Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation:

Effective risk mitigation and management requires a combination of preventive measures and reactive measures. Preventive measures are designed to reduce the likelihood of a crisis or event occurring or to minimize its impact before it happens — for example, implementing controls, training employees, maintaining insurance, and establishing security measures. Reactive measures are designed to respond to and manage a crisis or event after it has occurred — for example, crisis response plans, disaster recovery procedures, incident response teams, and business continuity arrangements. To effectively mitigate and manage the risks created by a crisis or event, an organization must not only work to prevent incidents (preventive) but also be prepared to respond and recover when incidents occur (reactive). This combination provides comprehensive risk management, making option D the correct answer.

Why the other options are incorrect:

A. Only preventive measures
– Relying solely on preventive measures is insufficient because no preventive control can eliminate all risks. Even with strong preventive measures, crises and events can still occur (e.g., natural disasters, novel cyberattacks). Without reactive measures, the organization would be unprepared to respond and recover, leaving it exposed to greater damage.

B. Alternative and reactive measures
– While reactive measures are important, this option omits preventive measures. "Alternative measures" is not a standard risk management category and does not clearly address risk mitigation. Effective risk management requires prevention as well as response, so this option is incomplete and imprecise.

C. Preventive and alternative measures
– This option includes preventive measures but omits reactive measures, which are essential for responding to and recovering from crises and events that occur despite preventive efforts. "Alternative measures" is also not a recognized risk management category, so this option is incomplete.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Risk Management and Business Continuity — specifically risk mitigation strategies, including preventive, detective, and corrective/reactive controls.

Explanation

Data normalization is the step in the data analytics process where the auditor standardizes data from different sources so that it can be accurately compared and matched. In this scenario, the auditor extracted employee data from two different systems, human resources and payroll, and matched the data sets by name. However, very few employees matched across the data sets, producing seemingly erroneous results. The most likely cause is that the data was not normalized, that is, the names in each data set were formatted or recorded differently, such as "John A. Smith" versus "Smith, John," use of middle initials, nicknames, maiden names, or differences in spacing, capitalization, or punctuation. Without normalizing the data by standardizing formats, trimming spaces, converting case, or splitting and combining name fields, the matching process can fail even though the same employees exist in both systems. This makes data normalization the step the auditor most likely omitted.

Why the other options are incorrect:

A. Data analysis
– The auditor did perform data analysis by matching the data sets and identifying unmatched employees. The issue is not that analysis was omitted, but that the analysis was performed on data that had not been standardized, leading to unreliable matches. The omitted step is the preparation step, normalization, not the analysis itself.

B. Data diagnostics
– While data diagnostics involves examining data for quality issues, including inconsistencies, the specific problem described, mismatched names due to differing formats across data sets, is most directly addressed by data normalization, which standardizes the data so it can be matched. Diagnostics identifies that a problem exists; normalization corrects the formatting inconsistencies so the matching can work properly. Given the scenario, normalization is the more precise and relevant omitted step.

C. Data velocity
– Data velocity refers to the speed at which data is generated, transmitted, and processed, which is a characteristic of big data rather than a step in the data analytics process. It is not a step the auditor would omit, and it does not explain the matching problem.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics — Specifically the data analytics process, including data normalization, data diagnostics, and data cleansing.

Explanation

Vertical integration occurs when an organization expands its operations to include activities that were previously performed by third parties in its supply chain or distribution channel, either upstream, toward suppliers, or downstream, toward customers. In this scenario, the restaurant decided to handle its own delivery services rather than relying on third-party food delivery services. By bringing the delivery function in-house, the restaurant is taking control of a downstream distribution activity that was previously outsourced to external providers. This is a classic example of vertical integration, specifically forward or downstream vertical integration, making option B the correct answer.

Why the other options are incorrect:

A. Diversification
– Diversification involves expanding into new products, services, or markets that are different from the organization's current business. While adding delivery services is a new activity, it is directly related to the restaurant's existing core business of preparing and selling food. The restaurant is not entering an unrelated business; it is bringing a related distribution function in-house. Therefore, this is not diversification.

C. Risk avoidance
– Risk avoidance involves eliminating a risk by not engaging in the activity that creates it. While the restaurant may be seeking to reduce its dependence on third-party delivery services, and the risks associated with them, such as loss of control over customer experience or fees, the decision to provide its own delivery is not primarily an example of risk avoidance. It is an operational and strategic decision to integrate a function, so vertical integration is the better description.

D. Differentiation
– Differentiation is a competitive strategy in which an organization offers unique or superior products or services that customers value, allowing it to charge a premium. While providing its own delivery service could potentially differentiate the restaurant from competitors, the defining characteristic of this decision is that the restaurant is taking over a function previously performed by third parties, which is vertical integration, not differentiation.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Strategic Management — Specifically corporate-level strategies, including vertical integration, diversification, and competitive strategies.

Explanation

Legitimate authority, also called positional power, is the authority that comes from a person's formal position or role within the organization. It is based on the recognition that the individual has the formal right, granted by the organization, to make decisions, issue directives, and allocate resources within the scope of their role. In this scenario, the technician was granted a role that enables him to prioritize projects throughout the organization. Because this authority was formally assigned to him through his organizational role, he is exercising legitimate authority, the power that derives from his formal position and the organization's recognition of his right to make those decisions. This makes legitimate authority the correct answer.

Why the other options are incorrect:

B. Coercive authority – Coercive authority is based on the ability to punish or threaten punishment to influence behavior, such as the power to demote, dismiss, or discipline. There is no indication in the scenario that the technician's ability to prioritize projects is based on coercive power or the threat of punishment, so this is not the correct type of authority.

C. Referent authority – Referent authority is based on personal characteristics, admiration, and identification, the power that comes from being liked, respected, or admired by others. It is not derived from a formal role or position. Since the technician's authority to prioritize projects comes from his formal role, not from personal admiration, referent authority is not the correct answer.

D. Expert authority – Expert authority is based on a person's specialized knowledge, skills, or expertise. While a technician may possess technical expertise, the authority to prioritize projects throughout the organization is not based on expertise alone but on the formal role granted to him by the organization. Therefore, legitimate authority is the better answer.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically types of authority and power in organizations, including legitimate, coercive, referent, and expert authority.

Standard organizational behavior theory (French and Raven's bases of power) — Legitimate authority derives from a person's formal position or role in the organizational hierarchy, and the right to make decisions within that role is granted by the organization.

Explanation

Office supplies on hand is an asset account that must be adjusted at the end of the period to reflect the actual supplies remaining, based on a physical count. The adjusting entry brings the asset account to its correct ending balance and records the supplies used, or expense, during the period.

* Beginning balance, end of year one = $9,000
* Purchases during year two were recorded as an expense of $45,000, debited to Supplies Expense.
* Physical count at end of year two = $11,500, which is the desired ending balance of the asset.

Because the purchases were expensed when acquired, the Office Supplies on Hand account still shows the beginning balance of $9,000. To bring it up to the actual ending balance of $11,500, the account must be increased, or debited, by:

$11,500 − $9,000 = $2,500

The adjusting entry at the end of year two is therefore a debit to Office Supplies on Hand for $2,500 and a corresponding credit to Supplies Expense for $2,500, reducing the expense to reflect the supplies still on hand. This makes option A the correct answer.

Why the other options are incorrect:

B. A debit to office supplies on hand for $11,500 – This would set the asset account to $11,500 without considering the existing $9,000 balance already in the account, resulting in a total balance of $20,500. The adjustment should be the difference between the desired ending balance and the existing balance, which is $2,500, not the full ending balance.

C. A debit to office supplies on hand for $20,500 – This amount does not correspond to any meaningful calculation in this scenario. It appears to combine the beginning balance and ending balance, or to add the ending balance to the beginning balance plus adjustments, which is incorrect.

D. A debit to office supplies on hand for $42,500 – This amount is close to the recorded purchases, $45,000, minus something, but it does not reflect the correct adjustment. The correct adjustment is the difference between the physical count and the existing balance, $11,500 − $9,000 = $2,500, not a figure derived from the purchases amount.

Reference:

IIA-CIA-Part3 content area on Financial Management / Accounting — Specifically adjusting entries, accrual accounting, and the accounting for office supplies, including asset versus expense treatment.

Explanation

Extrinsic rewards are rewards that come from outside the individual, meaning they are external to the work itself and are typically provided by the organization, such as pay, bonuses, commissions, benefits, promotions, and recognition. In this scenario, the sales manager stays with the organization because of the high bonuses she earns. The bonus is an external, tangible reward provided by the organization, not something derived from the intrinsic satisfaction of the work itself. This makes extrinsic reward the primary motivation for her to remain in the job, and option C is the correct answer.

Why the other options are incorrect:

A. Intrinsic reward – Intrinsic rewards are internal to the individual and come from the work itself, such as a sense of accomplishment, enjoyment of the work, personal growth, or satisfaction from helping others. In this scenario, the sales manager is experiencing significant stress from her job, which suggests she is not staying because of intrinsic satisfaction. Her motivation comes from the external bonus, not from internal rewards, so intrinsic reward is not the correct answer.

B. Job enrichment – Job enrichment is a job design technique that involves adding greater responsibility, autonomy, and variety to a job to increase motivation and satisfaction. It is not a type of reward or motivation in this scenario. The sales manager's motivation is the bonus she earns, not the design of her job, so job enrichment is not the correct answer.

D. The hierarchy of needs – The hierarchy of needs, based on Maslow's theory, is a motivation theory that describes human needs in a hierarchical order, including physiological, safety, social, esteem, and self-actualization needs. While it is a theory of motivation, it is not the specific type of reward or motivation described in this scenario. The sales manager's primary motivation is the high bonus, which is an extrinsic reward, rather than the fulfillment of a particular level of need. Therefore, this option does not best describe her primary motivation.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically motivation theories, including intrinsic versus extrinsic rewards.

Explanation

Margin of safety in sales dollars is the difference between actual sales and break-even sales. It measures how much sales can decline before the company reaches its break-even point and begins incurring losses.

* Break-even point in units = 25,000 shirts
* Selling price per shirt = $8
* Break-even sales in dollars = 25,000 × $8 = $200,000
* Actual sales =  $300,000

Margin of safety in sales dollars = Actual sales − Break-even sales
= $300,000 − $200,000 = $100,000

This makes option A the correct answer.

Why the other options are incorrect:

B. $200,000 – This is the break-even sales amount, calculated as 25,000 shirts × $8. It is not the margin of safety. The margin of safety is the amount by which actual sales exceed break-even sales, not the break-even level itself.

C. $275,000 – This amount does not correspond to any meaningful calculation in this scenario. It does not represent actual sales, break-even sales, or the difference between them.

D. $500,000 – This amount is higher than actual sales of $300,000 and does not correspond to any calculation relevant to margin of safety. The margin of safety cannot exceed actual sales because it represents the excess of actual sales over break-even sales.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically cost-volume-profit (CVP) analysis, break-even analysis, and margin of safety.

Explanation

Phishing attacks often involve fraudulent emails that appear to come from legitimate customers, requesting sensitive actions such as wire transfers. To avoid falling victim to such attacks, the financial institution needs a verification method that confirms the authenticity of the request through a channel that cannot be easily spoofed by the attacker. Calling the customer at the phone number already on record accomplishes this: it uses a pre-established, trusted contact method that the attacker does not control, and it allows the institution to directly confirm with the customer whether the wire request is genuine. This out-of-band verification, using a channel separate from the email, is the most effective way to detect and prevent phishing-based wire fraud, making option B the correct answer.

Why the other options are incorrect:

A. Reviewing the customer's wire activity to determine whether the request is typical – While reviewing past wire activity can help identify unusual transactions, it does not verify whether a specific request is authentic. A fraudulent request could resemble the customer's typical activity, or a legitimate request could appear unusual. This control is useful as a detective measure but does not confirm the legitimacy of the request itself.

C. Replying to the customer via email to validate the sender and request – Replying to the email is ineffective because the attacker controls the fraudulent email account. The attacker can simply reply and confirm the request, posing as the customer. Email is the very channel that was compromised, so using it for verification does not provide reliable assurance.

D. Reviewing the customer record to verify whether the customer has authorized wire requests from that email address – Even if the customer has previously authorized wire requests from a particular email address, the attacker can spoof or compromise that email account. Checking the record does not verify that the current request actually came from the customer, so it does not effectively prevent phishing-based fraud.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically cybersecurity, phishing, social engineering, and verification controls in financial transactions.

Explanation

A flat organizational structure is characterized by few hierarchical levels and a wide span of control. Span of control refers to the number of subordinates who report directly to a single manager or supervisor. In a flat structure, because there are fewer layers of management, each manager is responsible for a larger number of employees, resulting in a wide span of control. This is the defining characteristic of a flat structure, making option C the correct answer.

Why the other options are incorrect:

A. The structure is dispersed geographically – Geographic dispersion refers to whether an organization's operations and facilities are spread across different locations. It is not a defining characteristic of a flat structure. An organization can be flat or tall regardless of whether it is geographically dispersed.

B. The hierarchy levels are more numerous – A flat structure has fewer hierarchical levels, not more. Numerous hierarchy levels are characteristic of a tall, or hierarchical, structure, which is the opposite of a flat structure. Therefore, this statement is incorrect.

D. The lower-level managers are encouraged to exercise creativity when solving problems – While flat structures often delegate more authority and autonomy to lower-level managers, encouraging creativity is not a structural characteristic that defines a flat organization. It is more of a cultural or leadership attribute. The defining structural characteristic is the wide span of control with few hierarchical levels, making option C the better answer.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically organizational structures, span of control, and the characteristics of flat versus tall structures.

Explanation

The cash payback technique, also called the payback period method, is a capital budgeting method that identifies the time period required to recover the cost of a capital investment from the annual cash inflows produced by the investment. It measures how long it takes for the cumulative net cash inflows to equal the initial investment outlay. For example, if an investment of $100,000 generates $25,000 in annual cash inflows, the payback period is four years. This directly matches the description in the question, making the cash payback technique the correct answer.

Why the other options are incorrect:

B. Annual rate of return technique – The annual rate of return technique, also called the accounting rate of return, measures the expected profitability of an investment as a percentage, using accounting net income rather than cash flows. It does not identify the time period required to recover the cost of the investment. Instead, it expresses the average annual return as a percentage of the investment.

C. Internal rate of return method – The internal rate of return (IRR) method calculates the discount rate at which the present value of an investment's cash inflows equals the present value of its cash outflows, meaning the rate at which NPV equals zero. It measures the profitability or yield of an investment, not the time period required to recover the investment's cost.

D. Net present value method – The net present value (NPV) method discounts all expected future cash flows to their present value and compares the total present value of inflows to the initial investment. It measures the overall value created by an investment in dollar terms, not the time period required to recover the investment's cost.

Reference:

IIA-CIA-Part3 content area on Financial Management — Specifically capital budgeting techniques, including payback period, accounting rate of return, internal rate of return, and net present value.

Explanation

A globalization strategy, also called a global strategy, is one in which an organization treats the world as a single, integrated market and standardizes its products, branding, and marketing across all markets. The organization seeks to sell identical product lines using a uniform approach worldwide, capitalizing on economies of scale and consistent brand positioning. In this scenario, the organization wants to implement a unique advertising campaign for selling identical product lines across all of its markets, meaning it is standardizing both its products and its advertising approach across markets. This is the essence of a globalization strategy, making option D the correct answer.

Why the other options are incorrect:

A. Export strategy – An export strategy involves producing goods in the home country and selling them abroad, often with minimal adaptation to foreign markets. While it may involve selling similar products internationally, it does not necessarily involve a coordinated, standardized global advertising campaign across all markets. It is primarily a market-entry strategy rather than a global integration strategy.

B. Transnational strategy – A transnational strategy seeks to balance global integration with local responsiveness. It combines standardization where beneficial with adaptation to local market needs. Because a transnational strategy emphasizes responsiveness to local differences, it would not involve a single, uniform advertising campaign for identical products across all markets, so it is not the best answer.

C. Multi-domestic strategy – A multi-domestic strategy, also called a multidomestic or localization strategy, involves adapting products, branding, and marketing to each local market to meet local preferences and conditions. It emphasizes local responsiveness over global standardization. Since the organization in this scenario wants a unique, single advertising campaign for identical product lines across all markets, a multi-domestic strategy would not be appropriate.

Reference:

IIA-CIA-Part3 content area on Business Acumen / International Business and Strategic Management — Specifically international strategies, including globalization (global), transnational, multi-domestic, and export strategies.

Explanation

Strong security governance begins with clearly defined policies. Security governance is the framework of leadership, organizational structures, and processes that ensure information security supports and aligns with the organization's business objectives and manages risk appropriately. Clearly defined policies establish the tone at the top, set expectations for acceptable behavior, define roles and responsibilities, and provide the foundation for all other security controls and activities. Without clearly defined policies, an organization lacks direction, consistency, and accountability in its security efforts, making it difficult to implement effective security governance. This makes clearly defined policies the most fundamental element management should consider to ensure strong security governance, and option D is the correct answer.

Why the other options are incorrect:

A. Inventory of information assets – An inventory of information assets is an important component of security governance and risk management because an organization cannot protect what it does not know it has. However, it is a supporting activity that flows from policy direction rather than the foundational element of governance itself. Policies define the requirement to maintain an asset inventory; the inventory is a means of implementing policy, not the foundation of governance.

B. Limited sharing of data files with external parties – Limiting data sharing with external parties is a specific operational control or risk mitigation measure. While it can reduce risk, it is not the foundation of security governance. Governance requires policies and structures that govern all aspects of security, including data sharing, rather than a single restrictive practice.

C. Vulnerability assessment – A vulnerability assessment is a technical detective activity that identifies weaknesses in systems and networks. It is an important part of a security program, but it is an operational control, not the foundation of security governance. Governance establishes the policies, oversight, and accountability structures that direct and govern such assessments.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically information security governance, security policies, and governance frameworks.