Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 26

Explanation

Under absorption costing, also called full costing, all manufacturing costs, including direct materials, direct labor, and both variable and fixed manufacturing overhead, are treated as product costs. Fixed manufacturing overhead costs cannot be traced directly to individual units of product, so they are classified as indirect costs. Because they are manufacturing costs, they are also product costs, meaning they are attached to the product and flow through inventory until the product is sold. Therefore, fixed manufacturing overhead costs are classified as indirect product costs under absorption costing. They are allocated to units produced using a predetermined overhead rate and remain in inventory as part of the product's cost until the goods are sold, at which point they are expensed as part of cost of goods sold.

Why the other options are incorrect:

A. Direct, product costs
– Direct product costs are costs that can be traced directly to a unit of product, such as direct materials and direct labor. Fixed manufacturing overhead cannot be traced directly to individual units, so it is not a direct cost; it is an indirect cost.

C. Direct period costs
– Period costs are costs that are expensed in the period incurred and are not attached to the product, such as selling and administrative expenses. Fixed manufacturing overhead is not a period cost under absorption costing; it is a product cost. It also is not a direct cost because it cannot be traced directly to individual units.

D. Indirect period costs
– Indirect period costs are costs that are both indirect and expensed in the period incurred, such as indirect selling or administrative costs. Fixed manufacturing overhead is not a period cost under absorption costing; it is a product cost that is inventoried and expensed through cost of goods sold when the product is sold. While it is indirect, it is a product cost, not a period cost.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically absorption costing versus variable costing, product versus period costs, and cost classification.

Standard managerial accounting theory — Under absorption costing, fixed manufacturing overhead is treated as an indirect product cost and allocated to units produced, whereas under variable costing it is treated as a period cost and expensed in the period incurred.

Explanation

Under International Financial Reporting Standards (IFRS), the basis for consolidation is control . IFRS 10 (Consolidated Financial Statements) defines control as the power to govern the financial and operating policies of an entity so as to obtain benefits from its activities. An investor controls an investee when it has (1) power over the investee, (2) exposure or rights to variable returns from its involvement with the investee, and (3) the ability to use its power over the investee to affect the amount of the investor's returns. When control exists, the parent must consolidate the subsidiary's financial statements. This control-based model is the foundation for consolidation under IFRS, making control ownership the correct answer.

Why the other options are incorrect:

A. Variable entity approach – "Variable entity approach" is not the IFRS basis for consolidation. IFRS does address variable interests through the concept of a variable interest entity (VIE) under US GAAP (ASC 810), but the IFRS framework is built on the control model, not a variable entity approach. The term as stated does not represent the IFRS consolidation basis.

C. Risk and reward – Risk and reward is a concept associated with accounting for leases and certain financial instruments, as well as with the older "risks and rewards" model for consolidation. However, under current IFRS (IFRS 10), the basis for consolidation is control, not risk and reward. Risk and reward is not the primary basis for consolidation under IFRS.

D. Voting interest – Voting interest is a US GAAP concept historically used to determine consolidation, such as majority voting interest, usually over 50 percent of voting shares. While voting rights are often an indicator of control, IFRS does not use a purely voting-interest-based model; it uses the broader control model, which can apply even without majority voting interest. Therefore, voting interest alone does not represent the IFRS basis for consolidation.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically consolidation, control, and international financial reporting standards.

Standard financial accounting principles (IFRS 10 — Consolidated Financial Statements) — Consolidation is based on the concept of control, defined through power over the investee, exposure or rights to variable returns, and the ability to use power to affect those returns, rather than solely on voting interest or a risk-and-reward model.

Explanation

Integrity controls are application controls designed to monitor data being processed to ensure that it remains consistent, accurate, and complete throughout processing. They help detect and prevent errors, unauthorized changes, or corruption of data during processing. Examples include control totals, hash totals, record counts, check digits, and reconciliation routines that verify data integrity as it moves through the system. Because their purpose is to ensure data remains consistent and accurate during processing, integrity controls are the correct answer.

Why the other options are incorrect:

A. Management trail controls
– Management trail controls, also called audit trail controls, are designed to provide a record of transactions and activities so that processing can be traced and reviewed. While they support accountability and oversight, their primary purpose is to create a traceable history of activity, not to monitor data processing for consistency and accuracy in real time.

B. Output controls
– Output controls are designed to ensure the accuracy, completeness, and validity of the results produced by the system, such as reports and output files. They focus on the final results of processing rather than monitoring data during processing to maintain its consistency and accuracy.

D. Input controls
– Input controls are designed to ensure that data entered into the system is accurate, complete, authorized, and valid at the point of entry. They govern the quality of data going into the system, not the monitoring of data during processing to ensure it remains consistent and accurate.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically application controls, including input, processing (integrity), and output controls.

GTAG (Global Technology Audit Guide) — Auditing IT Controls and IT Essentials for Internal Auditors (IIA), which categorizes application controls into input controls (data entry accuracy), processing/integrity controls (ensuring data remains consistent and accurate during processing), and output controls (validating results), and describes integrity controls as those that monitor data during processing to ensure consistency and accuracy.

Explanation

The high-low method is a cost estimation technique used to separate mixed costs into their fixed and variable components. The method involves taking the highest and lowest activity levels and their associated total costs, then computing the difference between the high and low total costs and dividing by the difference in activity levels. The resulting amount represents the variable cost per unit of activity , that is, the variable cost component of the mixed cost. By computing the difference between the high and low levels of maintenance costs, the clerk determined the variable maintenance cost per unit of activity, making variable maintenance costs the correct answer.

Why the other options are incorrect:

A. Fixed maintenance costs
– Under the high-low method, fixed costs are determined after the variable cost per unit is calculated. Fixed costs are found by subtracting the total variable cost at either the high or low activity level from the total cost at that level. The difference between the high and low total costs does not directly yield fixed costs; it yields the variable costs.

C. Mixed maintenance costs
– Mixed, or semivariable, costs contain both a fixed and a variable component. The high-low method is used to separate a mixed cost into its fixed and variable elements, but the specific computation described, the difference between high and low total costs, determines the variable portion, not the mixed cost as a whole.

D. Indirect maintenance costs
– Indirect costs are costs that cannot be traced directly to a cost object. The high-low method is concerned with cost behavior, specifically fixed versus variable, not with whether costs are direct or indirect. Therefore, indirect maintenance costs are not what the clerk determined by applying the high-low method.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically cost behavior, mixed costs, and the high-low method of cost estimation.

Standard managerial accounting theory — The high-low method separates mixed costs into fixed and variable components, where the difference between total costs at high and low activity levels divided by the difference in activity levels yields the variable cost per unit.

Explanation

Electronic data interchange (EDI) is the electronic exchange of business documents, such as purchase orders, invoices, and shipping notices, between organizations in a standardized format. EDI's greatest benefit is realized in environments that require speed, accuracy, and tight coordination between trading partners. A just-in-time (JIT) purchasing environment depends on frequent, timely, and highly accurate communication of purchase orders and delivery schedules to ensure that materials arrive exactly when needed and inventory levels remain low. EDI directly supports JIT by enabling rapid, error-free transmission of purchasing documents, reducing lead times, minimizing manual processing, and synchronizing supplier deliveries with production schedules. This makes JIT the scenario that gains the greatest benefit from EDI.

Why the other options are incorrect:

B. A large volume of custom purchases
– Custom purchases often involve unique specifications, negotiations, and nonstandard terms, which may not lend themselves to standardized EDI transactions. While EDI can still be used, the benefit is reduced because custom purchases are less repetitive and standardized, requiring more manual handling and customization.

C. A variable volume sensitive to material cost
– Purchasing volume that varies with material cost sensitivity is primarily a pricing and cost management issue. While EDI can improve efficiency, the greatest benefit of EDI is not specifically tied to cost-sensitive volume variability. EDI's core advantage is speed, accuracy, and coordination of standardized transactions, which is most critical in JIT environments.

D. A currently inefficient purchasing process
– While EDI can improve an inefficient purchasing process, the greatest benefit of EDI is realized where timing and coordination are critical, such as in JIT environments. An inefficient process may benefit from many types of improvements, such as process reengineering or automation, but EDI's specific strengths, rapid, standardized, error-free document exchange, are most valuable in JIT purchasing, where timing and accuracy are essential.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically electronic data interchange (EDI), e-commerce, and supply chain management.

GTAG (Global Technology Audit Guide) — IT Essentials for Internal Auditors and related IIA guidance, which describes EDI as a technology that enables fast, accurate, standardized exchange of business documents between trading partners and notes that EDI provides significant benefits in environments requiring tight coordination and timely delivery, such as just-in-time purchasing.

Explanation

Among the application controls listed, password selection is the most dependent on the password owner. Password selection refers to the process by which the user chooses their own password. Because the user creates and controls the password, its strength, uniqueness, and confidentiality depend heavily on the user's choices and behavior, for example, whether they choose a strong password, avoid using personal information, and refrain from sharing it. Other password controls, such as password aging, lockout, and rotation, are enforced by the system regardless of the user's choices. Password selection, however, relies directly on the password owner to make appropriate decisions, making it the control most dependent on the password owner.

Why the other options are incorrect:

B. Password aging
– Password aging is a system-enforced control that requires users to change their passwords after a specified period. It is applied automatically by the system, so it does not depend on the password owner's decisions; the system enforces the requirement regardless of user preferences.

C. Password lockout
– Password lockout is a system-enforced control that disables an account after a specified number of failed login attempts. It is implemented and enforced by the system, not by the password owner, so it does not depend on the user's actions beyond entering incorrect passwords.

D. Password rotation
– Password rotation is the practice of periodically changing passwords, often enforced by system policy. Like password aging, it is system-enforced and does not rely on the password owner's discretion. The system mandates the rotation regardless of the user's preferences.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically authentication controls, password management, and access controls.

GTAG (Global Technology Audit Guide) — Identity and Access Management (IIA), which discusses password controls including password selection, which is user-chosen and dependent on user behavior, and password aging, password lockout, and password rotation, which are primarily system-enforced controls. Password selection is therefore the control most dependent on the password owner's choices and behavior.

Explanation

A firewall is a preventive control. It is designed to stop unauthorized access, malicious traffic, and other security threats before they reach the organization's internal network or systems. By filtering incoming and outgoing data packets based on predefined security rules, a firewall prevents unauthorized users and harmful traffic from entering the network in the first place. Because its primary function is to block or deny unwanted activity before it occurs, a firewall provides preventive control, making option C the correct answer.

Why the other options are incorrect:

A. Corrective – Corrective controls are designed to restore systems, data, or operations after a security incident or problem has occurred (e.g., backups, disaster recovery, patch management). A firewall does not correct or remediate incidents after they happen; it prevents them from occurring, so it is not a corrective control.

B. Detective – Detective controls are designed to identify or discover security incidents, errors, or irregularities after they have occurred or while they are occurring (e.g., log monitoring, intrusion detection systems, variance analysis). A firewall primarily blocks traffic rather than detecting and reporting incidents, so it is not classified as a detective control.

D. Discretionary – "Discretionary" describes a type of access control (discretionary access control, or DAC) where the owner of a resource decides who may access it, rather than a category of control function (preventive, detective, corrective). A firewall is not described as a discretionary control in terms of its control function; it is a preventive control.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically information security controls, including preventive, detective, and corrective controls, and network perimeter protection.

GTAG (Global Technology Audit Guide) — Information Security Governance and IT Essentials for Internal Auditors (IIA), which categorizes controls by function (preventive, detective, corrective) and identifies firewalls as preventive controls that block unauthorized traffic before it reaches the internal network.

Explanation

User-developed applications (UDAs), such as spreadsheets, small databases, and ad hoc query tools created by end users, are typically developed by users outside the formal IT development process. As a result, UDAs are often built with little consideration of controls, documentation, testing, or security. Users focus on getting the immediate task done rather than on establishing proper change control, access controls, input validation, error handling, or segregation of duties. In contrast, traditional IT applications are developed through a formal systems development life cycle (SDLC) that includes requirements analysis, design, testing, controls, and documentation. This difference, that UDAs are typically developed with little consideration of controls, makes option C the true statement.

Why the other options are incorrect:

A. UDAs and traditional IT applications typically follow a similar development life cycle – This is incorrect. UDAs are generally developed quickly and informally by users, without following a formal SDLC. Traditional IT applications, by contrast, follow a structured development life cycle with defined phases, approvals, testing, and documentation. Their development approaches are fundamentally different.

B. A UDA usually includes system documentation to illustrate its functions, and IT-developed applications typically do not require such documentation – This is incorrect and reverses the reality. Traditional IT-developed applications typically include extensive system documentation, such as design documents, user manuals, and technical specifications, while UDAs often lack formal documentation because they are developed informally by users for their own use.

D. IT testing personnel usually review both types of applications thoroughly to ensure they were developed properly – This is incorrect. Traditional IT applications are typically reviewed and tested by IT testing personnel and quality assurance teams. UDAs, however, are usually not subject to the same rigorous IT testing and review; they are often used without independent testing or review, which is a significant risk associated with UDAs.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically user-developed applications (UDAs), application controls, and the systems development life cycle.

GTAG (Global Technology Audit Guide) — Auditing User-Developed Applications (IIA), which describes UDAs as applications developed by end users outside the formal IT development process, often with little consideration of controls, documentation, or testing, in contrast to traditional IT applications developed under a formal SDLC.

Explanation

In project management, once a project is authorized and a formalized project management plan is being developed, one of the first steps is to define and break down the project scope into manageable components. This is accomplished through scope definition and the creation of a work breakdown structure (WBS), which decomposes the total project into smaller, more manageable deliverables and work packages. Breaking the project into manageable components is essential because it provides the foundation for all subsequent planning activities, including estimating time and cost, identifying resources, assigning responsibilities, identifying risks, and developing schedules. Without this decomposition, it is difficult to accurately estimate time, resources, or risks. Therefore, breaking the project into manageable components should be the first step in the project management plan.

Why the other options are incorrect:

A. Estimate time required to complete the whole project
– Estimating the time required for the entire project is a subsequent planning activity. Accurate time estimates depend on knowing the individual tasks and work packages, which come from breaking the project into manageable components. Time estimation cannot be done effectively before the project is decomposed.

B. Determine the responses to expected project risks
– Risk response planning comes after risk identification and analysis, which in turn depend on understanding the project scope and its components. Risk response planning is a later step in the project management plan, not the first.

D. Identify resources needed to complete the project
– Identifying resources is also a subsequent activity that depends on knowing what work needs to be done. Resource identification follows the decomposition of the project into manageable components, because you must first know the tasks before you can determine the resources required to perform them.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Project Management — Specifically project planning, scope definition, and the work breakdown structure.

Explanation

External connections are the IT layer through which an organization's systems and networks communicate with outside parties, such as vendors, customers, business partners, and other external networks. Because external connections link the organization's internal environment to outside entities, they represent a significant security and operational risk. Maintaining communication with a vendor over an external connection requires a tightly controlled and monitored manner to ensure that access is authorized, data is protected, and any activity is logged and reviewed. This includes controls such as secure protocols, firewalls, encryption, authentication, monitoring, and clearly defined interface agreements. This makes external connections the IT layer where tightly controlled and monitored communication with a vendor is required.

Why the other options are incorrect:

A. Applications
– Applications are software programs that process data and support business functions. While applications may communicate with vendors (e.g., through APIs or interfaces), the control and monitoring of vendor communication is primarily a function of the external connection layer, not the application layer itself. Applications operate within the environment; external connections govern how data moves between the organization and outside parties.

B. Technical infrastructure
– Technical infrastructure includes hardware, networks, operating systems, and other foundational components that support IT services. While infrastructure supports external connections, the specific layer requiring tightly controlled and monitored communication with a vendor is the external connection layer, which governs interaction with outside parties.

D. IT management
– IT management refers to the governance, planning, and oversight of IT resources and activities. While IT management sets policies and controls over vendor communication, it is not itself the IT layer through which the communication occurs. The external connections layer is the technical point where vendor communication takes place and must be controlled and monitored.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically IT layers, external connections, third-party access, and network security controls.