Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation

A mechanistic organizational structure is characterized by high specialization, rigidly defined tasks, centralized authority, formal rules and procedures, and close supervision. Because tasks are narrowly defined, rules are explicit, and decisions are made at higher levels, employees have less discretion and autonomy in how they perform their work. As a result, the organization relies on formal controls, supervision, and hierarchical oversight rather than on employees' self-control and self-direction. Reliance on self-control is therefore low in a mechanistic structure, making this the correct description.

Why the other options are incorrect:

A. Primary direction of communication tends to be lateral
– In a mechanistic structure, communication primarily flows vertically, downward from superiors to subordinates and upward through reporting lines, reflecting the hierarchical chain of command. Lateral (horizontal) communication is more characteristic of an organic structure, which emphasizes collaboration across functions and levels.

B. Definition of assigned tasks tends to be broad and general
– In a mechanistic structure, tasks are narrowly defined, specialized, and clearly specified, not broad and general. Broad and general task definitions are associated with organic structures, where employees have more flexibility and wear multiple hats.

C. Type of knowledge required tends to be broad and professional
– A mechanistic structure typically requires specialized, narrow knowledge tied to specific tasks and functions. Broad, professional knowledge that spans multiple areas is more characteristic of organic structures, which rely on expertise, adaptability, and cross-functional contribution.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically organizational structures and the distinction between mechanistic and organic structures.

Explanation

According to IIA guidance on IT, line management is responsible for the day-to-day operation and oversight of information security within their areas of responsibility. This includes reviewing and monitoring security controls to ensure they are functioning as intended and that security policies and procedures are being followed. Line management is closest to the operational activities where security controls are applied, so it is their responsibility to continuously review and monitor those controls, identify weaknesses, and take corrective action. This operational, hands-on responsibility distinguishes line management from executive management, the board, and internal auditors.

Why the other options are incorrect:

B. Dedicate sufficient security resources
– Dedicating sufficient resources to information security is a responsibility of executive management and the board. They are responsible for approving budgets, allocating resources, and ensuring the organization has the people, technology, and funding needed to maintain effective security. Line management does not have the authority to make organization-wide resource allocation decisions.

C. Provide oversight to the security function
– Providing oversight to the security function is the responsibility of executive management and the board. They set the tone at the top, establish governance structures, and monitor the overall effectiveness of the security program. Oversight is a governance-level responsibility, not a line management function.

D. Assess information control environments
– Assessing the information control environment is a responsibility of internal auditors, who provide independent, objective assurance on the effectiveness of controls. Internal audit evaluates the design and operating effectiveness of controls, including information security controls, but does not own or operate them. Line management operates the controls; internal audit assesses them.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically information security governance, roles and responsibilities, and control monitoring.

Explanation

When an organization implements a centralized governance, risk, and compliance (GRC) resource, the key enterprise governance concern is ensuring that the board, which holds ultimate responsibility for governance, is fully satisfied that an effective system of governance is in place. This requires that the GRC resource provide accurate, high-quality, timely, and reliable information to the board so it can fulfill its oversight responsibilities. Enterprise governance is fundamentally about how the board and executive management direct, control, and hold the organization accountable. A GRC system must therefore support the board's ability to oversee governance effectively by delivering trustworthy information about risks, compliance, and control performance. This is the highest-level governance concern that the final product must satisfy.

Why the other options are incorrect:

B. Compliance, audit, and risk management can find and seek efficiencies between their functions through integrated information reporting – While finding efficiencies through integrated reporting is a valuable operational benefit of a GRC resource, it is a functional or management-level concern, not the key enterprise governance concern. Efficiency gains serve the organization's operations, but the primary governance purpose is to enable the board to oversee governance effectively.

C. Key compliance and risk metrics can be tracked and compared throughout the enterprise, aiding in identifying problem departments – Tracking metrics and identifying problem areas is a useful monitoring capability, but it is a management and operational concern rather than the overarching enterprise governance concern. It supports management's oversight but does not by itself fulfill the board's governance responsibility.

D. Data analytics can be utilized for trending of the data to ensure that patterns and ongoing monitoring occurs throughout the organization – Data analytics and trending are valuable features that support monitoring and risk identification, but they are tools and capabilities, not the key enterprise governance concern. Governance requires that the board receive quality information to satisfy itself that governance is effective. Analytics is a means to that end, not the end itself.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Governance — Specifically enterprise governance, GRC integration, and the board's oversight responsibilities.

Explanation

According to IIA guidance on IT, user-developed applications (UDAs), including spreadsheets, are considered higher risk when they involve complex calculations, multiple formulas, significant assumptions, and are used to support important financial or operational decisions. An asset retirement calculation spreadsheet that is comprised of multiple formulas and assumptions fits this description well. Such a spreadsheet is likely to be complex, difficult to verify, prone to error, and material to the organization's financial reporting or decision-making. Complexity, combined with the use of assumptions and interdependent formulas, increases the risk of undetected errors and makes the spreadsheet a high-risk UDA that warrants stronger controls, documentation, testing, and review.

Why the other options are incorrect:

A. A revenue calculation spreadsheet supported with price and volume reports from the production department – While revenue calculations can be important, this spreadsheet is supported by reports from the production department, which provides a source of validation and reconciliation. The presence of supporting documentation reduces the risk compared to a spreadsheet based primarily on complex internal formulas and assumptions. It is therefore less likely to be classified as the highest-risk UDA.

C. An ad-hoc inventory listing spreadsheet comprising details of written-off inventory quantities – An ad-hoc listing of written-off inventory quantities is relatively simple in nature. It involves compiling data rather than performing complex calculations or applying significant assumptions. Because of its simplicity and limited complexity, it is generally considered lower risk than a spreadsheet with multiple formulas and assumptions.

D. An accounts receivable reconciliation spreadsheet used by the accounting manager to verify balances – While reconciliation spreadsheets are important and can carry some risk, this one is used by the accounting manager to verify balances, which implies a review and reconciliation process is in place. Reconciliations are a standard control activity, and the spreadsheet's purpose is to verify balances against other records, which reduces risk relative to a complex, assumption-driven calculation model.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically user-developed applications, spreadsheet risk, and IT controls.

Explanation

Profitability ratios measure the operating success of a company for a given period of time. They evaluate how effectively an organization generates earnings from its operations, using metrics such as gross profit margin, net profit margin, return on assets, and return on equity. These ratios focus on the company's ability to generate income relative to revenues, assets, and equity, which is the essence of operating success over a period. Profitability ratios are therefore the category of financial ratios that directly addresses the question.

Why the other options are incorrect:

A. Liquidity ratios
– Liquidity ratios measure a company's ability to meet its short-term obligations as they come due, using metrics such as the current ratio and quick ratio. They focus on short-term financial health and cash flow adequacy, not on operating success or profitability over a period.

C. Solvency ratios
– Solvency ratios measure a company's ability to meet its long-term obligations and remain financially viable over the long term, using metrics such as debt-to-equity and interest coverage. They focus on long-term financial stability and leverage, not on operating success or earnings performance.

D. Current ratios
– The current ratio is a specific liquidity ratio that compares current assets to current liabilities. While it is useful for assessing short-term liquidity, it is a single ratio rather than a category, and it does not measure operating success or profitability for a period.

Reference:

IIA-CIA-Part3 content area on Financial Management — Specifically financial ratio analysis, including liquidity, profitability, and solvency ratios.

Explanation

Big data governance is a management responsibility. Management is accountable for establishing the framework, policies, and processes that govern how data is collected, stored, used, and maintained across the organization. This includes ensuring that information storage systems are properly defined and structured, and that processes for updating critical data elements are clear, documented, and followed. Management owns the data governance program and is responsible for implementing controls, defining data quality requirements, assigning data ownership, and ensuring that critical data elements are accurate, consistent, and up to date. This statement accurately describes management's responsibilities in big data governance.

Why the other options are incorrect:

B. External auditors must ensure that analytical models are periodically monitored and maintained – External auditors provide independent assurance on financial statements and related controls. They do not have responsibility for ensuring that analytical models are monitored and maintained; that is a management responsibility. Assigning this responsibility to external auditors misstates their role and independence.

C. The board must implement controls around data quality dimensions to ensure that they are effective – The board provides oversight and governance direction, but it does not implement controls. Implementing controls around data quality dimensions is an operational responsibility of management, not the board. The board sets expectations and provides oversight, while management executes.

D. Internal auditors must ensure the quality and security of data, with a heightened focus on the riskiest data elements – Internal auditors provide independent, objective assurance and consulting services. They assess and evaluate the effectiveness of data quality and security controls, but they do not ensure or own the quality and security of data. That is management's responsibility. Internal audit's role is to review and report on how well management fulfills its responsibilities, not to take on operational accountability.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically big data governance, data management, and the roles and responsibilities of management, the board, internal audit, and external audit.

Explanation

The direct write-off method records bad debt expense only when a specific account is determined to be uncollectible and is written off. Because it does not estimate uncollectible accounts in advance, it is simple and inexpensive to apply. Its main advantage is practicality: when bad debt losses are immaterial or insignificant, the cost and effort of estimating uncollectible accounts under the allowance method are not justified. In such cases, the direct write-off method provides adequate reporting without the added complexity, making this the best argument for using it.

Why the other options are incorrect:

B. It provides a better alignment with revenue
– The direct write-off method actually provides poorer matching with revenue than the allowance method. Under the direct write-off method, bad debt expense is recognized only when an account is written off, which may occur in a period different from when the related revenue was earned. The allowance method matches estimated bad debt expense with the revenue of the period in which it was generated, so this statement favors the allowance method, not the direct write-off method.

C. It is the preferred method according to The IIA
– The IIA does not prescribe or prefer a specific method for recording bad debt; that is the domain of accounting standard setters, such as the FASB or IASB. The IIA sets standards for internal auditing, not for financial accounting treatment of receivables, so this statement is incorrect.

D. It states receivables at net realizable value on the balance sheet
– The direct write-off method does not state receivables at net realizable value. Under this method, accounts receivable are reported at gross amounts until specific accounts are written off, and no allowance for doubtful accounts is established. It is the allowance method that reports receivables at net realizable value by deducting the estimated uncollectible amount.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically accounting for accounts receivable, bad debt expense, and the direct write-off versus allowance methods.

Explanation

The inconsistency described, with key performance indicators (KPIs) showing a positive trend while customer complaints are increasing, suggests that the KPIs are measuring the wrong things or that employees are optimizing for the metrics rather than for genuine customer satisfaction. A common cause is that the call center script or performance measurement approach drives behavior that satisfies the metrics, such as calls completed or short handle times, without actually resolving customer issues, leading to more complaints. Reviewing and updating the call center script would address the root cause by ensuring that agents interact with customers in a way that focuses on resolving their problems and improving satisfaction, rather than merely meeting efficiency metrics. This recommendation corrects the underlying inconsistency between positive KPIs and rising complaints.

Why the other options are incorrect:

B. Re-emphasize the importance of call center employees completing a certain number of calls per hour
– This would likely worsen the problem. Emphasizing call volume pushes employees to prioritize speed and quantity over quality, which can increase customer complaints rather than resolve them. It reinforces the metric-driven behavior that is causing the inconsistency.

C. Retrain call center staff on area processes and common technical issues that they will likely be asked to resolve
– While retraining can improve competence, it does not address the root cause of the inconsistency between positive KPIs and rising complaints. If the KPIs themselves are misaligned with customer satisfaction, better-trained staff may still be measured on the wrong metrics, and complaints could continue to rise.

D. Increase the incentive for call center employees to complete calls quickly and raise the number of calls completed daily
– This would intensify the focus on speed and volume, likely worsening customer satisfaction. Incentivizing fast call completion encourages employees to rush customers off the phone, which can increase complaints and further widen the gap between positive KPIs and actual customer experience.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Performance Measurement — Specifically key performance indicators, performance metrics, and their alignment with organizational objectives and customer satisfaction.

Explanation

The question "How does our organization compete?" pertains to  business-level strategy. Business-level strategy focuses on how an organization competes in a particular market or industry, meaning how it positions itself relative to competitors to achieve a competitive advantage. It addresses decisions about pricing, differentiation, cost leadership, target customer segments, product features, and the value proposition offered to customers. This is distinct from corporate-level strategy, which addresses what businesses the organization should be in and how to allocate resources across them, and from functional-level strategy, which focuses on how individual functions, such as marketing, operations, and HR, support the business-level strategy.

Why the other options are incorrect:

A. Functional-level strategy
– Functional-level strategy concerns how individual functional areas, such as marketing, finance, operations, or human resources, support the business-level strategy. It focuses on operational efficiency and effectiveness within functions, not on how the organization as a whole competes in its market.

B. Corporate-level strategy
– Corporate-level strategy addresses the organization's overall scope and direction, including which industries or markets to enter, how to allocate resources across business units, and whether to diversify, acquire, or divest. It answers the question "What businesses should we be in?" rather than "How do we compete?"

D. Departments-level strategy
– This is not a recognized level of strategy in standard strategic management theory. The three generally accepted levels are corporate-level, business-level, and functional-level strategy. This option appears to be a distractor or typographical error.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Strategic Management — Specifically levels of strategy, including corporate-level, business-level, and functional-level strategy.

Explanation

Under inventory valuation rules, inventory is generally carried at the lower of cost or net realizable value (NRV). For defective items, NRV is the estimated selling price in the ordinary course of business less any costs necessary to make the sale. In this scenario, the defective items can be sold for $5 per unit, while their original production cost is $4 per unit. Therefore, the inventory is carried at the lower of cost ($4) or NRV ($5), which is $4 per unit. For 10,000 defective units, the carrying amount is $4,000.

Why the other options are incorrect:

A. $0 – This would imply that the defective items have no recoverable value. Because the items can still be sold for $5 per unit, they have positive value and should not be written down to zero.

C. $5,000 – This amount represents the NRV based on the $5 defective selling price per unit. However, inventory is carried at the lower of cost or NRV. Because the $4 production cost is lower than the $5 NRV, the carrying amount is $4,000 rather than $5,000.

D. $10,000 – This represents the normal market price of $10 per unit. That price is not applicable to the defective items because they cannot be sold at the normal market price. Using $10 per unit would overstate the inventory value.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically inventory valuation, lower of cost or net realizable value, and accounting for defective inventory.

Explanation

Systems software controls are controls designed to protect the operating system, system utilities, and other systems-level software that support applications and infrastructure. Intrusion testing, also called penetration testing, is a systems software control because it tests the security of systems software and infrastructure by simulating attacks to identify vulnerabilities in operating systems, network services, and system configurations. It helps ensure that systems software is properly secured against unauthorized access and exploitation, making it the correct answer among the options provided.

Why the other options are incorrect:

A. Restricting server room access to specific individuals
– Restricting physical access to the server room is a physical access control, not a systems software control. It protects the physical environment where systems software resides, but it does not control or secure the software itself.

B. Housing servers with sensitive software away from environmental hazards
– Housing servers away from environmental hazards, such as floods, fire, or excessive heat, is a physical and environmental control. It protects the physical infrastructure, not the systems software directly, so it is not a systems software control.

C. Ensuring that all user requirements are documented
– Documenting user requirements is a systems development or project management control related to requirements gathering and documentation. It is not a systems software control, which focuses on protecting and controlling systems-level software.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically IT controls, including systems software controls, physical controls, and systems development controls.

Explanation

A cold site is a disaster recovery facility that provides basic infrastructure, such as physical space, power, HVAC, internet, and telecommunications connectivity, but does not include pre-installed servers or other infrastructure equipment. When a disaster occurs, the organization must procure, install, and configure the necessary hardware and software before operations can resume. This makes the cold site the least expensive recovery option but also the one with the longest recovery time. The description in the question, a remote site with space for basic services like internet and telecommunications but no servers or infrastructure equipment, exactly matches the definition of a cold site.

Why the other options are incorrect:

A. Frozen site
– A "frozen site" is not a standard recognized category of disaster recovery site in IIA guidance or standard IT terminology. It appears to be a distractor and does not describe the facility described in the question.

C. Warm site
– A warm site is a partially equipped recovery facility that includes some pre-installed hardware, software, and network infrastructure, but is not fully configured or ready for immediate operation. Because it has some equipment in place, it does not match the description of a site with no servers or infrastructure equipment.

D. Hot site
– A hot site is a fully operational, duplicate facility that is configured to the organization's exact needs and can be brought online almost immediately. It includes duplicate hardware, software, network infrastructure, and replicated data, so it clearly does not match the description of a site without servers or infrastructure equipment.

Reference:

IIA-CIA-Part3 content area on Business Continuity Management (BCM) and Disaster Recovery Planning — Specifically alternate site strategies, including hot, warm, and cold sites.