Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 21

Explanation

When the CAE is asked to evaluate whether a proposal, such as outsourcing key IT functions, aligns with the organization's strategy, the most appropriate first action is to understand the strategic context and evaluate whether the supporting information is reliable and complete. To assess strategic alignment, the CAE must first understand the organization's overall strategy, objectives, and priorities, and then determine whether the proposal supports those objectives. This requires evaluating the information provided by the chief technology officer to ensure it is accurate, complete, and reliable, so the CAE can form a sound judgment about whether the outsourcing proposal truly aligns with the organization's strategic direction. This is the foundational step for any evaluation of strategic alignment.

Why the other options are incorrect:

B. Ascertain whether governance and approval processes are transparent, documented, and completed
– While governance and approval processes are important, this action focuses on whether the proposal followed proper procedures rather than on whether it aligns with the organization's strategy. It addresses process compliance, not strategic fit, so it is not the most appropriate action for determining strategic alignment.

C. Perform a due diligence review or assess management's review of provider operations
– Due diligence on provider operations is relevant to evaluating the outsourcing arrangement's feasibility, risks, and provider capabilities. However, it does not directly address whether the proposal aligns with the organization's strategy. Due diligence is a subsequent step once strategic alignment and the decision to consider outsourcing have been established.

D. Identify key performance measures and data sources
– Identifying key performance measures and data sources is important for monitoring and evaluating the outsourcing arrangement after it is implemented. It does not address the initial question of whether the proposal aligns with the organization's strategy, so it is not the most appropriate action at this stage.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Strategic Management and Governance — Specifically strategic alignment, the CAE's role in evaluating strategic initiatives, and the importance of understanding strategic context and reliable information.

Explanation

An  incremental backup  copies only the data that has changed since the  last backup of any type , whether full or incremental. In a busy production database environment, performing daily incremental backups is the most time- and storage-efficient methodology because it processes the smallest volume of data during each backup window. This minimizes bandwidth consumption, limits system overhead, and significantly shortens the required backup window.

Why the Incorrect Options Fail

A. Disk mirroring of the data being stored on the database is incorrect – Disk mirroring, such as RAID 1, provides fault tolerance and real-time redundancy, not a backup methodology. If data is corrupted, deleted, or infected with malware on the primary drive, the mirrored drive immediately replicates the corruption, providing no protection against logical data loss.

B. A differential backup that is performed on a weekly basis is incorrect – A differential backup copies all changes made since the  last full backup . As the week progresses, the amount of data backed up grows larger, making it less storage- and time-efficient than daily incremental backups. A weekly schedule can also create a large  Recovery Point Objective (RPO)  exposure window, potentially resulting in significant data loss if a failure occurs before the next backup.

C. An array of independent disks used to back up the database is incorrect –  Redundant Array of Independent Disks (RAID) is a hardware storage architecture designed primarily for system availability, fault tolerance, and performance. It is not a discrete backup strategy because changes, corruption, or deletions can be replicated across the array.

Reference:

IIA CIA Exam Syllabus: Part 3, Section IV – Information Technology & Business Continuity — Specifically backup strategies, recovery metrics such as RTO/RPO, and storage controls.

Explanation

To verify that none of an organization's employees are receiving fraudulent invoice payments, an internal auditor would need to compare data from different sources, such as the employee master file (names, addresses, bank account details, and tax identification numbers) against the vendor master file and invoice payment records. By joining different data sources, the auditor can identify matches or relationships that should not exist, such as an employee's bank account or address appearing in the vendor payment file. This could indicate a fraudulent invoice payment scheme, such as a fictitious vendor created by an employee. Data joining is the analytical technique that enables this cross-referencing and is therefore the most appropriate technique for detecting this type of fraud.

Why the other options are incorrect:

A. Perform gap testing
– Gap testing is used to identify missing items in a sequence, such as missing check numbers, invoice numbers, or purchase order numbers, to detect unrecorded or missing transactions. While useful for detecting certain types of errors or fraud, it does not directly compare employee data with vendor payment data, so it would not effectively identify employees receiving fraudulent invoice payments.

C. Perform duplicate testing
– Duplicate testing identifies duplicate payments or duplicate entries in a data set, such as the same invoice being paid twice. While this can detect some fraudulent payments, it does not specifically compare employee information against vendor payment records, so it would not reliably identify employees who are receiving fraudulent invoice payments through fictitious vendors.

D. Calculate statistical parameters
– Calculating statistical parameters, such as means, standard deviations, and trends, is useful for identifying anomalies, outliers, or unusual patterns in data. While this can support fraud detection, it does not directly compare employee and vendor data to identify improper relationships, so it is not the most appropriate technique for this specific objective.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically data analytics techniques used in audit engagements, including data joining, gap testing, duplicate testing, and statistical analysis.

Explanation

A trademark is an intangible asset that can have an indefinite useful life because it can be renewed indefinitely, as long as the owner continues to use it and pays the required renewal fees. Trademarks identify and distinguish goods or services and can retain their value for an indefinite period. Under accounting standards, intangible assets with indefinite useful lives are not amortized but are tested for impairment at least annually. Because a trademark can legally be renewed without a foreseeable limit, it is considered to have an indefinite life, making it the correct answer.

Why the other options are incorrect:

A. Underground oil deposits
– Underground oil deposits are natural resources (wasting assets) that are physically consumed as they are extracted. They have a finite, depletable life, and their cost is allocated through depletion. They are not intangible assets with indefinite lives.

B. Copyright
– A copyright has a finite legal life, such as the life of the author plus a specified number of years, or a set term for corporate works. It is an intangible asset with a definite useful life and is amortized over that period. It does not have an indefinite life.

D. Land
– Land is a tangible asset, not an intangible asset. While land generally has an indefinite life and is not depreciated, the question asks specifically about intangible assets, and land does not belong in that category.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically intangible assets, useful lives, and amortization versus impairment.

Explanation

Authentication is the process of verifying that a user is who they claim to be before granting access to systems, applications, or data. It answers the question, "Are you who you say you are?" A smart card is an authentication device. It is something the user possesses, a "something you have" factor, and requiring users to validate their identity with a smart card is a direct example of an authentication control. The smart card, often combined with a PIN or password, verifies the user's identity at the point of login, which is precisely what authentication controls are designed to do.

Why the other options are incorrect:

A. Identity requests are approved in two steps
– This describes an authorization or approval process for granting identities or access, not authentication. Approving identity requests relates to provisioning and authorization, deciding what a user is allowed to do, not to verifying identity at login.

B. Logs are checked for misaligned identities and access rights
– This describes a monitoring or review control, a detective control, that examines logs to identify inconsistencies between identities and access rights. It is not an authentication control, which operates at the point of access to verify identity.

D. Functions can be performed based on access rights
– This describes authorization, which determines what an authenticated user is permitted to do, including their access rights and permissions. Authorization occurs after authentication and defines the scope of access, not the verification of identity itself.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically authentication and authorization controls, identity and access management.

Explanation

In a bring-your-own-device (BYOD) environment, one of the key security features used to confirm that a legitimate employee is accessing organizational applications with their own smart device is to require that only organization-approved devices be used. This is typically implemented through mobile device management (MDM) or similar controls, where devices must be registered, inventoried, and approved by the organization before they are permitted to access organizational systems. Approved devices can be verified by unique device identifiers, certificates, or enrollment in MDM, which helps confirm that the device is authorized and meets security requirements, such as encryption, patching, and screen lock. This gives the organization assurance that access is coming from a legitimate, sanctioned device belonging to an authorized employee.

Why the other options are incorrect:

A. Using a jailbroken or rooted smart device feature
– Jailbreaking or rooting a device removes manufacturer and administrative restrictions, weakening security controls and increasing the risk of malware and unauthorized access. This is a security risk, not a security feature, and would not help verify a legitimate employee. It would undermine security.

C. Obtaining written assurance from the employee that security policies and procedures are followed
– Written assurance is a form of attestation and does not technically verify identity or secure the device. An employee could provide written assurance while still using a compromised or unauthorized device. It is not a technical security feature that identifies a legitimate employee using their own device.

D. Introducing a security question known only by the employee
– A security question is a knowledge-based authentication factor, but it is weak because answers can be guessed or researched, and it does not verify that the device itself is legitimate or authorized. It also does not address device-level security, which is the core concern in BYOD access.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically mobile device management (MDM), BYOD security, and authentication controls.

Explanation

The contracting process generally follows a sequence of phases: initiation, bidding (or solicitation), development, and management. During the development phase, the contract itself is drafted for the proposed business activity. This is the stage where the terms, conditions, scope of work, deliverables, pricing, performance requirements, and legal provisions are put into writing and refined through negotiation between the parties. The development phase follows the bidding or solicitation phase, where proposals or bids are obtained, and precedes the management phase, where the contract is administered and monitored. Drafting the contract is a core activity of the development phase, making it the correct answer.

Why the other options are incorrect:

A. Initiation phase
– The initiation phase is the earliest stage, where the need for a business activity or procurement is identified, requirements are defined, and the decision to proceed is made. Contracts are not drafted at this stage; the focus is on defining the need and obtaining authorization.

B. Bidding phase
– The bidding, or solicitation, phase involves requesting proposals or bids from potential vendors or contractors, evaluating responses, and selecting a preferred provider. While contract terms may be discussed, the actual drafting of the contract occurs in the subsequent development phase.

D. Management phase
– The management phase occurs after the contract has been awarded and signed. It involves administering the contract, monitoring performance, managing changes, and ensuring compliance with the agreed terms. Contract drafting has already been completed by this stage.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Procurement and Contract Management — Specifically the phases of the contracting process, including initiation, bidding, development, and management.

Explanation

When executive compensation is tied to the organization's financial results, executives have a strong personal financial incentive to achieve those results, sometimes at any cost. This can encourage behavior that is inconsistent with the interests of relevant stakeholders, such as shareholders, employees, customers, and the public. For example, executives may manipulate earnings, take excessive risks, cut corners on quality or safety, delay necessary investments, or engage in other short-term actions designed to boost reported financial results and increase their compensation. These actions may benefit executives personally in the short term while harming the long-term interests of stakeholders. This misalignment between executive incentives and stakeholder interests is a well-recognized governance risk, making this the most likely situation to arise.

Why the other options are incorrect:

A. The organization reports inappropriate estimates and accruals due to poor accounting controls
– While compensation tied to financial results can create incentives to manipulate estimates and accruals, the cause described here is poor accounting controls, not the compensation structure itself. The question asks what is most likely to arise from executive compensation being based on financial results, and the broader and more direct consequence is dysfunctional behavior inconsistent with stakeholder interests. Poor controls are a separate control weakness, not an inherent result of the compensation design.

B. The organization uses an unreliable process for gathering and reporting executive compensation data
– An unreliable process for gathering compensation data is an operational or control deficiency in the compensation system, not a likely consequence of tying compensation to financial results. The incentive structure itself does not cause the data-gathering process to become unreliable.

C. The organization experiences increasing discontent of employees, if executives are eligible for compensation amounts that are deemed unreasonable
– While employee discontent over perceived excessive executive pay is possible, it is conditional and not the most direct or likely result of linking compensation to financial results. The more fundamental risk is that executives will pursue financial results in ways that harm stakeholder interests, which is option D.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Governance and Executive Compensation — Specifically incentive structures, agency theory, and the alignment of executive interests with stakeholder interests.

Explanation

Vertical analysis is a financial statement analysis technique in which each line item on a financial statement is expressed as a percentage of a base figure within the same statement, typically revenue on the income statement or total assets on the balance sheet. In this scenario, the internal auditor expressed electricity and depreciation expenses as a percentage of revenue, 10% and 7% respectively, which is exactly how vertical analysis works on the income statement. By converting each expense to a percentage of revenue, the auditor can evaluate the relative size and composition of expenses and compare them across periods or against industry benchmarks, independent of changes in absolute dollar amounts.

Why the other options are incorrect:

A. Horizontal analysis
– Horizontal analysis compares financial statement line items across two or more periods to identify changes over time, such as year-over-year percentage changes in revenue or expenses. It focuses on trends over time, not on expressing individual line items as a percentage of a base figure within a single period, so it does not describe this calculation.

C. Ratio analysis
– Ratio analysis involves calculating financial ratios that express relationships between different financial statement items, such as the current ratio, debt-to-equity ratio, or return on assets. While expressing expenses as a percentage of revenue could loosely be considered a ratio, this specific technique, each line item as a percentage of a base figure within the same statement, is properly classified as vertical analysis, also called common-size analysis.

D. Trend analysis
– Trend analysis examines financial data over multiple periods to identify patterns, direction, and rates of change, such as revenue growth trends or expense trends. It looks at changes over time rather than expressing line items as percentages of a base within a single period, so it is not the technique used here.

Reference:

IIA-CIA-Part3 content area on Financial Management — Specifically financial statement analysis techniques, including vertical (common-size) analysis, horizontal analysis, ratio analysis, and trend analysis.

Explanation

A router is a networking device that connects different networks together, for example, connecting a local area network (LAN) to a wide area network (WAN) or the internet. Routers operate at Layer 3 (the network layer) of the OSI model and use IP addresses to determine the best path for forwarding data packets between networks. A switch, by contrast, connects devices within the same network, typically a LAN. Switches operate primarily at Layer 2 (the data link layer) and use MAC addresses to forward data frames to the correct device within the network. The essential distinction is that routers connect networks to each other, while switches connect devices within a single network. This makes option C the correct statement.

Why the other options are incorrect:

A. A router operates at layer two, while a switch operates at layer three of the open systems interconnection model
– This statement reverses the layers. A router operates primarily at Layer 3 (network layer) of the OSI model, while a switch operates primarily at Layer 2 (data link layer). The statement is therefore incorrect.

B. A router transmits data through frames, while a switch sends data through packets
– This statement also reverses the terminology. Routers forward data in the form of packets (Layer 3 protocol data units), while switches forward data in the form of frames (Layer 2 protocol data units). The statement is therefore incorrect.

D. A router uses a media access control address during the transmission of data, while a switch uses an internet protocol address
– This statement reverses the addressing mechanisms. Routers use IP addresses (Layer 3) to route packets between networks, while switches use MAC addresses (Layer 2) to forward frames within a network. The statement is therefore incorrect.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically network components, including routers, switches, and the OSI model.