Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 23

Explanation:

Income statement accounts (also called temporary or nominal accounts) must be closed at the end of each accounting period. These accounts include revenues, expenses, gains, and losses. At the end of the period, their balances are transferred to a summary account (such as Income Summary) and ultimately to retained earnings (or owner's equity). Closing these accounts resets their balances to zero so they can accumulate activity for the next period. This process is known as the closing process, and it applies specifically to income statement accounts because they measure activity for a period rather than a point in time.

Why the other options are incorrect:

B. Balance sheet accounts
– Balance sheet accounts (assets, liabilities, and equity) are permanent accounts and are not closed at the end of the period. Their balances carry forward from one period to the next because they represent the organization's financial position at a point in time, which is cumulative.

C. Permanent accounts
– Permanent accounts (also called real accounts) are balance sheet accounts whose balances are carried forward indefinitely. They are not closed at the end of the period; only temporary (income statement) accounts are closed.

D. Real accounts
– Real accounts are another term for permanent accounts (balance sheet accounts). Like permanent accounts, they are not closed at the end of the period. Their balances continue into the next period, so this option is incorrect.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — specifically the accounting cycle, closing process, and the distinction between temporary and permanent accounts.

Explanation:

To give the organization the best chance of recovering data, backups must be both secure and available in the event of a disaster. This option achieves that by (1) storing encrypted physical copies of the data, which protects confidentiality; (2) storing the encryption keys separately from the data, so that if the data is compromised or the storage location is breached, the data cannot be decrypted without the separately held keys; and (3) keeping both the data and the keys in secure offsite locations a few hours away, so that a disaster at the primary site (e.g., fire, flood, or physical destruction) does not destroy both the data and the keys. Separating the data from the keys and placing both offsite balances security and recoverability, making this the best option for ensuring data can be recovered.

Why the other options are incorrect:

A. Encrypted physical copies of the data, and their encryption keys are stored together at the organization and are readily available upon request
– Storing the encryption keys together with the encrypted data defeats much of the purpose of encryption, because anyone who gains access to the storage location can also access the keys and decrypt the data. In addition, keeping both at the organization means a disaster at the primary site could destroy both the data and the keys, making recovery impossible.

C. Encrypted reports on usage and database structure changes are stored on a cloud-based, secured database that is readily accessible
– This option only stores reports on usage and database structure changes, not the actual data itself. Without the full data, the organization cannot fully recover its operations. Storing only reports and metadata does not provide the best chance of recovering data.

D. Encrypted copies of the data are stored in a separate secure location a few hours away, while the encryption keys are stored at the organization and are readily available
– While the encrypted data is stored offsite, the encryption keys remain at the organization. If a disaster destroys the organization's primary site, the keys could be lost along with it, making the offsite encrypted data undecryptable and therefore useless for recovery. The keys must be protected and available separately from the primary site.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically backup and recovery, data protection, encryption key management, and offsite storage.

Explanation:

According to IIA guidance on IT, access control is about ensuring that users can access only the data and functions they need to perform their job responsibilities, based on the principle of least privilege and need-to-know. Setting data availability by user need means defining and restricting access rights so that each user can only reach the data and system functions required for their role. This is the essence of effective access control. In an automated point-of-sale (POS) system, this would mean, for example, that cashiers can process sales but cannot access pricing configuration, refund authorization, or management reports, while supervisors and managers have broader access appropriate to their duties. This approach directly controls who can access what within the POS system, making it the most effective access control strategy among the options.

Why the other options are incorrect:

A. Install and update anti-virus software
– Anti-virus software protects systems from malware infections. While important for overall security, it is not an access control strategy; it does not govern who can access the POS system or what data they can use. It addresses a different risk (malicious software) rather than controlling access.

B. Implement data encryption techniques
– Encryption protects the confidentiality of data by making it unreadable to unauthorized parties, both in storage and in transmission. While encryption is a valuable security control, it does not control who is authorized to access the system or what they can do once inside. It protects data from being understood if intercepted, not from being accessed by unauthorized users.

D. Upgrade firewall configuration
– A firewall controls network traffic entering and leaving the organization's network. While it helps prevent unauthorized external access, it does not govern internal user access rights within the POS system. It is a perimeter control, not an access control over the application and its data.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically access controls, the principle of least privilege, and need-to-know access in application systems.

Explanation:

Predictive analytics uses historical data, statistical models, and machine learning techniques to forecast future outcomes or identify the likelihood of future events. In this scenario, the hospital wants to determine which patients are likely to require readmission for additional treatment — that is, it wants to predict a future event based on patterns in existing data (such as patient history, diagnoses, treatment records, and demographics). This is a classic application of predictive analytics, which estimates the probability of future occurrences and helps organizations anticipate needs and allocate resources accordingly.

Why the other options are incorrect:

B. Prescriptive analytics
– Prescriptive analytics goes beyond prediction to recommend specific actions or decisions to achieve a desired outcome. It answers the question "What should we do about it?" While prescriptive analytics may build on predictive models, the question asks about determining which patients are likely to require readmission, which is a prediction of likelihood, not a recommendation for action. Therefore, predictive analytics is the more accurate answer.

C. Descriptive analytics
– Descriptive analytics summarizes and describes what has already happened, using historical data to provide insights into past performance or trends (e.g., how many patients were readmitted last year). It does not forecast future events or identify which patients are likely to require readmission, so it is not the correct technique here.

D. Diagnostic analytics
– Diagnostic analytics examines past data to understand why something happened — it focuses on identifying causes and relationships (e.g., why readmission rates increased). It is explanatory rather than predictive, so it does not determine which patients are likely to require additional treatment in the future.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics— specifically types of data analytics, including descriptive, diagnostic, predictive, and prescriptive analytics.

Explanation

In this scenario, the employee's smart card continued to be used to access her former building after she was promoted and relocated. This indicates that her old access rights were not removed or updated when her role changed. A regular review of access logs would help detect this type of issue because it would reveal that the smart card was still being used at the previous building, prompting corrective action such as deactivating the old access rights. Log reviews are a detective control that identifies unauthorized or inappropriate access, enabling security personnel to investigate and remediate the situation. While log review alone does not automatically prevent the access, it is the control that would most directly detect and lead to prevention of this incident.

Why the other options are incorrect:

B. Two-level authentication

– Two-level authentication, such as something you have plus something you know, strengthens authentication at the point of entry, but in this scenario, the smart card was legitimately issued to the employee. If the employee, or someone else using her card, also had the second authentication factor, two-level authentication would not prevent access. The problem is not weak authentication at the door; it is that the employee's access rights to the old building were never updated or revoked.

C. Photos on smart cards
– Photos on smart cards help security personnel visually verify that the person using the card is the legitimate cardholder. However, this control depends on someone physically inspecting the card and the person at the point of entry. If the card is used at an unattended reader or if no one checks the photo, it would not prevent the access. It also does not address the underlying issue of outdated access rights.

D. Restriction of access hours
– Restricting access hours limits when a card can be used, but it does not prevent a former occupant from using the card during allowed hours. Since the access occurred at the previous building during presumably normal hours, access-hour restrictions would not have prevented this incident.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically physical access controls, access rights management, and monitoring controls.

Explanation

Inventory fraud schemes typically involve manipulating inventory records to conceal theft, misappropriation, or false reporting. Common inventory frauds include stealing inventory and covering it up with fictitious adjustments, write-offs, or shrinkages recorded against inventory records. Analyzing the stratification of inventory adjustments by warehouse location is an effective detection technique because it breaks down inventory adjustments, such as write-offs, shrinkage, and count variances, by location and value ranges, allowing the auditor to identify unusual patterns or concentrations. For example, if one warehouse consistently shows disproportionately large or frequent adjustments compared to others, this could indicate that inventory is being stolen and masked through adjustments at that location. This technique helps isolate anomalies that might signal fraud.

Why the other options are incorrect:

A. Analyze invoice payments just under individual authorization limits
– This technique is designed to detect fraud in the procurement or accounts payable process, where an employee splits invoices or keeps amounts just below approval thresholds to avoid scrutiny. It relates to payment authorization fraud, not inventory fraud. It would not effectively detect manipulation of inventory records or physical inventory theft.

C. Analyze inventory invoice amounts and compare with approved contract amounts
– This technique compares invoice amounts to contract terms to detect overbilling or pricing discrepancies in purchases. While useful for detecting procurement fraud or billing errors, it focuses on the purchasing and invoicing process rather than on inventory adjustments or physical inventory discrepancies. It would not be the best technique for detecting an inventory fraud scheme.

D. Analyze differences discovered during duplicate payment testing
– Duplicate payment testing identifies instances where the same invoice has been paid more than once. This is a technique for detecting accounts payable fraud or errors, not inventory fraud. It does not address inventory records, adjustments, or physical inventory counts, so it would not effectively detect an inventory fraud scheme.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics and Fraud Detection — Specifically inventory fraud schemes and analytical techniques used to detect them.

Explanation

When senior management establishes new IT guidelines and cybersecurity policies, it must consider emerging trends and changes in how technology is used across the organization. The growing use of bring-your-own-device (BYOD) arrangements, where employees use personally owned devices for organizational matters, is a significant cybersecurity concern that directly affects policy design. BYOD introduces risks related to data leakage, unsecured devices, mixing of personal and organizational data, loss or theft of devices, and difficulty enforcing security controls on devices the organization does not own. As BYOD use grows, senior management must update cybersecurity policies to address device approval, mobile device management, encryption, access controls, acceptable use, and incident response for personally owned devices. This makes the growing use of BYOD a key consideration for new IT guidelines and cybersecurity policies.

Why the other options are incorrect:

A. Assigning new roles and responsibilities for senior IT management – While assigning roles and responsibilities is an important governance activity, it is an internal organizational decision rather than an external or emerging trend that would drive the need for new cybersecurity guidelines. It is a consequence of policy decisions, not a trigger for reconsidering cybersecurity policies.

C. Expansion of operations into new markets with limited IT access – Expanding into new markets may raise IT and security considerations, but this is a strategic business decision that may or may not occur. It is not a general trend that senior management would necessarily need to address as part of new IT guidelines for cybersecurity policy, and it is phrased conditionally, "with limited IT access," making it less directly relevant than BYOD.

D. Hiring new personnel within the IT department for security purposes – Hiring additional IT security personnel is a resource and staffing decision, not a policy consideration that would shape new cybersecurity guidelines. It addresses capacity rather than the content and scope of the policies themselves, so it is not the best answer.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically cybersecurity governance, IT policy development, and emerging technology risks including BYOD.

Explanation

In data backup procedures, the tape rotation schedule determines how backup media are cycled through use and how long each backup is retained before being overwritten or retired. For example, a rotation schedule may specify daily, weekly, monthly, and annual backups, with media being reused according to a defined cycle. The rotation schedule therefore directly affects the retention period of backed-up data, meaning how far back the organization can restore data if needed. This makes option C a true statement about data backup.

Why the other options are incorrect:

A. System backups should always be performed real time
– Not all backups need to be performed in real time. The frequency of backups depends on the criticality of the data, the cost of backup, and the acceptable recovery point objective (RPO). Some systems may use real-time replication, while others may use daily, weekly, or monthly backups. Stating that backups should "always" be performed in real time is inaccurate and impractical for many organizations.

B. Backups should be stored in a secured location onsite for easy access
– Storing backups only onsite is not recommended because a disaster at the primary site, such as fire, flood, or theft, could destroy both the original data and the onsite backups. Best practice requires that backups be stored offsite in a secure location, and often a copy is retained onsite for operational convenience. Therefore, this statement is not true as written.

D. Backup media should be restored only in case of a hardware or software failure
– Backups are used for many purposes beyond hardware or software failure, including recovering from data corruption, accidental deletion, cyberattacks such as ransomware, human error, and disaster recovery. Restricting restoration to hardware or software failure only is incorrect and understates the purpose of backups.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically data backup, backup rotation schedules, retention, and disaster recovery planning.

GTAG (Global Technology Audit Guide) — Business Continuity Management and IT Essentials for Internal Auditors (IIA), which discusses backup procedures, rotation schedules and their effect on data retention, the importance of offsite storage, and the varied purposes for which backups are restored.

Explanation

A flatter organizational structure removes layers of management and widens spans of control, meaning fewer managers and supervisors are needed between senior executives and front-line employees. Because administrative and managerial overhead is reduced, a flatter structure is typically expected to lower costs. Fewer management layers mean less spending on managerial salaries, benefits, and related administrative overhead, and it also tends to streamline communication and reduce bureaucratic inefficiency. This makes lower costs the expected change when an organization reorganizes into a flatter structure.

Why the other options are incorrect:

B. Slower decision making at the senior executive level
– A flatter structure typically speeds up decision-making, not slows it down. With fewer layers of management, information travels more quickly between senior executives and lower levels, and decisions can be made and communicated faster. Slower decision-making is more characteristic of tall, hierarchical structures.

C. Limited creative freedom in lower-level managers
– A flatter structure generally gives lower-level managers more autonomy, responsibility, and decision-making authority, not less. With fewer layers of supervision, lower-level managers often have greater creative freedom and discretion in how they perform their work. Limited creative freedom is more typical of tall, rigid hierarchies.

D. Senior-level executives more focused on short-term, routine decision making
– In a flatter structure, senior executives typically focus on strategic, long-term decisions, while operational and routine decisions are delegated to lower levels. A flatter structure pushes decision-making down, so senior executives are less involved in routine, short-term decisions, not more. This statement describes the opposite of what a flatter structure would produce.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically organizational structures, span of control, and the characteristics of flat versus tall structures.

Standard organizational theory — Flat structures have fewer hierarchical levels and wider spans of control, which reduce administrative overhead and costs, speed up decision-making, and delegate authority to lower levels, in contrast to tall structures.

Explanation

The help desk function is typically responsible for providing frontline support to users, resolving incidents, answering questions, and handling service requests related to IT systems and applications. This includes maintenance service items such as production support, assisting users with problems in production systems, troubleshooting issues, logging and escalating incidents, and coordinating routine maintenance and support activities. The help desk serves as the central point of contact between users and IT services, and its responsibilities are centered on user support and incident resolution rather than on managing infrastructure, hosting hardware, or designing security architecture.

Why the other options are incorrect:

B. Management of infrastructure services, including network management
– Managing infrastructure services such as networks, servers, and storage is typically the responsibility of the IT infrastructure or operations group, not the help desk. The help desk supports users, while infrastructure management involves the design, implementation, and maintenance of the underlying technical environment.

C. Physical hosting of mainframes and distributed servers
– Physically hosting mainframes and distributed servers is a data center operations responsibility, involving facilities, hardware, power, cooling, and physical security. This is not a help desk function, which focuses on end-user support rather than physical hosting of equipment.

D. End-to-end security architecture design
– Designing the organization's end-to-end security architecture is the responsibility of the information security function, such as the chief information security officer and security architects. The help desk does not design security architecture; it may enforce certain security procedures at the user support level, but architecture design is outside its scope.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically IT service management, help desk functions, and the division of responsibilities within IT.