Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation

Automated attacks that attempt to identify weak or leaked passwords, such as brute-force attacks, credential stuffing, and password spraying, rely on the attacker obtaining or guessing a valid password to log into employee accounts. Requiring two-step verification (also called two-factor authentication or multi-factor authentication) for all users is the most effective measure to protect against these attacks because it adds a second authentication factor beyond the password. Even if an attacker successfully identifies or obtains a weak or leaked password, they cannot log in without the second factor, such as a one-time code, hardware token, or biometric verification. This makes two-step verification the best protection against password-based automated attacks.

Why the other options are incorrect:

A. Requiring users to change their passwords every two years
– A two-year password change interval is far too long to be effective and does not address the core vulnerability. Even with periodic changes, weak or leaked passwords can still be exploited. Moreover, frequent password changes can lead to poor password choices. This measure does not provide strong protection against automated password attacks.

C. Requiring the use of a virtual private network (VPN) when employees are out of the office
– A VPN encrypts the connection between a remote user and the organization's network, protecting data in transit. While a VPN is a valuable security control, it does not prevent an attacker from using a weak or leaked password to log into an employee's account. Once the attacker has valid credentials, a VPN alone does not stop unauthorized access if the attacker can connect through the VPN with those credentials.

D. Requiring the use of up-to-date antivirus, security, and event management tools
– Antivirus software, security tools, and event management systems help detect and respond to malware and security incidents, but they do not prevent an attacker from logging in with a valid password. These tools are important for overall security but are not the primary control against password-based automated attacks.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically authentication controls, multi-factor authentication, and protection against password-based attacks.

Explanation

Data cleansing, also called data cleaning or scrubbing, is the process of detecting and correcting or removing inaccurate, incomplete, duplicated, or irrelevant data from a data set before analysis. Eliminating duplicate records is a core data cleansing activity because duplicates can distort analytical results, inflate counts, and lead to incorrect conclusions. By removing duplicate records, the internal auditor ensures that the data set is accurate, consistent, and reliable for analytics purposes. This makes eliminating duplicate records the correct action for cleaning data obtained for analytics.

Why the other options are incorrect:

A. Deploys data visualization tool
– Deploying a data visualization tool is an analytics technique used to present and explore data graphically, such as charts and dashboards. It is not a data cleansing activity; it occurs after the data has been prepared and cleaned.

B. Adopt standardized data analysis software
– Adopting standardized data analysis software is a tooling and standardization decision. While it can support analytics, it does not itself clean the data. Choosing software is separate from the process of identifying and correcting data quality issues.

C. Define analytics objectives and establish outcomes
– Defining analytics objectives and establishing outcomes is part of the planning phase of an analytics project. It determines what the auditor wants to achieve, not how the data is cleaned. It precedes data cleansing and does not address data quality issues such as duplicates, errors, or inconsistencies.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics — Specifically data preparation, data cleansing, and data quality.

Explanation

The most relevant control to reduce the risk of project cost overruns is a formal process to monitor the project's status and compare actual performance against the cost baseline. The cost baseline is the approved, time-phased budget against which project performance is measured. By regularly monitoring project status and comparing actual costs to the baseline, management can detect variances early, identify the causes of cost overruns, and take corrective action before the situation worsens. This ongoing monitoring and comparison is the core control for keeping project costs within budget, making it the most relevant control for reducing the risk of cost overruns.

Why the other options are incorrect:

A. Scope change requests are reviewed and approved by a manager with a proper level of authority – While proper approval of scope changes is important for controlling scope creep, which can lead to cost overruns, it addresses only one source of cost overruns, unapproved scope changes. It does not provide ongoing monitoring of actual costs against the budget, so it is not the most comprehensive or relevant control for reducing cost overrun risk overall.

B. Cost overruns are reviewed and approved by a control committee led by the project manager – Having cost overruns reviewed and approved by a committee led by the project manager is problematic because the project manager has a vested interest in the project and may not provide objective oversight. This arrangement also addresses overruns only after they have already occurred, rather than preventing or detecting them early. It is not a strong control against cost overruns.

C. There is a formal quality assurance process to review scope change requests before they are implemented – A quality assurance process that reviews scope changes is useful for ensuring changes meet quality and scope requirements, and it can help control scope-related cost impacts. However, like option A, it addresses only one dimension, scope changes, and does not directly monitor actual costs against the cost baseline. It is not the most relevant control for reducing the risk of cost overruns overall.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Project Management — Specifically project cost management, cost control, and the cost baseline.

Explanation

When collecting information about employees' job satisfaction, the best method is one that encourages honest, candid responses while reaching a representative sample of employees. Online surveys sent randomly to employees are particularly effective for this purpose because they offer anonymity (or at least confidentiality), which encourages employees to respond truthfully without fear of reprisal or pressure from management. Random selection helps ensure the sample is representative of the broader employee population, reducing bias. Online surveys are also efficient, allow standardized questions, and can reach employees across different locations and shifts. This makes them the best method among the options for collecting information about job satisfaction.

Why the other options are incorrect:

B. Direct onsite observations of employees
– Direct observation involves watching employees as they work. While it can provide information about behavior and working conditions, it does not effectively measure job satisfaction, which is an attitude, feeling, or perception. Observation cannot capture employees' internal feelings, and the presence of an observer may alter behavior and introduce bias.

C. Town hall meetings with employees
– Town hall meetings are large-group gatherings where management communicates with employees and may receive questions or feedback. While they can provide some general insight into employee sentiment, they are not an effective method for systematically collecting job satisfaction data. Employees may be reluctant to speak honestly in a public forum, and the format does not provide anonymity or structured, comparable data.

D. Face-to-face interviews with employees
– Face-to-face interviews can yield rich, detailed information about job satisfaction, but they are less effective than anonymous surveys for this purpose. Employees may be hesitant to express dissatisfaction openly to an interviewer, especially if they fear their responses could be identified and held against them. Interviews are also time-consuming and difficult to conduct with a large, representative sample. While useful as a supplement, they are not the best primary method for collecting job satisfaction information.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior and Audit Evidence — Specifically methods of collecting information, including surveys, interviews, observation, and meetings, and their appropriateness for different objectives.

Explanation

The primary driver behind the creation and prioritization of new strategic initiatives is the identification of threats and opportunities facing the organization. Strategic initiatives are developed in response to changes in the external and internal environment, such as emerging market opportunities, competitive threats, technological changes, regulatory shifts, and customer needs. By assessing threats, which may harm the organization, and opportunities, which may benefit it, management determines what new initiatives are needed and how to prioritize them based on their potential impact and alignment with organizational objectives. This makes threats and opportunities the fundamental driver behind strategic initiative creation and prioritization.

Why the other options are incorrect:

A. Risk tolerance
– Risk tolerance is the amount of risk an organization is willing to accept in pursuit of its objectives. While risk tolerance influences how much risk the organization is willing to take when pursuing initiatives, it is not the primary driver behind the creation of those initiatives. Initiatives are created in response to threats and opportunities; risk tolerance shapes the boundaries within which the organization pursues them.

B. Performance
– Performance refers to how well the organization is achieving its objectives. While performance results may indicate the need for new initiatives, for example, underperformance may prompt corrective action, performance is a consideration or input rather than the primary driver. The fundamental driver is the identification of threats and opportunities in the environment that the organization must respond to.

D. Governance
– Governance refers to the structures, processes, and practices by which the organization is directed, controlled, and held accountable. Governance provides oversight and decision-making mechanisms for approving and monitoring strategic initiatives, but it is not the driver behind their creation. Threats and opportunities are what prompt the organization to develop new initiatives in the first place.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Strategic Management — Specifically strategic planning, environmental scanning, and the drivers of strategic initiatives.

Explanation

Management by objectives (MBO) is a performance management approach in which managers and employees jointly set specific, measurable goals, monitor progress, and evaluate performance based on goal achievement. A key principle of MBO is participative goal setting, that is, goals are established collaboratively with input from employees at all levels, not imposed solely by management. When goal setting involves all team members, including lower-level staff, employees are more likely to understand, accept, and commit to the goals, which increases motivation, engagement, and the overall success of the approach. This participative nature is central to MBO, making option C the true statement.

Why the other options are incorrect:

A. It is particularly helpful to management when the organization is facing rapid change
– MBO relies on setting stable, measurable objectives over a defined period. In rapidly changing environments, objectives can quickly become obsolete, making MBO less effective. MBO is better suited to relatively stable environments where goals can be set and pursued over a reasonable timeframe.

B. It is a more successful approach when adopted by mechanistic organizations
– MBO emphasizes participation, communication, and individual goal setting, which aligns better with organic, flexible structures. Mechanistic organizations with rigidly defined tasks and centralized authority offer less room for the participative goal setting that makes MBO effective, so MBO is not more successful in mechanistic organizations.

D. It is particularly successful in environments that are prone to having poor employer-employee relations
– MBO depends on trust, communication, and collaboration between managers and employees. In environments with poor employer-employee relations, the participative and collaborative aspects of MBO are undermined, making it less likely to succeed. MBO is more successful where relationships are healthy and there is mutual trust.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically performance management approaches, including management by objectives, participative goal setting, and employee motivation.

Explanation

The cost principle, also called the historical cost principle, requires that assets be recorded and reported at their original acquisition cost, regardless of changes in market value over time. Under this principle, a building purchased for $1 million should continue to be reported at $1 million, less any accumulated depreciation, even if its current market value has increased to $1.2 million. This is exactly what option B describes: the building's market value has risen, but the company continues to report it at its original cost of $1 million. This best demonstrates the application of the cost principle.

Why the other options are incorrect:

A. A company reports trading and investment securities at their market cost
– Trading and investment securities are typically reported at fair (market) value, not at historical cost, under applicable accounting standards. Reporting securities at market value reflects the fair value measurement principle, not the cost principle, so this does not demonstrate the cost principle.

C. A building purchased last year for $1 million is currently worth $1.2 million, and the company adjusts the records to reflect the current value
– Adjusting the building's recorded value upward to reflect its current market value violates the cost principle. Under the cost principle, the building should remain at its original cost, less depreciation, rather than being written up to market value. This option illustrates a departure from the cost principle rather than its application.

D. A company reports assets at either historical or fair value, depending on which is closer to market value
– This statement describes a mixed or selective approach to valuation that is not consistent with the cost principle. The cost principle requires reporting at historical cost, not choosing between historical and fair value based on which is closer to market value. This option misstates the principle.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically accounting principles, including the cost (historical cost) principle, fair value measurement, and asset valuation.

Explanation:

Physical controls are measures designed to protect an organization's physical assets — such as people, facilities, equipment, and IT infrastructure — from physical threats like fire, flood, theft, vandalism, and unauthorized access. Providing fire detection and suppression equipment (e.g., smoke detectors, fire alarms, sprinkler systems, and fire extinguishers) is a physical control because it directly protects the physical environment and equipment from fire damage. It is a tangible, physical safeguard installed in the facility to detect and extinguish fires, making it a clear example of a physical control.

Why the other options are incorrect:

B. Establishing a physical security policy and promoting it throughout the organization
– Establishing and promoting a physical security policy is an administrative (or policy) control, not a physical control. While it governs how physical security is managed, the policy itself is a documented directive rather than a physical safeguard. Physical controls are the actual tangible measures (locks, barriers, fire suppression, surveillance) implemented to protect assets.

C. Performing business continuity and disaster recovery planning
– Business continuity and disaster recovery planning are administrative (management) controls. They involve developing plans and procedures to maintain or restore operations after a disruption, but they are not physical safeguards. They are processes and documentation, not physical measures.

D. Keeping an offsite backup of the organization's critical data
– Keeping an offsite backup is a data protection and recovery control (often categorized as a logical or administrative control, or as part of disaster recovery). While it involves the physical storage of backup media, its primary purpose is data availability and recovery, not the physical protection of assets from physical threats. It is more accurately classified as a recovery or data protection control rather than a physical control in the sense of protecting physical assets.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically types of controls, including physical, administrative, and technical controls, and the protection of physical assets.

Explanation

According to Maslow's hierarchy of needs theory, human needs are arranged in a hierarchy: physiological needs, safety needs, social (belonging) needs, esteem needs, and self-actualization needs. Lower-level needs, such as physiological and safety needs, must generally be satisfied before higher-level needs become motivating. If an employee's lower-level needs are already met, meaning physiological needs such as adequate pay for basic living and safety needs such as job security and safe working conditions are satisfied, then higher-level needs become the primary motivators. Among the options provided, recognition addresses esteem needs, including achievement, respect, appreciation, and acknowledgment from others. Recognition can be an important motivator for retention because it makes employees feel valued and appreciated, fulfilling esteem needs that become prominent once lower-level needs are met. This makes recognition the option most likely to have the greatest impact on retaining staff in this situation.

Why the other options are incorrect:

A. Social benefits
– Social benefits, such as team events, social activities, and a sense of belonging, address social needs, which are lower in the hierarchy than esteem needs. While social needs are important, they are below esteem needs. If lower-level needs are already met, the next most impactful motivator would be at the esteem level, recognition, rather than the social level, though social needs are also relevant.

B. Compensation
– Compensation primarily addresses physiological and safety needs, such as the ability to meet basic living expenses and achieve financial security. Since the question states that lower-level needs are already met, compensation would be less impactful as a retention tool at this stage. Its motivating effect diminishes once basic needs are satisfied.

C. Job safety
– Job safety addresses safety needs, which are lower-level needs in Maslow's hierarchy. If lower-level needs are already met, job safety is already satisfied and would not be the most impactful factor for retention at this point.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically motivation theories, including Maslow's hierarchy of needs and employee retention.

Explanation:

Indirect labor related to the production of a key product is a manufacturing overhead cost, which is a product cost under absorption costing. Product costs (direct materials, direct labor, and manufacturing overhead, including indirect labor) are attached to the units produced and are not expensed immediately. Instead, they are recorded on the balance sheet as part of inventory (work in process or finished goods) until the related goods are sold. Only when the goods are sold do these costs flow to the income statement as cost of goods sold. Since the indirect labor was incurred in connection with production and the goods have not necessarily been sold by year-end, the cost should be reported on the balance sheet as part of inventory, making option D the correct answer.

Why the other options are incorrect:

A. It should be reported as an administrative expense on the income statement
– Administrative expenses are period costs related to general management and administration, not production. Indirect labor related to manufacturing a product is a product cost, not an administrative expense, so it should not be reported as such.

B. It should be reported as period cost other than a product cost on the management accounts
– This is incorrect. Indirect labor related to production is a product cost, not a period cost. Period costs (such as selling and administrative expenses) are expensed in the period incurred, whereas product costs are inventoried until the related goods are sold. The statement misclassifies the cost.

C. It should be reported as cost of goods sold on the income statement
– Indirect labor becomes part of cost of goods sold only when the related finished goods are sold. If the goods remain in inventory at year-end, the cost should not yet be reported as cost of goods sold. Because the question does not state that the goods were sold, the cost should remain in inventory on the balance sheet.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — specifically product costs versus period costs, manufacturing overhead, and inventory valuation.

Explanation:

A quality audit is a systematic, independent examination of a project's processes, procedures, and activities to determine whether they comply with established standards, policies, and requirements. When an internal auditor wants to measure the project team's performance related to how project tasks are completed — that is, whether the work is being performed according to defined quality standards, processes, and methodologies — a quality audit is the most appropriate tool. Quality audits evaluate the effectiveness and efficiency of the project team's work processes, identify areas for improvement, and verify compliance with quality requirements and organizational standards. This makes a quality audit the best choice for assessing how project tasks are completed.

Why the other options are incorrect:

A. A balanced scorecard
– A balanced scorecard is a strategic performance measurement framework that tracks performance across multiple perspectives (financial, customer, internal processes, and learning and growth). While it can be used to measure organizational or project performance at a high level, it is not specifically designed to assess how project tasks are completed against quality standards and processes, so it is not the most appropriate tool for this purpose.

C. Earned value analysis
– Earned value analysis (EVA) is a project performance measurement technique that integrates scope, schedule, and cost data to assess project performance in terms of cost and schedule variances (e.g., whether the project is ahead of or behind schedule, over or under budget). It measures project performance in terms of time and cost, not how tasks are completed in terms of quality or process compliance, so it is not the best answer.

D. Trend analysis
– Trend analysis examines data over multiple periods to identify patterns, direction, and rates of change. While it can be used to assess performance trends, it does not specifically evaluate how project tasks are completed against quality standards and processes, so it is not the most appropriate tool for measuring the project team's performance related to task completion.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Project Management — specifically project quality management, quality audits, and performance measurement in software development projects.

Explanation:

A right-to-audit clause is a contractual provision that grants an organization (or its internal auditors) the right to audit a third-party service provider's systems, processes, and controls — particularly those that affect the organization's data or operations. To exercise this right effectively, the organization or its auditors need appropriate access to the third party's systems. Requesting that the third party create audit or "read-only" functionalities gives the organization (or its auditors) the ability to view and examine relevant data, records, and system configurations without the ability to modify them. This read-only access directly supports the execution of the right-to-audit clause, because it enables the organization to perform audit procedures, verify controls, and review the third party's processing of payroll data. This makes option A the true statement.

Why the other options are incorrect:

B. This will enforce robust risk assessment practices
– Read-only audit access does not, by itself, enforce robust risk assessment practices. Risk assessment is a broader management process that involves identifying, analyzing, and evaluating risks; providing audit access is a control mechanism that supports oversight, not a method for enforcing risk assessment practices.

C. This will address cybersecurity considerations and concerns
– While limiting access to read-only can reduce the risk of unauthorized changes and support security, the primary purpose of requesting audit or read-only functionality is to enable audit access, not to address cybersecurity concerns generally. Cybersecurity is a broader set of controls and practices; read-only access is a specific access control that supports auditing, not a comprehensive cybersecurity solution.

D. This will enhance the third party's ability to apply data analytics
– Read-only audit access granted to the organization or its auditors is intended to benefit the organization's auditing and oversight activities, not to enhance the third party's data analytics capabilities. The third party's analytics capabilities are separate from the organization's right to audit its systems.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Third-Party Risk Management and IT Governance — specifically right-to-audit clauses, third-party assurance, and audit access.