Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation:

Change management is the process of controlling modifications to IT systems, applications, infrastructure, and configurations so that changes are introduced in a controlled and coordinated manner. The fundamental purpose of change management is to protect the production environment — ensuring that changes do not disrupt operations, introduce errors, compromise security, or cause unintended consequences. To achieve this, changes must be managed through a repeatable, defined, and predictable process that includes requesting, reviewing, approving, testing, implementing, and documenting changes. A standardized, repeatable process ensures consistency, reduces risk, and enables the organization to anticipate and control the effects of changes. This makes option D the true statement regarding change management.

Why the other options are incorrect:

A. The degree of risk associated with a proposed change determines whether the change request requires authorization – This is incorrect. All changes generally require some level of authorization, though the level of approval may vary based on the risk and impact of the change (e.g., routine changes may be approved at lower levels, while major changes require senior approval). The degree of risk affects the level or tier of authorization, not whether authorization is required at all.

B. Program changes generally are developed and tested in the production environment
– This is incorrect and represents a significant control weakness. Changes should be developed and tested in a separate development or test environment, never directly in the production environment. Testing in production risks disrupting live operations and exposing the organization to errors and outages.

C. Changes are only required by software programs
– This is incorrect. Changes are not limited to software programs. Change management applies to a wide range of IT components, including hardware, network configurations, operating systems, databases, infrastructure, and documentation. Any modification to the IT environment should be subject to change management.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically IT change management, change control processes, and the protection of the production environment.

Explanation:

A spear phishing attack is a targeted form of phishing in which the attacker impersonates a trusted individual — often a senior executive or a known colleague — and sends a carefully crafted message to specific employees in order to trick them into revealing sensitive information, clicking malicious links, or performing harmful actions. In this scenario, the intruder posed as the organization's CEO and sent an email specifically targeting payroll staff to obtain employees' private tax information. The attack was targeted (aimed at a specific group — payroll staff) and relied on impersonating a trusted authority figure (the CEO) to manipulate the recipients. These are the defining characteristics of a spear phishing attack, making option B the correct answer.

Why the other options are incorrect:

A. Boundary attack
– A boundary attack refers to an attack against the boundary or perimeter of a network (e.g., exploiting weaknesses in firewalls, routers, or network perimeter defenses). In this scenario, the attack did not target a network boundary; it targeted people through a deceptive email, which is a social engineering technique, not a network boundary attack.

C. Brute force attack
– A brute force attack is a method of systematically trying all possible combinations of passwords or keys until the correct one is found, typically to gain unauthorized access to a system. In this scenario, no passwords were cracked or guessed; the attacker used impersonation and deception to obtain information from employees, which is not a brute force attack.

D. Spoofing attack
– Spoofing is a broad term that refers to disguising a communication or device as coming from a trusted source — for example, email spoofing (forging the sender's address) or IP spoofing. While the attacker in this scenario did impersonate the CEO (which could involve some form of spoofing), the overall attack — a targeted, deceptive email designed to trick specific employees into divulging sensitive information — is best described as a spear phishing attack. Spear phishing is the more specific and accurate description of the attack type.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically cybersecurity risks, social engineering, phishing, and spear phishing.

Explanation:

An ethnocentric attitude is a management orientation in which the organization believes that the home country's (parent company's) practices, values, standards, and approaches are superior to those of foreign subsidiaries. In an ethnocentric organization, decision-making authority and control are centralized at headquarters, and the parent company dictates policies, procedures, and practices to its foreign subsidiaries. Headquarters sends orders, commands, and advice to the subsidiaries, and subsidiaries are expected to follow the direction set by the home office. Key positions are typically filled by parent-country nationals (PCNs), and standards for evaluation and control are set by headquarters, not by local subsidiaries. This makes option B the true statement about an ethnocentric organization.

Why the other options are incorrect:

A. Standards used for evaluation and control are determined at local subsidiaries, not set by headquarters
– This describes a polycentric attitude, in which each subsidiary is allowed to operate according to local standards and practices. In an ethnocentric organization, standards are set by headquarters, not by local subsidiaries, so this statement is the opposite of ethnocentrism.

C. People of local nationality are developed for the best positions within their own country
– This describes a polycentric staffing approach, in which host-country nationals (HCNs) are hired and developed for key positions in their own country. In an ethnocentric organization, parent-country nationals typically fill the most important positions worldwide, not local nationals, so this statement is incorrect.

D. There is a significant amount of collaboration between headquarters and subsidiaries
– An ethnocentric organization is characterized by control and direction from headquarters, not by collaboration and shared decision-making. Significant collaboration and mutual exchange between headquarters and subsidiaries is more characteristic of a geocentric attitude, which values a global, integrated approach. In an ethnocentric organization, headquarters dictates and subsidiaries follow, so this statement does not accurately describe ethnocentrism.

Reference:

IIA-CIA-Part3 content area on Business Acumen / International Business and Organizational Behavior
— specifically ethnocentric, polycentric, regiocentric, and geocentric management orientations and staffing approaches.

Explanation:

The discounted payback period is a capital budgeting technique that measures the length of time required for the cumulative discounted cash flows from a project to equal the initial investment. In other words, it calculates the time it takes for a project to break even on a discounted cash flow basis — that is, the point at which the present value of the cash inflows recovered equals the initial investment outlay. Unlike the simple payback period, the discounted payback period incorporates the time value of money by discounting future cash flows to their present value before determining how long recovery takes. This makes option C the true statement.

Why the other options are incorrect:

A. It calculates the overall value of a project
– The discounted payback period does not calculate the overall value of a project; it only measures how long it takes to recover the initial investment on a discounted basis. Measuring overall value (the net increase in value) is the role of net present value (NPV), not the discounted payback period. The discounted payback period ignores cash flows that occur after the payback period, so it does not capture the project's total value.

B. It ignores the time value of money
– This is incorrect. The discounted payback period specifically incorporates the time value of money by discounting future cash flows to their present value before determining the payback period. It is the traditional (simple) payback period that ignores the time value of money, not the discounted payback period.

D. It begins at time zero for the project
– While it is true that the initial investment typically occurs at time zero in capital budgeting analysis, this statement is not the distinguishing or defining characteristic of the discounted payback period. Many capital budgeting techniques begin at time zero (e.g., NPV, IRR, simple payback). This statement is true of capital budgeting generally but does not specifically describe what the discounted payback period calculates. Option C is the more accurate and specific description of the technique.

Reference:

IIA-CIA-Part3 content area on Financial Management — specifically capital budgeting techniques, including payback period, discounted payback period, net present value, and internal rate of return.

Explanation:

An organizational chart is a diagram that depicts the formal structure of an organization, including reporting lines, hierarchical levels, departmental divisions, and the chain of authority. One of its key limitations is that it shows only formal relationships — that is, the officially designated reporting lines and authority structures. It does not capture the informal relationships, communication patterns, influence networks, and day-to-day working interactions that also shape the control environment. Informal relationships can significantly affect how controls operate in practice (e.g., employees may bypass formal channels, or influence may reside with individuals not reflected in the chart). Because the organizational chart presents only the formal structure, it provides an incomplete picture of the control environment, making this the correct disadvantage.

Why the other options are incorrect:

B. The organizational chart shows only the line of authority
– While the organizational chart does show lines of authority, it typically also shows departmental structure, reporting relationships, and sometimes staff (advisory) relationships. Saying it shows "only" the line of authority is too narrow and not the primary disadvantage. The more fundamental limitation is that it captures formal relationships only, not informal ones.

C. The organizational chart shows only the senior management positions
– This is incorrect. An organizational chart typically depicts positions at multiple levels of the organization, not just senior management. It shows the hierarchy from top to bottom, including subordinate roles and departments.

D. The organizational chart is irrelevant when testing the control environment
– This is incorrect. The organizational chart is relevant and useful for understanding the control environment because it helps the auditor identify reporting lines, segregation of duties, and the assignment of authority and responsibility. It is not irrelevant; it simply has limitations, the most significant being that it reflects only formal relationships.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Internal Control and Governance— specifically the control environment, organizational structure, and the use of organizational charts in audit.

Explanation:

Jailbreaking (or rooting) a smart device involves bypassing the manufacturer's and carrier's administrative restrictions to gain privileged access to the device's operating system. This practice often involves circumventing digital rights management (DRM) protections, altering or installing unauthorized software, and using the device in ways that violate licensing agreements and terms of service. As a result, jailbreaking can increase the risk of infringing local regulations such as copyright laws (e.g., by circumventing DRM or using pirated applications) and privacy laws (e.g., by installing apps that collect data in ways that violate privacy regulations, or by disabling security features that protect personal data). In a BYOD environment, allowing or tolerating jailbroken devices exposes the organization to legal and regulatory risk, making this the practice most likely to increase the risk of infringement on local regulations.

Why the other options are incorrect:

A. Not installing anti-malware software
– Failing to install anti-malware software increases the risk of malware infection and data compromise, but it is primarily a security risk rather than a legal or regulatory compliance risk. It does not directly relate to copyright or privacy law infringement.

B. Updating operating software in a haphazard manner
– Irregular or haphazard software updates create security vulnerabilities and stability issues, but they do not directly increase the risk of infringing copyright or privacy laws. This is primarily a security and patch management concern.

C. Applying a weak password for access to a mobile device
– A weak password increases the risk of unauthorized access and data breach, which is a security risk. While a data breach could have regulatory implications, the weak password itself does not directly cause infringement of copyright or privacy laws in the way that jailbreaking does.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically BYOD risks, mobile device security, and legal/regulatory compliance considerations.

Explanation:

In the three lines of defense model, the second line of defense consists of risk management and compliance functions that provide oversight, guidance, and monitoring of the first line (operational management, which owns and manages risk directly). The second line is responsible for establishing risk management frameworks, monitoring risks and controls, and reviewing the effectiveness of risk management activities performed by the first line. Reviewing disaster recovery test results is a second-line activity because it involves oversight and monitoring — the second line reviews the results of disaster recovery testing conducted by the first line (IT operations) to assess whether the organization's recovery capabilities are adequate and whether remediation is needed. This fits the oversight and monitoring role of the second line of defense.

Why the other options are incorrect:

A. Block unauthorized traffic
– Blocking unauthorized traffic is an operational control performed by the first line of defense (e.g., IT operations or network security teams). The first line owns and manages risk directly through day-to-day operational controls, so this is not a second-line activity.

B. Encrypt data
– Encrypting data is also an operational control implemented by the first line of defense (e.g., IT staff or system administrators). It is a hands-on technical control, not an oversight or monitoring function, so it belongs to the first line, not the second.

D. Provide independent assessment of IT security
– Providing independent assessment of IT security is the role of the third line of defense — internal audit. Internal audit provides independent, objective assurance and consulting services and reports to the board and senior management. The second line provides oversight and monitoring, but the independent assessment function belongs to the third line.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Governance and Risk Management — specifically the three lines of defense model and the roles and responsibilities of each line.

Explanation:

Data corruption and errors occur when data is incorrectly entered, processed, or altered, resulting in inaccurate or incomplete information. The most efficient control to protect business data from corruption and errors is one that detects errors at the point of processing before the data is accepted or approved. Batch totals (also called control totals or hash totals) are an example of such a control: they calculate totals (e.g., sums of amounts, record counts, or hash values) for a batch of transactions and compare them before and after processing to verify that all records were processed correctly and that no data was lost, duplicated, or altered. By identifying errors before approval, batch total controls prevent corrupted or erroneous data from entering or affecting the system, making them a highly efficient preventive/detective control against data corruption and errors. This makes option B the most appropriate answer.

Why the other options are incorrect:

A. Controls to ensure data is unable to be accessed without authorization
– Authorization controls (access controls) protect data from unauthorized access, which addresses confidentiality and security, but they do not directly prevent or detect data corruption and errors caused by incorrect entry, processing mistakes, or system faults. Access controls reduce the risk of intentional tampering but do not address accidental errors or processing corruption.

C. Controls to encrypt the data so that corruption is likely ineffective
– Encryption protects the confidentiality of data by making it unreadable without the decryption key. It does not prevent or detect data corruption or errors — corrupted data remains corrupted whether or not it is encrypted. Encryption is a confidentiality control, not an integrity control, so it is not the most efficient control for protecting against corruption and errors.

D. Controls to quickly identify malicious intrusion attempts
– Controls that identify malicious intrusion attempts (e.g., intrusion detection systems) address security threats from attackers, not data corruption and errors caused by processing mistakes, incorrect entry, or system faults. While important for security, they do not directly protect against data corruption and errors in the way batch total controls do.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically application controls, data integrity controls, and error detection.

Explanation:

Inventory turnover is calculated as cost of goods sold divided by average inventory. If inventory is overstated (i.e., reported at a value higher than its actual economic value or cost), the denominator in the inventory turnover ratio increases, which causes the inventory turnover to decline. At the same time, if ending inventory is overstated, cost of goods sold is understated (because COGS = Beginning Inventory + Purchases − Ending Inventory). An understated COGS means gross profit is higher, which increases the gross margin rate. Therefore, an overstatement of inventory can simultaneously cause a declining inventory turnover (due to the inflated denominator) and an increasing gross margin rate (due to the understated COGS). This makes inventory overstatement the best explanation for the situation described.

Why the other options are incorrect:

A. The organization's operating expenses are increasing
– Operating expenses affect operating income and net income, but they do not affect gross margin, which is calculated as sales minus cost of goods sold. Gross margin is determined before operating expenses are deducted. Increasing operating expenses would not explain an increasing gross margin rate, nor would it directly explain declining inventory turnover.

B. The organization has adopted just-in-time inventory
– Just-in-time (JIT) inventory systems typically reduce inventory levels, which would increase inventory turnover (because average inventory decreases), not decrease it. JIT also tends to reduce holding costs and improve efficiency, but it does not explain an increasing gross margin rate combined with declining inventory turnover.

C. The organization is experiencing inventory theft
– Inventory theft would reduce actual inventory below recorded amounts, potentially leading to understated inventory, not overstated inventory. Theft would typically cause inventory shrinkage and could result in a lower gross margin if the theft is recognized as a loss, and it would not directly explain an increasing gross margin rate.

Reference:

IIA-CIA-Part3 content area on Financial Management — specifically financial ratio analysis, inventory turnover, gross margin, and the effects of inventory misstatement.

Explanation:

A strategic plan is a formal document that outlines an organization's long-term direction, objectives, and the actions needed to achieve them. When examining a strategic plan, an internal auditor should expect to find the identification of achievable goals and timelines — that is, specific, measurable objectives the organization intends to accomplish, along with the timeframes within which they are to be achieved. Goals provide direction, and timelines establish the schedule for accomplishing them, making these core components of any strategic plan. This makes option A the correct answer.

Why the other options are incorrect:

B. Analysis of the competitive environment
– An analysis of the competitive environment (e.g., SWOT analysis, industry analysis, competitor assessment) is typically an input to the strategic planning process rather than a component of the strategic plan itself. While the strategic plan may summarize key environmental findings, the detailed competitive analysis is generally part of the supporting analysis that informs the plan, not a required component of the plan document itself.

C. Plan for the procurement of resources
– A plan for procuring resources (e.g., funding, staffing, equipment) is more closely associated with operational planning, budgeting, or implementation planning than with the strategic plan itself. The strategic plan sets direction and goals; resource procurement plans are typically developed as part of the operational plans that support the strategy.

D. Plan for progress reporting and oversight
– A plan for progress reporting and oversight (e.g., monitoring, performance measurement, governance) is typically part of the implementation and monitoring framework that follows the strategic plan, rather than a core component of the strategic plan itself. While the strategic plan may include some high-level monitoring considerations, the detailed reporting and oversight plan is usually developed separately as part of execution and performance management.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Strategic Management — specifically strategic planning, strategic plan components, and the auditor's role in reviewing strategic plans.

Explanation:

Data analytics in an audit engagement generally follows a logical sequence: define the objectives and expected value of the analysis, obtain the data, normalize/clean the data, analyze the data, and interpret and report the results. Once the internal auditor has ascertained the value expected from the review — that is, determined what the analysis is intended to achieve and what benefit it will provide — the next step is to obtain the data needed to perform the analysis. Without the data, no further steps (normalization, analysis, or interpretation) can be performed. This makes obtaining the data the logical and necessary next step after establishing the expected value of the review.

Why the other options are incorrect:

A. Normalize the data
– Normalizing (cleaning and standardizing) the data comes after the data has been obtained. The auditor cannot normalize data that has not yet been acquired, so this step follows obtaining the data rather than preceding it.

C. Identify the risks
– Identifying risks is part of the audit planning process and typically occurs before or during the definition of the engagement objectives. Once the expected value of the data analytics review has been determined, the immediate next step is to obtain the data needed to perform the analysis, not to identify risks again.

D. Analyze the data
– Analyzing the data occurs after the data has been obtained and normalized. Since the data has not yet been acquired, analysis cannot be the next step. The correct sequence is to obtain the data first, then normalize it, and then analyze it.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics — specifically the data analytics process in audit engagements, including defining objectives, obtaining data, cleansing/normalizing data, analyzing data, and reporting results.

Explanation:

When using data analytics in an audit or review of the procurement process, the first step is to define the questions to be answered — that is, to clarify the objectives of the analysis and determine what the auditor wants to learn or verify. This step establishes the purpose and direction of the analytics work, ensuring that the analysis is focused, relevant, and aligned with the engagement objectives. Only after the questions and objectives are clearly defined can the auditor determine which data sources are needed, what data to extract, how to analyze it, and what constitutes an anomaly. Without defining the questions first, the analysis risks being unfocused, inefficient, and ineffective. This makes defining the questions to be answered the correct first step.

Why the other options are incorrect:

A. Identify data anomalies and outliers
– Identifying anomalies and outliers is part of performing the analysis, which occurs after the questions have been defined and the data has been obtained. It is not the first step; the auditor must first know what questions to ask and what data to examine before anomalies can be meaningfully identified.

C. Identify data sources available – Identifying data sources is an important step, but it comes after the questions to be answered have been defined. The auditor must first determine what questions need answering in order to know which data sources are relevant and available.

D. Determine the scope of the data extract
– Determining the scope of the data extract (e.g., which fields, which time period, which transactions) follows from the defined questions and the identified data sources. It is a subsequent step, not the first, because the scope depends on what questions the auditor is trying to answer.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics — specifically the data analytics process in audit engagements, including defining objectives and questions, identifying data sources, extracting data, and analyzing data.