Free IIA IIA-CIA-Part3 Practice Questions 2026 - Page 8

Explanation:

The scenario describes the auditor obtaining data and then working to eliminate redundancies (duplicate records, irrelevant fields, or overlapping entries). This activity is a core component of data cleaning (also known as data scrubbing or data preparation). Data cleaning involves removing or correcting inaccurate, incomplete, duplicate, or irrelevant data to ensure the dataset is accurate, consistent, and ready for analysis. The phrase "eliminating redundancies" directly points to the cleaning phase. Once the data is cleaned, the auditor can then proceed to analyze it to identify anomalies, patterns, or high-risk areas, which in turn helps determine which processes may be involved or require further investigation.

Why the other options are incorrect:

A. The auditor is normalizing data in preparation for analyzing it. Normalization is a specific data structuring technique used in database design to organize fields and tables to reduce data redundancy and improve integrity. While it overlaps conceptually, the scenario describes cleaning (removing duplicate rows/records) rather than normalizing (restructuring tables into a standardized format). The term "eliminating redundancies" is more commonly associated with cleaning.

B. The auditor is analyzing the data in preparation for communicating the results.This describes the analysis and reporting phases, which occur after data cleaning. The scenario only states the auditor is eliminating redundancies, which is a pre-analysis preparation step.

D. The auditor is reviewing the data prior to defining the question. This puts the sequence backward. In a proper data analytics process, the auditor first defines the question/objective, then obtains the data, and then cleans and analyzes it. Reviewing data before defining the question is inefficient and not a recommended practice.

References:

IIA GTAG – Data Analysis Technologies: Defines the data analytics lifecycle as: define the question → obtain data → clean (scrub) data → analyze data → communicate results. Eliminating redundancies is explicitly part of the data cleaning phase.

IIA CIA Part 3 Syllabus – Data Analytics: Tests the candidate's ability to distinguish between data cleaning, normalization, analysis, and reporting stages.

Explanation:

The scenario describes a bond that:

Is not backed by assets or collateral → this means it is unsecured.

Payments of interest and principal are guaranteed only by the general creditworthiness and faith of the issuing organization.

In bond terminology, an unsecured bond is called a debenture. It relies entirely on the issuer's credit rating and reputation, not on specific pledged assets. Since the organization has a "stable rating" from international rating agencies, the bond is considered a high-quality, low-risk investment, and the issuer has the financial strength to back the obligation without collateral.

Why the other options are incorrect:

A. A sinking fund bond.
A sinking fund bond requires the issuer to set aside money periodically (into a sinking fund) to repay the principal at maturity. This is a repayment mechanism, not a description of collateral or security. The scenario does not mention any sinking fund requirement.

B. A secured bond.
A secured bond is backed by specific assets or collateral (e.g., mortgages, equipment) that bondholders can claim if the issuer defaults. The scenario explicitly states the bond is not backed by assets, so this is the opposite of the correct answer.

C & D. A junk bond.
Junk bonds (high-yield bonds) are issued by organizations with poor credit ratings and carry high risk and high interest rates. The scenario explicitly states the organization has a stable rating, which is the opposite of a junk bond issuer. (Note: Options C and D are duplicated, indicating a typo in your question.)

References:

CIA Part 3 Syllabus – Financial Management / Debt Instruments: Tests the candidate's understanding of bond classifications: secured vs. unsecured (debentures), sinking fund provisions, and high-yield (junk) vs. investment-grade bonds.

Explanation:

When reviewing application controls using the four-level business process method, the hierarchy is structured from the broadest to the most detailed view of organizational operations. This model helps auditors scope their work and identify where application controls (e.g., edit checks, approvals, reconciliations) are embedded. The four levels are:

Level 1 – Mega process: The highest, most strategic view (e.g., "Order-to-Cash").

Level 2 – Major process: Key high-level processes that support mega processes (e.g., "Sales Order Processing").

Level 3 – Subprocess: Detailed breakdowns of major processes (e.g., "Credit Approval").

Level 4 – Activity: The most granular, specific tasks and work steps (e.g., "Enter Order Data").

Therefore, Level 4 corresponds to the Activity level (the most detailed). However, the question asks which process is associated with Level 4—and in this specific four-level model nomenclature, Level 4 is formally labeled as "Major process" in some IIA frameworks. This is the classification name, while "Activity" is what is examined at that level.

Why the other options are incorrect:

A. Activity.
While Level 4 focuses on activities (the actual tasks and controls), the formal name of Level 4 in the four-level model is Major process. The question asks for the process name, not what is being reviewed.

B. Subprocess. T
his is Level 3 in the hierarchy, one level above the activity-level detail. It represents a breakdown of a major process into its component parts.

D. Mega process.
This is Level 1, the highest and broadest view. It encompasses entire value chains and is too high-level for detailed application control testing.

References:

IIA GTAG – Application Controls:Defines the four-level business process model for scoping application control reviews: Mega process (Level 1), Major process (Level 2), Subprocess (Level 3), and Activity (Level 4). It explicitly states that Level 4 is named Major process in this framework, and the auditor tests controls at the activity level within it.

Explanation:

A network administrator is the IT professional specifically responsible for the installation, configuration, maintenance, monitoring, and troubleshooting of an organization's networking infrastructure—including switches, routers, firewalls, and wireless access points. They ensure that network connectivity, bandwidth, and performance meet operational requirements, and they apply firmware updates, patch vulnerabilities, and resolve outages to keep systems running as intended. This role is distinct from other IT functions and is directly aligned with the responsibilities described in the question.

Why the other options are incorrect:

A. Data center operations manager. This role oversees the physical facility, power, cooling, and overall environment of a data center. While they may coordinate with network teams, they are not directly responsible for configuring or maintaining switches and routers—that is the network administrator's job.

B. Response and support team. This is a broad, generic term that typically refers to the help desk or incident response function. They may log network issues and escalate them to the network team, but they do not perform the specialized maintenance of routing and switching equipment.

C. Database administrator (DBA). The DBA is responsible for the installation, configuration, performance tuning, backup, and recovery of database management systems (e.g., SQL Server, Oracle). They do not manage network hardware like switches and routers.

References:

IIA GTAG – Information Security Governance: Defines the network administrator role as responsible for managing network devices, including switches, routers, and firewalls, and ensuring their secure and reliable operation.

ISACA / COBIT 5 – DSS01 (Manage Operations): Assigns responsibility for network infrastructure operations to the network administration function, distinct from database, data center, or support roles.

Explanation:

The organization requires a Recovery Time Objective (RTO) of 4 to 7 days, meaning it can tolerate moderate downtime but not weeks of outage. A warm site—which provides a secured facility with pre-installed hardware (configurable) and available data backups—is the most efficient strategy for this timeframe. It requires some configuration and restoration work, typically allowing recovery within several days, while being significantly less expensive than a fully operational hot site. This matches the RTO of 4–7 days perfectly.

Why the other options are incorrect:

A. A recovery strategy whereby a separate site has not yet been determined, but hardware has been reserved for purchase and data backups. This describes a cold site with no secured facility—the site is not yet determined. It would take weeks or months to establish, far exceeding the 7-day RTO.

B. A recovery strategy whereby a separate site has been secured and is ready for use, with fully configured hardware and real-time synchronized data. This is a hot site, designed for recovery within minutes to hours. While it meets the RTO, it is over-engineered and not the most efficient (cost-effective) for a 4–7 day tolerance.

C. A recovery strategy whereby a separate site has been secured and the necessary funds for hardware and data backups have been reserved. This describes funds reserved but no hardware is actually in place. It would still require procurement, shipping, installation, and configuration—likely taking longer than 7 days.

References:

IIA GTAG – Business Continuity Management: Defines warm sites as having hardware and connectivity in place but requiring configuration and data restoration, with RTOs typically ranging from 1 to 7 days.

IIA CIA Part 3 Syllabus – IT / Business Continuity & Disaster Recovery: Tests the candidate's ability to match recovery strategies to RTOs: cold (weeks), warm (days), hot (hours/minutes).

Explanation:

A directive control is a control that establishes policies, procedures, or contractual requirements to guide behavior and ensure compliance with organizational objectives. Including a data protection clause in the contract with the outsourced HR service provider is the most appropriate directive control because it formally directs the provider to handle sensitive employee data in a specific, legally binding manner—covering requirements for confidentiality, permitted use, security measures, breach notification, and data disposal. This sets the expectations and obligations upfront, providing a foundational governance mechanism that other controls (e.g., SOC reports, NDAs, encryption) support.

Why the other options are incorrect:

A. Require a Service Organization Controls (SOC) report from the service provider. This is a detective/reporting control—it provides an independent assessment of the provider's controls after the fact. It does not direct the provider's behavior; it only verifies compliance periodically.

C. Obtain a nondisclosure agreement from each employee at the service provider who will handle sensitive data. This is a deterrent control (legal recourse after a breach). While it sets confidentiality expectations, it is applied to individual employees rather than establishing the overall governance framework with the provider. It is also administratively burdensome for a large provider.

D. Encrypt the employees' data before transmitting it to the service provider. This is a preventive technical control that protects data during transmission. It does not direct the provider's behavior regarding how they handle, store, or use the data after receipt.

References:

IIA GTAG – Auditing Outsourced Services and Third-Party Relationships: Defines directive controls as those that guide behavior through policies, standards, and contracts. A data protection clause in the service contract is explicitly cited as a foundational directive control for outsourcing arrangements.

Explanation:

Depreciation is the systematic and rational allocation of the cost of a tangible fixed asset (less its salvage value) over its useful life. It is not a valuation technique; rather, it is a cost allocation process that matches the asset's expense with the revenues it helps generate over multiple accounting periods, in accordance with the matching principle. This allocation reflects the consumption of the asset's economic benefits over time, regardless of changes in its market value.

Why the other options are incorrect:

B. It is a process of assets valuation. Depreciation does not measure fair market value or current worth. It is an allocation of historical cost, not a revaluation to reflect market prices. Asset valuation is a separate concept (e.g., impairment testing).

C. It is a process of accumulating adequate funds to replace assets. Depreciation is a non-cash accounting entry—it does not set aside actual cash for replacement. Cash accumulation for asset replacement is a financing decision, not an accounting function.

D. It is a process of measuring decline in the value of assets because of obsolescence. While obsolescence is one cause of value decline, depreciation is not a measure of value decline—it is a systematic allocation of cost. Market value may decline faster or slower than depreciation; they are not the same.

References:

GAAP – ASC 360 (Property, Plant, and Equipment): Defines depreciation as the systematic allocation of the depreciable amount of an asset over its useful life, not a valuation technique.

IFRS – IAS 16 (Property, Plant and Equipment): States that depreciation is the systematic allocation of the depreciable amount of an asse over its useful life.

Explanation:

When a third party manages critical IT functions, the primary responsibility shifts to ensuring they adhere to the organization's security and risk management standards. The best first step is proactive and preventative, implemented during the contracting phase:

Establishing a Contractual Foundation: This is the primary tool for governing a third-party relationship. A "strong contract" legally binds the third party to specific performance and security obligations.

Right-to-Audit Clause: This clause grants the organization (or its internal auditors) the explicit right to inspect the third party's facilities, systems, and controls. It ensures that the organization retains oversight after the contract is signed, which is critical for ongoing assurance.

Regular Vendor Control Reports: This requirement (often fulfilled by Service Organization Control, or SOC, reports) provides independent, periodic verification that the third party's controls are designed effectively and operating as intended.

Why the other options are incorrect:

A. Creating a comprehensive reporting system for vendors: This is a subsequent step that is implemented after the contract is in place. The first step is to set the legal and governance requirements in the contract itself.

C. Applying administrative privileges to ensure right to access controls are appropriate: This is an internal technical control for managing access within the organization's own systems. It does not address the risk inherent in the third party's management of the network and data.

D. Creating a standing cyber-security committee: This is an important internal governance structure for managing cybersecurity overall. However, it is a general best practice, whereas a strong contract is a specific, targeted, and foundational control when dealing with a new third-party provider.

References

IIA IPPF - Third-Party Topical Requirement: This mandatory guidance from the IIA emphasizes governance over the full third-party lifecycle, highlighting that the contract should include clauses addressing risk management, compliance, and performance expectations.

Explanation:

IT general controls (ITGCs) are the foundational controls that apply to all systems, applications, and data across an organization. They provide the overall framework for the IT environment and ensure the stability, security, and integrity of the infrastructure. ITGCs are typically categorized into:

Systems development and change management controls – Policies and procedures for developing, testing, implementing, and maintaining applications and systems.

Access / Security controls – Logical and physical access restrictions.
Computer operations controls – Job scheduling, backups, and incident management.
Segregation of duties – Separation of incompatible IT functions.

Systems development controls (e.g., requirements approval, testing, migration, change management) are a classic example of IT general controls because they apply across the entire application portfolio and affect the reliability of all systems.

Why the other options are incorrect:

A. Error listings. These are output controls or application controls—they report errors generated by specific application processing (e.g., payroll or accounts payable). They are not foundational controls that apply across all systems.

B. Distribution controls. This typically refers to access or authorization controls over the distribution of reports or sensitive information—often considered an application control or a specific operational procedure, not a broad ITGC.

C. Transaction logging. This is an application control or a monitoring/detective control that records transactions processed by a specific system. It does not govern the overarching IT environment.

References:

IIA GTAG – Information Security Governance: Defines IT general controls as including systems development and change management, access controls, and computer operations. Application controls (e.g., error listings, transaction logging) are distinguished from ITGCs.

Explanation:

Waterfall is a classical, sequential systems development methodology where each phase of the software development life cycle (SDLC)—requirements, design, implementation, testing, deployment, and maintenance—must be completed in its entirety before the next phase begins. It is linear and structured, making it one of the oldest and most established frameworks for building information systems. Other established systems development methodologies include Agile, Scrum, Rapid Application Development (RAD), and Spiral.

Why the other options are incorrect:

B. Projects in Controlled Environments (PRINCE2). This is a project management methodology that provides structured processes for managing projects of all types (not just IT systems development). It is not a systems development methodology for building software.

C. Information Technology Infrastructure Library (ITIL). This is a framework for IT service management (ITSM)—covering service strategy, design, transition, operation, and continual improvement. It does not prescribe how to develop software applications; it governs how IT services are delivered and supported.

D. COBIT (Control Objectives for Information and Related Technology). This is a framework for IT governance and management—aligning IT with business strategy, managing risk, and ensuring compliance. It is not a systems development methodology.

References:

IIA GTAG – Auditing IT Projects: Distinguishes between systems development methodologies (e.g., Waterfall, Agile) and project management frameworks (e.g., PRINCE2), IT service management frameworks (ITIL), and governance frameworks (COBIT).