Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation

When deciding whether to accept a special order, the relevant cost per unit is the incremental cost  that will be incurred if the order is accepted. Fixed manufacturing costs are  not relevant  because they do not change with the additional production, assuming adequate manufacturing capacity exists as stated in the problem. Therefore, the relevant cost per unit includes only the  variable costs :

* Direct labor = $2
* Direct material = $5
* Variable manufacturing = $2.50

Relevant cost per unit = $2 + $5 + $2.50 = $9.50

Since the special order price of $11 per unit exceeds the relevant cost of $9.50, accepting the order would contribute $1.50 per unit toward covering fixed costs and increasing profit, assuming no other variables change.

Why the other options are incorrect:

B. $10.50
– This amount does not correspond to the sum of the variable costs given ($2 + $5 + $2.50 = $9.50). It appears to include an additional $1.00 of cost that is not supported by the data provided.

C. $11
– This is the special order price per unit, not the relevant cost. The relevant cost is the incremental cost of producing each unit, which is lower than the selling price.

D. $13
– This amount does not correspond to any combination of the costs given. It is higher than the relevant cost and would incorrectly include fixed or irrelevant costs.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically relevant costing, special order decisions, and the treatment of fixed versus variable costs.

Standard managerial accounting theory — For special order decisions with available capacity, only variable (incremental) costs are relevant; fixed costs are irrelevant because they do not change with the decision.

Explanation

When an internal auditor finds that 3% of payments did not agree with the submitted invoices, the auditor needs to determine whether this deviation rate is significant or within acceptable limits. The most useful key performance indicator (KPI) for this purpose is one that defines the process owner's tolerance for performance deviations, that is, the acceptable threshold or error rate established for the accounts payable process. If the process owner's tolerance is, for example, 1%, then a 3% deviation rate exceeds the acceptable limit and is significant. If the tolerance is 5%, then 3% may be within acceptable limits. Without knowing the established tolerance, the auditor cannot judge the significance of the finding. This makes a KPI defining the process owner's tolerance for deviations the most relevant to assessing the significance of the test results.

Why the other options are incorrect:

B. A KPI that defines the importance of performance levels and disbursement statistics being measured – This KPI addresses which performance levels and statistics are important to measure, but it does not provide a benchmark or threshold against which the 3% deviation can be evaluated. Knowing what is measured does not tell the auditor whether 3% is significant.

C. A KPI that defines timeliness with regard to reporting disbursement data errors to authorized personnel – This KPI relates to how quickly errors are reported once identified, not to whether the 3% deviation rate itself is acceptable or significant. Timeliness of reporting is a separate performance dimension and does not help determine the significance of the deviation rate.

D. A KPI that defines operating ratio objectives of the disbursement process – This KPI relates to operating ratios, such as cost efficiency, of the disbursement process, not to the acceptable level of payment errors or deviations. It does not provide a benchmark for evaluating whether the 3% mismatch rate is significant.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Performance Measurement and Internal Audit — Specifically key performance indicators, performance tolerances, and the evaluation of audit findings.

Explanation

Transfer pricing regulations generally require that transactions between related parties, such as a parent company and its overseas subsidiary, be conducted at arm's length, meaning the price should be the same as what unrelated parties would agree to in a comparable transaction. Selling inventory to an overseas subsidiary at fair value (market value) aligns with the arm's length principle because the price reflects what the inventory would sell for in an open market. This reduces the risk of violating transfer pricing regulations, which are designed to prevent organizations from shifting profits between jurisdictions by manipulating intercompany prices. By using fair value, the organization ensures that the transaction is commercially reasonable and defensible to tax authorities.

Why the other options are incorrect:

B. The local subsidiary purchases inventory at a discounted price – A discounted price that is not consistent with what unrelated parties would pay may not satisfy the arm's length principle. If the discount is not justified by market conditions or comparable transactions, it could be viewed as a transfer pricing violation designed to shift profits to the subsidiary's jurisdiction. This increases, rather than reduces, the risk of violating transfer pricing regulations.

C. The organization sells inventory to an overseas subsidiary at the original cost – Selling at cost may not reflect an arm's length price because unrelated parties would typically include a profit margin in the sale price. Selling at cost effectively transfers profit out of the selling entity's jurisdiction, which may be challenged by tax authorities and could violate transfer pricing regulations.

D. The local subsidiary purchases inventory at the depreciated cost – Depreciated cost is a concept typically applied to fixed assets, not inventory, and it does not represent an arm's length price. Using depreciated cost as a transfer price for inventory would not be consistent with the arm's length principle and would increase the risk of a transfer pricing violation.

Reference:

IIA-CIA-Part3 content area on Financial Management / Taxation and International Business — Specifically transfer pricing, the arm's length principle, and regulatory compliance.

Explanation

According to IIA guidance on IT, a payment gateway is a service or system that authorizes credit card and other electronic payments for online (e-commerce) transactions. When a customer submits payment information on an e-commerce website, the payment gateway securely transmits the transaction details to the payment processor and acquiring bank to verify and authorize the payment. It acts as the interface between the merchant's website and the financial institutions, handling the authorization process and helping to protect sensitive cardholder data through encryption and secure protocols such as HTTPS/TLS and tokenization. This makes payment gateways the component that authorizes credit card online payments, making option D the true statement.

Why the other options are incorrect:

A. HTTP sites provide sufficient security to protect customers' credit card information – HTTP (Hypertext Transfer Protocol) is not secure because it transmits data in clear text, which can be intercepted. Secure e-commerce transactions require HTTPS (HTTP Secure), which uses encryption through TLS to protect data in transit. HTTP sites do not provide sufficient security to protect credit card information, so this statement is false.

B. Web servers store credit cardholders' information submitted for payment – Best practices and industry standards such as PCI DSS generally discourage storing sensitive cardholder data on web servers unless it is properly protected and necessary. Many organizations avoid storing such data altogether by using tokenization or payment gateways instead. Therefore, stating that web servers store cardholder information as a general rule is inaccurate and unsafe.

C. Database servers send cardholders' information for authorization in clear text – Cardholder information should not be transmitted in clear text, especially during authorization. It should be encrypted, such as through TLS, to protect against interception. Sending cardholder data in clear text would represent a serious security weakness, so this statement is false.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically e-commerce security, payment systems, and data protection in online transactions.

Explanation

The Internet of Things (IoT) refers to the network of interconnected physical devices, including sensors, appliances, machines, wearables, and other smart objects, that collect and transmit data over the internet. One of the most significant impacts of IoT is on velocity of data, which refers to the speed at which data is generated, transmitted, and processed. IoT devices continuously stream data in real time, generating enormous volumes of data at extremely high speed. For example, sensors in manufacturing equipment, smart meters, connected vehicles, and health monitoring devices transmit data continuously and often in real time. This unprecedented speed of data generation and transmission makes velocity the data attribute most significantly impacted by IoT.

Why the other options are incorrect:

A. Normalization
– Normalization refers to the process of organizing data in a database to reduce redundancy and improve data integrity. While IoT data may require normalization for storage and analysis, normalization is a data management technique, not a data attribute most significantly impacted by IoT. IoT's primary impact is on the speed and volume of data, not on how data is structured in databases.

C. Structuration
– Structuration refers to how data is organized, formatted, or structured, such as structured, semi-structured, or unstructured data. While IoT generates large amounts of semi-structured and unstructured data, the most dramatic and defining impact of IoT is on the speed of data generation and transmission, not on how the data is structured. Velocity is the more significant attribute.

D. Veracity
– Veracity refers to the accuracy, quality, and trustworthiness of data. IoT does raise concerns about data veracity, such as sensor errors, noise, and incomplete data, but the most significant and characteristic impact of IoT is on velocity, the sheer speed and real-time nature of data generation and transmission. Veracity is a concern, but velocity is the attribute most fundamentally transformed by IoT.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically big data, the Internet of Things, and data characteristics such as volume, velocity, variety, and veracity.

Explanation

Individual operational goals should be established in a way that supports the achievement of the organization's overall strategy. The most appropriate foundation for individual operational goals is therefore alignment with organizational strategy, meaning that each employee's goals should cascade down from the organization's strategic objectives, through departmental and unit goals, to the individual level. When individual goals are aligned with the organization's strategy, employees' efforts are directed toward the same overall priorities, ensuring that day-to-day operational activities contribute to the achievement of strategic objectives. This alignment provides the rationale and direction for setting individual operational goals, making it the foundation on which those goals should be based.

Why the other options are incorrect:

A. Individual skills and capabilities
– While individual skills and capabilities may influence how goals are set or what an employee is capable of achieving, they are not the foundation for operational goals. Goals should be driven by organizational needs and strategy, not solely by what an individual is currently capable of doing. Skills and capabilities are considerations in goal setting, but they do not provide the strategic direction that should underlie operational goals.

C. Financial and human resources of the unit
– The resources available to a unit affect what goals are feasible, but they are constraints or enabling factors rather than the foundation for individual operational goals. Goals should be established based on strategic direction, and resources should be aligned to support them, not the other way around.

D. Targets of key performance indicators
– Key performance indicator (KPI) targets are measures used to track progress toward goals, but they are not the foundation for those goals. KPIs should be derived from the goals, which in turn should be aligned with organizational strategy. Treating KPI targets as the foundation would invert the relationship between strategy, goals, and measures.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Performance Management — Specifically goal setting, strategic alignment, and performance measurement.

Explanation

Bond financing involves issuing debt, on which the company pays interest. Unlike dividends on common stock, interest on bonds is a fixed obligation and does not dilute ownership. When a company uses bond financing instead of issuing additional common stock, it does not increase the number of shares outstanding. As a result, the company's earnings are spread over a smaller number of shares, which increases earnings per share (EPS) compared to issuing additional common stock, assuming all other variables are equal. This effect is known as financial leverage: using debt can magnify returns to shareholders because the fixed interest cost does not reduce the number of shares, while the earnings available to common shareholders may increase. This makes higher company earnings per share the true statement.

Why the other options are incorrect:

A. Lower shareholder control – Bond financing does not reduce shareholder control. Bondholders are creditors, not owners, and they do not have voting rights or control over the company. Issuing common stock, by contrast, would dilute existing shareholders' ownership and control. Therefore, bond financing actually preserves shareholder control rather than lowering it.

B. Lower indebtedness – Bond financing increases indebtedness because bonds are a form of debt. Compared to issuing common stock (equity), bond financing results in higher, not lower, indebtedness. The company takes on a fixed obligation to pay interest and repay principal, so this statement is incorrect.

D. Higher overall company earnings – Bond financing does not increase the company's overall earnings. The company's operating earnings are determined by its operations, not by how it is financed. In fact, bond financing adds interest expense, which reduces net income. While EPS may be higher due to the smaller number of shares outstanding, overall company earnings (net income) may be lower, not higher, because of the interest expense. Therefore, this statement is incorrect.

Reference:

IIA-CIA-Part3 content area on Financial Management — Specifically capital structure, debt versus equity financing, financial leverage, and earnings per share.

Explanation

A data privacy policy should establish the principles and rules governing how personal data is collected, used, retained, and disposed of. The following items should be included:

1. Stipulations for deleting certain data after a specified period of time – A data privacy policy should include retention and disposal rules, specifying that personal data is kept only as long as necessary and then deleted. This reflects the privacy principle of storage limitation and proper disposal of personal data, and it is a standard component of a data privacy policy.

2. Guidance on acceptable methods for collecting personal data – A data privacy policy should address how personal data may be collected, including requirements for lawful and fair collection, obtaining consent where required, and limiting collection to what is necessary. This reflects the collection limitation and consent principles and belongs in a data privacy policy.

3. A description of what constitutes appropriate use of personal data – A data privacy policy should define the permissible uses of personal data, ensuring that data is used only for the purposes for which it was collected or as otherwise permitted. This reflects the use limitation principle and is a core element of a data privacy policy.

Together, items 1, 2, and 4 are appropriately included in a data privacy policy, making option C the correct answer.

Why item 3 is incorrect:

3. A requirement to retain personal data indefinitely to ensure a complete audit trail – Retaining personal data indefinitely violates the privacy principle of storage limitation, which requires that personal data be kept only as long as necessary for the purposes for which it was collected. Indefinite retention increases the risk of unauthorized access, misuse, and breach, and is contrary to data privacy principles. While audit trails may be required for certain records, this should be done in a way that is consistent with privacy requirements, such as retaining audit logs rather than all personal data and for defined periods. Therefore, item 3 should not be included in a data privacy policy.

Why the other options are incorrect:

A. 1 and 2 only – This option omits item 4, which is also a necessary component of a data privacy policy. A privacy policy must describe appropriate use of personal data, so this option is incomplete.

B. 2 and 3 only – This option includes item 3 (indefinite retention), which is incorrect, and omits items 1 and 4, which are necessary. Therefore, this option is incorrect.

D. 2, 3, and 4 only – This option includes item 3 (indefinite retention), which violates privacy principles, and omits item 1 (deletion after a specified period), which is a necessary component. Therefore, this option is incorrect.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically data privacy, privacy principles, and data protection policies.

Explanation

The budgeted income statement, also called the pro forma income statement or budgeted statement of profit or loss, provides the best basis for evaluating the organization's performance because it summarizes expected revenues, costs, and expenses, and ultimately projected net income for the budget period. Performance evaluation focuses on how well the organization has performed relative to its plans, that is, whether it achieved its revenue targets, controlled its costs, and generated the expected level of profit. The budgeted income statement captures all of these elements in one statement, making it the most comprehensive and appropriate budget for comparing actual results against planned results. By comparing the actual income statement to the budgeted income statement, management can analyze variances in revenues and expenses and assess overall organizational performance.

Why the other options are incorrect:

A. Cash budget
– The cash budget projects cash receipts and cash disbursements and is used to plan for the organization's cash needs and ensure adequate liquidity. While it is useful for cash management, it focuses on cash flows rather than on revenues, expenses, and profitability, so it is not the best basis for evaluating overall organizational performance.

B. Budgeted balance sheet
– The budgeted balance sheet projects the organization's assets, liabilities, and equity at the end of the budget period. It shows the expected financial position, but it does not directly measure operating performance, including revenues, costs, and profits, for the period, so it is not the best basis for performance evaluation.

C. Selling and administrative expense budget
– The selling and administrative expense budget projects only a subset of the organization's expenses, specifically selling and administrative costs. It covers only part of the organization's operations and does not include revenues, cost of goods sold, or other expenses, so it is too narrow to serve as the basis for evaluating overall organizational performance.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically budgeting, budgetary control, and performance evaluation.

Explanation

When several organizations develop a strategy to open co-owned shopping malls, they are combining their resources, expertise, and market presence in a shared venture. The primary purpose of such a strategy is to increase market synergy, that is, to achieve benefits that neither organization could achieve as effectively on its own. By co-owning shopping malls, the organizations can share costs, risks, and customer traffic, cross-promote each other's products or services, and leverage each other's strengths and market positions. Synergy arises when the combined effort produces greater value than the sum of the individual efforts, which is the fundamental rationale for co-owned ventures such as jointly owned shopping malls. This makes market synergy the primary purpose of this strategy.

Why the other options are incorrect:

A. To exploit core competence
– While organizations may leverage their core competencies in a co-owned venture, this is not the primary purpose of opening co-owned shopping malls. Exploiting core competence refers to applying an organization's distinctive strengths to new opportunities; the co-owned mall strategy is more fundamentally about combining strengths and market presence to create synergy.

C. To deliver enhanced value
– Delivering enhanced value to customers can be an outcome of a co-owned shopping mall strategy, but it is not the primary purpose. Enhanced value is a result that may arise from synergy, but the underlying motivation for organizations to co-own shopping malls is to realize synergistic benefits such as shared costs, increased traffic, and combined market power.

D. To reduce costs
– Cost reduction can be a benefit of co-ownership because costs and risks are shared among the co-owners. However, it is not the primary purpose of the strategy. If cost reduction alone were the goal, other strategies, such as outsourcing or economies of scale, might be more direct. The distinguishing feature of co-owned shopping malls is the pursuit of synergy among the participating organizations.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Strategic Management — Specifically cooperative strategies, joint ventures, strategic alliances, and synergy.

Standard strategic management theory — Synergy occurs when the combined value of cooperating organizations exceeds what each could achieve independently; co-owned ventures such as jointly owned shopping malls are pursued primarily to realize market synergy through shared customers, cross-promotion, combined market presence, and shared resources.

Explanation

Under absorption costing, also called full costing, all manufacturing costs, including direct materials, direct labor, and both variable and fixed manufacturing overhead, are treated as product costs. Fixed manufacturing overhead costs cannot be traced directly to individual units of product, so they are classified as indirect costs. Because they are manufacturing costs, they are also product costs, meaning they are attached to the product and flow through inventory until the product is sold. Therefore, fixed manufacturing overhead costs are classified as indirect product costs under absorption costing. They are allocated to units produced using a predetermined overhead rate and remain in inventory as part of the product's cost until the goods are sold, at which point they are expensed as part of cost of goods sold.

Why the other options are incorrect:

A. Direct, product costs
– Direct product costs are costs that can be traced directly to a unit of product, such as direct materials and direct labor. Fixed manufacturing overhead cannot be traced directly to individual units, so it is not a direct cost; it is an indirect cost.

C. Direct period costs
– Period costs are costs that are expensed in the period incurred and are not attached to the product, such as selling and administrative expenses. Fixed manufacturing overhead is not a period cost under absorption costing; it is a product cost. It also is not a direct cost because it cannot be traced directly to individual units.

D. Indirect period costs
– Indirect period costs are costs that are both indirect and expensed in the period incurred, such as indirect selling or administrative costs. Fixed manufacturing overhead is not a period cost under absorption costing; it is a product cost that is inventoried and expensed through cost of goods sold when the product is sold. While it is indirect, it is a product cost, not a period cost.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically absorption costing versus variable costing, product versus period costs, and cost classification.

Standard managerial accounting theory — Under absorption costing, fixed manufacturing overhead is treated as an indirect product cost and allocated to units produced, whereas under variable costing it is treated as a period cost and expensed in the period incurred.

Explanation

Under International Financial Reporting Standards (IFRS), the basis for consolidation is control . IFRS 10 (Consolidated Financial Statements) defines control as the power to govern the financial and operating policies of an entity so as to obtain benefits from its activities. An investor controls an investee when it has (1) power over the investee, (2) exposure or rights to variable returns from its involvement with the investee, and (3) the ability to use its power over the investee to affect the amount of the investor's returns. When control exists, the parent must consolidate the subsidiary's financial statements. This control-based model is the foundation for consolidation under IFRS, making control ownership the correct answer.

Why the other options are incorrect:

A. Variable entity approach – "Variable entity approach" is not the IFRS basis for consolidation. IFRS does address variable interests through the concept of a variable interest entity (VIE) under US GAAP (ASC 810), but the IFRS framework is built on the control model, not a variable entity approach. The term as stated does not represent the IFRS consolidation basis.

C. Risk and reward – Risk and reward is a concept associated with accounting for leases and certain financial instruments, as well as with the older "risks and rewards" model for consolidation. However, under current IFRS (IFRS 10), the basis for consolidation is control, not risk and reward. Risk and reward is not the primary basis for consolidation under IFRS.

D. Voting interest – Voting interest is a US GAAP concept historically used to determine consolidation, such as majority voting interest, usually over 50 percent of voting shares. While voting rights are often an indicator of control, IFRS does not use a purely voting-interest-based model; it uses the broader control model, which can apply even without majority voting interest. Therefore, voting interest alone does not represent the IFRS basis for consolidation.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically consolidation, control, and international financial reporting standards.

Standard financial accounting principles (IFRS 10 — Consolidated Financial Statements) — Consolidation is based on the concept of control, defined through power over the investee, exposure or rights to variable returns, and the ability to use power to affect those returns, rather than solely on voting interest or a risk-and-reward model.