning incentives with risk tolerance and long-term objectives.

A. Commissions: These are typically tied to short-term sales performance rather than long-term strategic success.

C. Gain-sharing bonuses: These provide short-term financial rewards based on operational performance but do not incentivize sustained value creation.

D. Allowances: Fixed allowances do not fluctuate based on company performance and do not drive long-term strategic focus.

IIA Standard 2110 – Governance: Ensures that management incentives align with the organization ' s mission and risk tolerance.

IIA Practice Guide: Evaluating Corporate Governance: Emphasizes long-term incentive structures such as stock options to promote sustainable decision-making.

COSO Enterprise Risk Management (ERM) Framework: Highlights how executive compensation should support long-term organizational strategy.

Step-by-Step Justification:Why Not the Other Options?IIA References:

Ransomware is a type of cyberattack where malicious software encrypts an organization ' s data, making it inaccessible until a ransom is paid to the attacker. This aligns with the question’s scenario, where denial-of-service is caused by malicious data encryption.

Let ' s analyze the options:

A. Phishing:

Phishing is a social engineering attack that tricks individuals into providing sensitive information, such as usernames, passwords, or credit card numbers. It does not involve encryption or direct denial-of-service.

B. Ransomware (✅ Correct Answer):

Ransomware encrypts critical data and demands a ransom for its release, effectively causing a denial-of-service scenario since the victim cannot access their own systems.

Some well-known ransomware attacks include WannaCry and NotPetya.

C. Hacking:

Hacking is a broad term for unauthorized access to systems but does not specifically refer to denial-of-service through encryption. Ransomware is a specific type of hacking attack.

D. Malware:

Malware (malicious software) is a general category that includes viruses, trojans, worms, spyware, and ransomware. While ransomware is a type of malware, not all malware encrypts data to demand ransom.

IIA Global Technology Audit Guide (GTAG) – Auditing Cybersecurity Risks – Discusses various cyber threats, including ransomware.

NIST Cybersecurity Framework (CSF) – Defines ransomware as a major threat that disrupts business continuity.

COBIT Framework (Control Objectives for Information and Related Technologies) – Addresses risks associated with ransomware and how internal auditors should assess controls.

ISO/IEC 27001 – Information Security Management Systems (ISMS) – Identifies the importance of cybersecurity measures to prevent ransomware attacks.

IIA References:

According to the IIA Standards, audit communications must be accurate, objective, clear, concise, constructive, and timely. In this case, the auditor’s statement that “controls are as effective as last year” is inaccurate, because the prior year’s report identified significant weaknesses. Equating ineffective controls with effectiveness misrepresents the actual condition, thereby compromising accuracy.

Objectivity (Option C), conciseness (Option A), and constructiveness (Option B) are not the main issue here. The primary weakness is accuracy (Option D).

Comprehensive and Detailed In-Depth Explanation:

Smart devices often incorporate advanced security features that enhance secure authentication mechanisms. These features may include biometric sensors (such as fingerprint readers or facial recognition), hardware tokens, and secure enclaves that store authentication credentials. By utilizing these technologies, smart devices provide robust methods to verify user identities, thereby strengthening access controls to sensitive information and systems. While smart devices do offer portability (option C), their primary contribution to security lies in enhancing authentication processes. Version control (option A) pertains to managing changes in software or documents and is not directly impacted by smart devices. Privacy (option B) can be influenced by smart devices, but the direct improvement is in secure authentication, which in turn can support privacy protections.

Phishing attacks often target financial institutions by impersonating customers and requesting fraudulent fund transfers. The best way to verify such requests is to independently contact the customer using a trusted communication channel, such as the phone number on record.

Verbal confirmation via a trusted number prevents fraudsters from exploiting email spoofing or compromised accounts.

This aligns with industry best practices, including multi-factor verification for high-risk transactions.

A. Reviewing the customer ' s wire activity to determine whether the request is typical. (Incorrect)

While reviewing transaction history can help detect anomalies, fraudsters can mimic previous transaction patterns, making this method unreliable on its own.

B. Calling the customer at the phone number on record to validate the request. (Correct)

Direct phone verification ensures that the actual account owner is making the request.

This is a widely recommended anti-fraud measure in financial institutions.

C. Replying to the customer via email to validate the sender and request. (Incorrect)

If the email account is compromised, the fraudster will control the response.

Email validation is not secure for financial transactions.

D. Reviewing the customer record to verify whether the customer has authorized wire requests from that email address. (Incorrect)

While this can help identify unregistered emails, attackers often spoof or hack real customer emails.

Email-based verification alone is not sufficient.

IIA GTAG 16 – Security Risk: IT and Cybersecurity recommends multi-factor authentication for high-risk financial transactions.

IIA Standard 2120 – Risk Management highlights the need for robust fraud prevention mechanisms, including direct customer verification.

FFIEC (Federal Financial Institutions Examination Council) Cybersecurity Guidelines emphasize the importance of out-of-band authentication for wire transfers.

Explanation of Answer Choices:IIA References:Thus, the correct answer is B. Calling the customer at the phone number on record to validate the request.

A flatter organizational structure reduces hierarchical levels and promotes greater autonomy for employees. The primary benefit is cost reduction due to fewer management layers and streamlined decision-making.

Fewer Management Layers – Reduces the number of mid-level managers, decreasing salary expenses.

Increased Operational Efficiency – Less bureaucracy leads to faster decision-making, lowering administrative costs.

Encourages Employee Autonomy – Reduces dependence on supervision, improving productivity.

B. Slower decision-making at the senior executive level – Incorrect because flatter structures lead to faster decision-making due to fewer approval levels.

C. Limited creative freedom in lower-level managers – Incorrect because flatter structures provide more autonomy and innovation opportunities.

D. Senior-level executives more focused on short-term, routine decision-making – Incorrect because executives in a flatter structure focus on strategic, high-level decisions, delegating routine tasks.

IIA’s GTAG on Governance and Risk Management – Discusses the financial and operational impacts of different organizational structures.

COSO’s Enterprise Risk Management (ERM) Framework – Emphasizes how flatter structures reduce operational inefficiencies and costs.

COBIT 2019 (Governance Framework) – Highlights the impact of organizational structure on financial performance.

Why Lower Costs is the Correct Answer?Why Not the Other Options?IIA References:

For a customer-facing banking application, the most critical issue is protecting sensitive data while it is transmitted between the customer and the web application. Account numbers, credentials, balances, and other confidential information can be intercepted over networks if communications are not encrypted. Encryption in transit, usually through secure protocols such as TLS, protects confidentiality and integrity during transmission. Option A is useful because logs may contain sensitive information, but it is not the most important control for customer data moving across the internet. Option B may be important for data at rest, but the question focuses on a web-based customer application and submitted data. Option C is relevant to physical security, but it does not address interception risk during online communication. Therefore, Option D is the strongest answer.