Pass the IIA CIA IIA-CIA-Part3 Questions and answers with ExamsMirror

When an organization outsources IT services, risks can be categorized as:

Risks specific to the organization – Risks that arise internally within the company.

Risks specific to the service provider – Risks that are under the control of the third-party provider.

Shared risks – Risks that require joint management by both the organization and the service provider.

Let’s analyze the answer choices:

Option A: Unexpected increases in outsourcing costs.

Incorrect. While cost increases can be a risk, they are often a shared risk because the organization and the provider negotiate pricing terms.

Option B: Loss of data privacy.

Incorrect. Data privacy concerns are shared between the organization (which must ensure compliance with regulations like GDPR or CCPA) and the service provider (which must implement proper security controls).

Option C: Inadequate staffing.

Correct. The service provider is responsible for maintaining adequate staffing levels to deliver the contracted services effectively. If they fail to do so, service quality can deteriorate, posing risks to the organization.

IIA Reference: Internal auditors should assess vendor risk management, including the provider’s staffing capabilities. (IIA GTAG: Auditing IT Outsourcing)

Option D: Violation of contractual terms.

Incorrect. While the service provider may be responsible for upholding contract terms, the organization is also responsible for contract enforcement. This makes it a shared risk rather than one specific to the provider.

A risk and control questionnaire (RCQ) is used during preliminary surveys to help the auditor ascertain the existence of controls in a specific process or program. It provides structured information about which controls are in place, which are missing, and how they are applied.

Option A refers to reconciliation, which is not the main purpose. Option C (testimonial information) suggests reliance on management statements, which is weaker than structured control identification. Option D involves external confirmation, which goes beyond the RCQ’s purpose.

The internal audit procedures manual documents policies and procedures for conducting audit engagements, including steps to follow when issues arise, such as disputes with management regarding findings. It ensures consistency and standardization of audit practice.

Option A (strategic plan) and Option C (resources) are not part of audit procedures but rather part of planning or organizational documents. Option D (authority to collect data) belongs in the internal audit charter, not in the procedures manual.

Therefore, the correct answer is appropriate response options for disputes with management (Option B).

Business continuity planning (BCP) requires a recovery strategy that minimizes downtime and ensures that critical operations resume within the organization’s desired recovery time objective (RTO).

Since the organization wants to recover within four to seven days, it does not require an expensive real-time recovery site (hot site).

The best strategy is a warm site: a pre-secured location with configurable hardware and data backups that can be activated within the required timeframe.

(A) Incorrect – A recovery strategy whereby a separate site has not yet been determined, but hardware has been reserved for purchase and data backups.

This is a cold site, requiring time for setup and hardware installation.

It does not meet the four to seven-day recovery timeframe efficiently.

(B) Incorrect – A recovery strategy whereby a separate site has been secured and is ready for use, with fully configured hardware and real-time synchronized data.

This describes a hot site, which allows instant failover with real-time synchronization.

While effective, it is costly and unnecessary for a four-to-seven-day recovery target.

(C) Incorrect – A recovery strategy whereby a separate site has been secured and the necessary funds for hardware and data backups have been reserved.

While a site has been secured, the absence of pre-configured hardware would delay recovery, making it an inefficient choice.

(D) Correct – A recovery strategy whereby a separate site has been secured with configurable hardware and data backups.

This describes a warm site, which is the best balance between cost and recovery efficiency.

Configurable hardware and data backups ensure that operations can resume within four to seven days.

IIA’s GTAG (Global Technology Audit Guide) – Business Continuity and IT Disaster Recovery

Recommends warm sites for recovery within a few days.

ISO 22301 – Business Continuity Management Systems

Defines recovery time objectives (RTOs) and site classifications (hot, warm, cold).

COBIT Framework – IT Risk Management

Guides organizations on cost-effective recovery site selection based on risk tolerance.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

A detective control is a security measure that identifies and alerts an organization to potential cyberthreats after they occur but before they cause harm. Detective controls do not prevent attacks but help detect them in a timely manner.

Why Option B (Monitoring for vulnerabilities based on industry intelligence) is Correct:

Continuous monitoring for vulnerabilities helps detect emerging threats, security breaches, and weaknesses in IT systems.

Uses threat intelligence feeds, security information and event management (SIEM) systems, and intrusion detection systems (IDS).

Helps organizations respond quickly to cyberattacks by identifying patterns, suspicious activity, or known vulnerabilities.

Why Other Options Are Incorrect:

Option A (A list of trustworthy, good traffic and a list of unauthorized, blocked traffic):

Incorrect because this describes a whitelisting/blacklisting technique, which is a preventive control, not a detective control.

Option C (Comprehensive service level agreements with vendors):

Incorrect because service level agreements (SLAs) ensure contractual obligations, but do not detect security threats.

Option D (Firewall and other network perimeter protection tools):

Incorrect because firewalls are preventive controls, designed to block unauthorized access, not detect threats after they occur.

IIA GTAG – "Auditing Cybersecurity Risks": Discusses detective controls such as vulnerability monitoring and threat intelligence.

COBIT 2019 – DSS05 (Manage Security Services): Recommends continuous monitoring for cyber threats as a detective control.

NIST Cybersecurity Framework – Detect Function: Highlights vulnerability management and threat monitoring as key detective measures.

IIA References:Thus, the correct answer is B. Monitoring for vulnerabilities based on industry intelligence.

The first step in a project management plan is to break the project into manageable components, known as Work Breakdown Structure (WBS). This step ensures clarity, task allocation, and effective tracking.

(A) Estimate time required to complete the whole project.

Incorrect: Time estimation comes after breaking the project into smaller tasks.

(B) Determine the responses to expected project risks.

Incorrect: Risk management is important but is planned after defining project tasks and scope.

(C) Break the project into manageable components. (Correct Answer)

Dividing the project into smaller tasks (WBS) helps in resource allocation, scheduling, and risk assessment.

IIA GTAG 12 – Project Risk Management suggests using WBS to define tasks clearly.

(D) Identify resources needed to complete the project.

Incorrect: Resources can only be allocated effectively after defining project components.

IIA GTAG 12 – Project Risk Management: Recommends Work Breakdown Structure (WBS) as the first step in project planning.

PMBOK (Project Management Body of Knowledge): Defines WBS as the foundation of project planning.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (C) Break the project into manageable components, as this is the first step in structuring and planning a successful project.

The internal audit plan should be risk-based. To achieve this, the CAE should develop an audit universe that lists all auditable units (processes, functions, systems, etc.) and use it as the foundation for risk assessment and prioritization.

Option B is too narrow (monetary value is just one factor). Option C is incomplete since senior management’s input is important but not the sole basis. Option D is incorrect because eliminating units not mandated by law ignores risk-based planning requirements.

Thus, the most appropriate approach is Option A: establishing an audit universe.

Manufacturing costs are classified into three main categories: direct materials, direct labor, and manufacturing overhead. These categories help organizations determine product costs, pricing strategies, and financial reporting.

Why Option B (Overhead costs, direct labor, direct materials) is Correct:

Direct materials: Raw materials used directly in production (e.g., wood for furniture).

Direct labor: Labor costs directly tied to production (e.g., factory workers assembling a product).

Manufacturing overhead: Indirect costs related to production (e.g., depreciation, factory utilities, maintenance).

These categories align with GAAP, IFRS, and cost accounting standards.

Why Other Options Are Incorrect:

Option A (Direct materials, indirect materials, raw materials):

"Indirect materials" and "raw materials" are part of manufacturing overhead and direct materials, respectively, but do not form a primary cost classification.

Option C (Direct materials, direct labor, depreciation on factory buildings):

Depreciation on factory buildings is an overhead cost, not a separate category.

Option D (Raw materials, factory employees' wages, production selling expenses):

Selling expenses are not part of manufacturing costs; they are part of operating expenses.

IIA Practice Guide – Auditing Cost Management: Defines manufacturing cost classifications.

IFRS & GAAP Cost Accounting Standards: Outline manufacturing cost components.

COSO Framework – Cost Control Guidelines: Emphasizes accurate cost allocation in financial reporting.

IIA References:

According to the IIA Standards, audit communications must be accurate, objective, clear, concise, constructive, and timely. In this case, the auditor’s statement that “controls are as effective as last year” is inaccurate, because the prior year’s report identified significant weaknesses. Equating ineffective controls with effectiveness misrepresents the actual condition, thereby compromising accuracy.

Objectivity (Option C), conciseness (Option A), and constructiveness (Option B) are not the main issue here. The primary weakness is accuracy (Option D).

According to IIA guidance, if a nonconformance occurs, the CAE must evaluate its impact on the overall scope and operations of the internal audit activity. If the deficiency materially affects internal audit’s overall ability to fulfill its responsibilities, conformance cannot be claimed. If the impact is limited, conformance may still be declared with appropriate disclosure.

Options A and B assume automatic conformance without evaluation. Option C is incorrect because there is no concept of “partial conformance” under the Standards.

Internal audit maintains independence by avoiding the design or implementation of management’s corrective actions. However, the internal audit function has a valid role in evaluating and monitoring whether management’s action plans effectively address audit observations. This ensures risks are mitigated while internal audit retains its assurance role.

Option A is too restrictive; while internal audit does not design or implement action plans, it does monitor and evaluate them. Options B and D inappropriately place responsibility for action plan design and monitoring with internal audit, which would compromise independence.

Definition of Rooting:

Rooting (on Android) or Jailbreaking (on iOS) is the process of bypassing manufacturer and administrative security controls on a smart device.

This allows users to gain full control (root access) over the operating system, which can override security restrictions and allow installation of unauthorized applications.

How Rooting Increases Data Security Risks:

Bypassing Security Measures: Rooting removes built-in security protections, making the device more vulnerable to malware, unauthorized access, and data breaches.

Exposure to Malicious Apps: Rooted devices can install third-party applications that are not vetted by official app stores, increasing the risk of data theft, spyware, and ransomware attacks.

Circumventing Enterprise Security Policies: Many organizations use Mobile Device Management (MDM) to enforce security policies, but rooted devices can bypass these controls, exposing corporate data to cyber threats.

Increased Risk of Privilege Escalation Attacks: Attackers can exploit root access to take full control of the device, leading to unauthorized access to sensitive information.

IIA’s Perspective on Cybersecurity Risks:

IIA Standard 2110 – Governance emphasizes the importance of protecting sensitive data and ensuring compliance with IT security policies.

IIA’s GTAG (Global Technology Audit Guide) on Information Security warns against the dangers of rooted or jailbroken devices, as they compromise cybersecurity defenses.

NIST Cybersecurity Framework and ISO 27001 Information Security Standards identify unauthorized modifications to devices as a critical security risk.

Eliminating Incorrect Options:

B. Eavesdropping: This refers to intercepting communications (e.g., listening in on phone calls or network traffic) but does not involve circumventing administrative restrictions.

C. Man-in-the-Middle (MITM) Attack: This is an attack where an attacker intercepts and alters communication between two parties but does not involve rooting a device.

D. Session Hijacking: This attack involves stealing session tokens to impersonate a user but is unrelated to bypassing security controls on devices.

IIA References:

IIA Standard 2110 – Governance and IT Security

IIA GTAG – Information Security Risks

NIST Cybersecurity Framework

ISO 27001 Information Security Standards

Innovation in internal audit is reflected in how the function applies new technologies, methodologies, and thought leadership. Measuring staff application of technology in audit fieldwork and their engagement in professional organizations/publications demonstrates innovation and forward-looking practices.

Options A, B, and D measure performance, satisfaction, or compliance but do not specifically address innovation.

When management agrees to address audit issues, the CAE must ensure that the final report documents management’s agreement and corrective action plan, including implementation timelines. This ensures accountability and enables proper follow-up monitoring.

Option B (follow-up engagement) may happen later, but the first step is proper documentation. Option C is unnecessary since management already agreed to corrective action. Option D is inappropriate because it is management’s responsibility to develop and own the action plan, not internal audit’s.

The main objective of risk-based assurance is to demonstrate that audit observations are directly connected to organizational risks. By measuring the percentage of audit observations that can be tied to significant risks, the internal audit function shows that it is focusing on areas of importance to governance and risk management.

Options A, C, and D are useful performance metrics, but they do not measure the ability of internal audit to deliver risk-based assurance as directly as Option B.