Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 17

Explanation:

According to IIA guidance, a project management methodology is a broad, integrated collection of policies, standards, procedures, tools, and techniques used to guide the planning and execution of a project. It provides a structured framework that defines how projects should be initiated, planned, executed, monitored, controlled, and closed. Methodologies such as PMBOK, PRINCE2, and Agile provide consistency, repeatability, and discipline in project delivery, helping organizations manage scope, time, cost, quality, and risk. The key characteristic described in the question — a broad collection of integrated policies, standards, and procedures for planning and executing projects — is exactly what a project management methodology provides.

Why the other options are incorrect:

A. Project portfolio – A project portfolio is the collection of all projects and programs undertaken by an organization, managed collectively to achieve strategic objectives. It refers to the grouping and prioritization of projects, not the integrated set of policies, standards, and procedures used to guide individual project planning and execution.

B. Project development – Project development refers to the process of defining, designing, and building a project or its deliverables. It is a phase or activity within a project, not a broad framework of policies, standards, and procedures governing how projects are planned and executed.

C. Project governance – Project governance refers to the framework of authority, accountability, decision-making, and oversight structures that guide and control projects at the organizational level. While governance establishes direction and oversight, it is not itself the integrated collection of policies, standards, and procedures that guide day-to-day project planning and execution — that is the role of the methodology.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Project Management — specifically project management frameworks, methodologies, and governance.

Explanation:

Fixed manufacturing costs are costs that do not change with the level of production output, such as factory rent, depreciation of plant and equipment, insurance, property taxes, and salaries of production supervisors. The purpose of incurring these costs is to ensure that production facilities and capacity are available so the organization can manufacture its products. In other words, fixed manufacturing costs are incurred to establish and maintain the readiness and availability of production resources — the plant, equipment, and supporting infrastructure — regardless of how much is actually produced in a given period. This is the fundamental reason these costs exist and the role they play in manufacturing operations.

Why the other options are incorrect:

B. To decrease direct expenses related to production – Direct expenses related to production (direct materials and direct labor) are variable costs that change with output. Fixed manufacturing costs do not decrease direct expenses; they are separate from direct costs and are not incurred for the purpose of reducing them.

C. To incur stable costs despite operating capacity – While it is true that fixed manufacturing costs remain stable in total across different levels of operating capacity, this describes a characteristic of fixed costs (cost behavior), not their purpose. The question asks for the purpose of fixed manufacturing costs, which is to ensure the availability of production facilities.

D. To increase the total unit cost under absorption costing – Under absorption costing, fixed manufacturing costs are allocated to units produced, which affects unit cost. However, increasing unit cost is not the purpose of fixed manufacturing costs; it is merely a consequence of how they are accounted for. The purpose is to provide and maintain production capacity.

Reference:
 IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — specifically cost behavior, fixed versus variable costs, and manufacturing cost classifications.

Explanation:

An Internet service provider (ISP) delivers continuous, real-time connectivity and services to its customers, so even brief downtime can be extremely costly and damaging to its reputation and contractual obligations. Because of this, an ISP requires a recovery solution that can restore operations almost immediately after a disaster. A hot site is a fully operational, duplicate facility with pre-installed hardware, software, and network infrastructure, and replicated data that is ready to take over operations within hours or even minutes. This makes a hot site the most appropriate choice for an ISP, whose servers and network services must be restored with minimal interruption.

Why the other options are incorrect:

A. On site – Restoring operations on site is not feasible when the servers were damaged by a natural disaster at that location. The on-site facility may be destroyed, inaccessible, or without power and connectivity, making it unsuitable for recovery. Recovery must occur at an alternate location.

B. Cold site – A cold site provides only basic infrastructure (space, power, HVAC, cabling) with no pre-installed hardware or software. Rebuilding an ISP's servers and network from scratch at a cold site would take days or weeks, resulting in prolonged downtime that is unacceptable for an ISP's continuous service requirements.

D. Warm site – A warm site is partially equipped with some hardware and software but is not fully configured or ready for immediate operation. Recovery typically takes days, which is still too slow for an ISP that must restore connectivity and services with minimal interruption. A hot site offers the speed required.

Reference:

* IIA-CIA-Part3 content area on Business Continuity Management (BCM) and Disaster Recovery Planning — alternate site strategies, including hot, warm, and cold sites.

Explanation:

Authentication credentials based on biometrics — such as fingerprints, iris patterns, facial recognition, or voice recognition — are tied to an individual's physical or behavioral characteristics. Unlike keys, cards, or tokens, biometric traits cannot be reissued, changed, or replaced. When an employee's access rights need to be removed, a biometric credential is the most difficult to revoke because the credential itself is permanently associated with the person. The organization cannot "take back" the employee's fingerprint or iris pattern; it can only delete the biometric template from the system or remove the individual's authorization record. However, even then, if the person's biometric data remains in any backup or secondary system, or if the same biometric is used across multiple systems, revoking access completely is challenging. This makes biometric credentials inherently harder to revoke than physical or token-based credentials, which can simply be collected, deactivated, or destroyed.

Why the other options are incorrect:

A. A traditional key lock
– A traditional key lock uses a physical key that can be collected from the departing employee, and the lock can be rekeyed if necessary. Revocation is straightforward because the physical credential can be taken back and the lock changed, making it relatively easy to revoke access.

C. A card-key system
– A card-key system uses a physical card that can be deactivated in the access control system and collected from the employee. Revocation is simple and immediate: the card is disabled electronically and physically retrieved, so it is not difficult to revoke.

D. A proximity device
– A proximity device (such as a proximity card or badge) is similar to a card-key system. It can be deactivated in the access control system and collected from the employee. Revocation is straightforward because the device can be electronically disabled and physically recovered, making it easy to revoke.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically authentication methods, access control, and identity management.

Explanation:

When an investor organization acquires a significant influence over another organization — typically evidenced by owning between 20 percent and 50 percent of the investee's voting stock — the equity method of accounting is used. Owning 40 percent of another organization's stock falls squarely within this range, so the investor is presumed to have significant influence over the investee's operating and financial policies. Under the equity method, the investor initially records the investment at cost and subsequently adjusts the carrying amount to recognize its share of the investee's net income or loss and dividends received. This method reflects the investor's proportionate economic interest in the investee and is the appropriate accounting treatment for a 40 percent ownership stake.

Why the other options are incorrect:

A. Cost method – The cost method is typically used when the investor has little or no influence over the investee, generally when ownership is less than 20 percent of the voting stock. Since 40 percent ownership indicates significant influence, the cost method would not be appropriate.

C. Consolidation method – The consolidation method is used when the investor has control over the investee, generally when ownership exceeds 50 percent of the voting stock. At 40 percent ownership, the investor does not have control, so consolidation is not appropriate.

D. Fair value method – The fair value method is generally used for investments in equity securities where the investor has little or no influence (typically less than 20 percent ownership) and the investment is measured at fair value through profit or loss or through other comprehensive income. At 40 percent ownership, the investor has significant influence, so the equity method is required instead of the fair value method.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — specifically investment accounting and the criteria for applying the cost, equity, consolidation, and fair value methods.

Explanation:

In this fraud scheme, one employee was able to clock in and clock out for her co-worker friends because the time-tracking system relied on credentials that could be shared or used by another person. Physical authentication devices that verify something unique to the individual — such as fingerprints, facial features, or iris patterns — prevent this type of fraud because the credential is tied to the actual person and cannot be transferred to or used by someone else. Biometric devices verify that the person clocking in is physically present and is who they claim to be, which eliminates the ability of one employee to clock in on behalf of another. This makes face or finger recognition equipment the most effective control against this fraudulent scheme.

Why the other options are incorrect:

B. Radio-frequency identification chips to authenticate employees with cards
– RFID cards can be shared, loaned, or handed to another employee, allowing one person to clock in for a friend. Because possession of the card — not the identity of the person — is what authenticates the transaction, this control does not prevent one employee from clocking in for another.

C. A requirement to clock in and clock out with a unique personal identification number
– A personal identification number (PIN) can be shared or observed by others. One employee could use a co-worker's PIN to clock them in or out, just as the fraudulent employee did in this scenario. A PIN authenticates knowledge, not physical identity, so it does not prevent this type of fraud.

D. A combination of a smart card and a password to clock in and clock out
– While combining a smart card with a password strengthens authentication compared to a card or password alone, both factors can still be shared or disclosed. One employee could obtain a co-worker's smart card and password and clock in on their behalf, so this control does not fully prevent the fraud described.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically authentication methods, access controls, and fraud prevention.

Explanation:

The most recent backup of the human resources database is specifically intended for disaster recovery purposes — that is, to restore the database and its data in the event of a system failure, data corruption, or loss of the primary data center. When a data center failure occurs and operations must be restored at the backup site, the most recent backup is the best source of information because it contains the most current version of the database available, minimizing data loss and allowing the organization to resume HR operations as quickly as possible. This is the primary purpose of maintaining regular backups: to enable restoration of systems and data after a disruption.

Why the other options are incorrect:

A. An incorrect program fix was implemented just prior to the database backup
– If an incorrect program fix was implemented before the backup was taken, then the backup would also contain the erroneous program fix or its effects. Restoring from this backup would not correct the problem; it might reintroduce or perpetuate the error. A backup taken before the incorrect fix would be a better source.

B. The organization is preparing to train all employees on the new self-service benefits system
– Training employees on a new system requires current, accurate, and complete data as well as training materials, not a backup of the HR database. A backup is not the appropriate source for training purposes, and using a backup could present outdated information.

D. There is a need to access prior year-end training reports for all employees in the human resources database
– Accessing prior year-end training reports requires historical data from a specific past period, not the most recent backup. The most recent backup would reflect current data, not prior year-end data, so it would not be the best source for this purpose.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically backup and recovery, disaster recovery planning, and data restoration.

Explanation:

In a bring-your-own-device (BYOD) environment, employees use their personally owned devices — smartphones, tablets, laptops — to access organizational data, applications, and networks. Because the organization does not own or fully control these devices, it has less ability to enforce technical controls directly on them. As a result, the organization must rely more heavily on users to voluntarily comply with established policies and procedures, such as acceptable use policies, security requirements (e.g., passwords, encryption, patching), and restrictions on downloading certain applications or accessing sensitive data. This increased dependence on user compliance is a defining characteristic and challenge of BYOD environments, making this statement true.

Why the other options are incorrect:

B. With fewer devices owned by the organization, there is reduced need to maintain documented policies and procedures – This is incorrect. A BYOD environment actually increases the need for well-documented policies and procedures because the organization must clearly define what is acceptable on personal devices, how organizational data must be protected, what happens when an employee leaves, and how incidents are handled. Fewer organization-owned devices does not reduce the need for governance; it increases the need for clear rules covering personally owned devices.

C. Incident response times are less critical in the BYOD environment, compared to a traditional environment – This is incorrect. Incident response times are equally, if not more, critical in a BYOD environment. Because personal devices may be outside the organization's direct control and may connect to unsecured networks, security incidents can spread quickly and be harder to contain. Rapid detection and response are essential to limit damage.

D. Incident response times are less critical in the BYOD environment, compared to a traditional environment – This is a duplication of option C and is likewise incorrect. Incident response remains highly critical in BYOD environments, and organizations must have robust incident response plans that account for personally owned devices.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically mobile device management, BYOD risks, and IT security policies.

Explanation:

When the head of R&D hires more experienced researchers, two things are likely to happen. First, experienced researchers typically command higher pay rates than less experienced staff, which means the actual labor rate paid will exceed the standard labor rate. This results in an adverse (unfavorable) labor rate variance  — option 2. Second, experienced researchers are generally more efficient, skilled, and productive, so they should complete the work in fewer hours than the standard allows. This results in a  favorable labor efficiency variance  — option 1. Therefore, the likely variances are a favorable labor efficiency variance and an adverse labor rate variance, which corresponds to answer choice A (1 and 2).

Why the other options are incorrect:

B. 1 and 4
– This combination pairs a favorable labor efficiency variance (1) with a favorable labor rate variance (4). A favorable labor rate variance would mean the actual rate paid was lower than the standard rate, which is unlikely when hiring more experienced and higher-paid researchers. Hiring experienced staff typically increases the labor rate, producing an adverse — not favorable — rate variance, so option 4 is incorrect.

C. 3 and A
– This option is not a valid answer choice; "A" is not a numbered variance, and option 3 (adverse labor efficiency variance) would suggest the experienced researchers were less efficient than standard, which contradicts the expectation that experienced researchers improve efficiency. This combination is not appropriate.

D. 2 and 3
– This combination pairs an adverse labor rate variance (2) with an adverse labor efficiency variance (3). While the adverse labor rate variance is likely correct, the adverse labor efficiency variance is not. Experienced researchers should improve efficiency, producing a favorable efficiency variance, not an adverse one. Therefore, option 3 is incorrect.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — specifically standard costing, variance analysis, and labor rate and efficiency variances.

Explanation:

When ending inventory is understated in one year, it creates a self-correcting error that reverses in the following year. Ending inventory of the current year becomes the beginning inventory of the next year. If ending inventory was understated, then beginning inventory for the following year will also be understated. Since cost of goods sold is calculated as Beginning Inventory + Purchases − Ending Inventory, an understated beginning inventory reduces cost of goods sold in the following year. A lower cost of goods sold means lower expenses, which causes net income to be overstated in the following year. This is why the error in one period reverses in the next period.

Why the other options are incorrect:

A. Net income would be understated
– This would be the effect in the year the error occurred, not the following year. In the year the ending inventory was understated, cost of goods sold would be overstated, causing net income to be understated. However, the question asks about the following year, where the effect reverses and net income is overstated.

B. Net income would not be affected
– This is incorrect. Inventory errors affect two consecutive periods. The error in ending inventory affects the current year's cost of goods sold and net income, and it also affects the following year's beginning inventory, cost of goods sold, and net income. The effect does not simply disappear.

D. Net income would be negative
– There is no basis in the information provided to conclude that net income would be negative. An understated ending inventory in one year leading to overstated net income in the following year does not necessarily mean the organization would report a net loss. The direction of the error is toward overstatement, not toward a loss.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — specifically inventory valuation, cost of goods sold, and the effect of inventory errors on the income statement.