Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation

To find the targeted sales amount for the current year, we need to work backward from the desired net profit margin of 50%, using the known cost and expense figures for the current year.

* Current year cost of sales = $10,500,000
* Current year expenses = $7,100,000
* Total costs and expenses = $10,500,000 + $7,100,000 = $17,600,000
* Targeted net profit margin = 50%

If the net profit margin is 50%, that means net profit is 50% of sales, and total costs and expenses are the remaining 50% of sales. Therefore:

Total costs and expenses = 50% of targeted sales

$17,600,000 = 0.50 × Targeted sales

Targeted sales = $17,600,000 ÷ 0.50 = $35,200,000

Verification:

* Sales = $35,200,000
* Gross profit = $35,200,000 − $10,500,000 = $24,700,000
* Net profit = $24,700,000 − $7,100,000 = $17,600,000
* Net profit margin = $17,600,000 ÷ $35,200,000 = 50%

This confirms that the targeted sales amount is $35,200,000, making option D the correct answer.

Why the other options are incorrect:

A. $20,000,000 – At this sales level, net profit would be $20,000,000 − $10,500,000 − $7,100,000 = $2,400,000, giving a net profit margin of 12%, not 50%. This is far below the target.

B. $24,500,000 – At this sales level, net profit would be $24,500,000 − $10,500,000 − $7,100,000 = $6,900,000, giving a net profit margin of approximately 28%, not 50%. This does not meet the target.

C. $30,000,000 – At this sales level, net profit would be $30,000,000 − $10,500,000 − $7,100,000 = $12,400,000, giving a net profit margin of approximately 41%, not 50%. This does not meet the target.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically financial statement analysis, net profit margin calculation, and cost-volume-profit relationships.

Explanation

The internal rate of return (IRR) is the discount rate at which the present value of a project's cash inflows equals the present value of its cash outflows, meaning the rate at which the project's net present value (NPV) equals zero. To determine whether a project is potentially acceptable, the manager should compare the project's IRR to the organization's  required rate of return, also called the hurdle rate or minimum acceptable rate of return. If the IRR exceeds the required rate of return, the project is generally considered acceptable because it is expected to generate a return greater than the minimum required. If the IRR is below the required rate of return, the project should generally be rejected. This makes comparing the IRR to the required rate of return the correct approach, and option C is the answer.

Why the other options are incorrect:

A. Compare to the annual cost of capital – While the required rate of return is often based on the organization's cost of capital, the direct comparison for IRR is to the required rate of return (hurdle rate), which may reflect the cost of capital plus a risk premium or other adjustments. Comparing to the cost of capital alone is less precise than comparing to the required rate of return, which is the established benchmark for project acceptance.

B. Compare to the annual interest data – Annual interest data, such as market interest rates, is not the appropriate benchmark for evaluating a project's IRR. Interest rates may influence the cost of capital, but they are not the decision criterion for project acceptance. The IRR should be compared to the organization's required rate of return, not to general interest rate data.

D. Compare to the net present value – Net present value (NPV) and IRR are separate capital budgeting techniques. NPV is a dollar amount, while IRR is a percentage rate. The manager would not compare the IRR computation to the NPV. Rather, the manager would compare the IRR to the required rate of return, or would use NPV as an alternative decision criterion. Comparing IRR to NPV is not a valid analytical step because they are different measures.

Reference:

IIA-CIA-Part3 content area on Financial Management — Specifically capital budgeting techniques, including internal rate of return, net present value, and the required rate of return (hurdle rate).

Explanation

A matrix organization is an organizational structure that combines two or more lines of authority, typically functional departments and project or product teams. Employees in a matrix organization often report to both a functional manager, such as their department head, and a project or product manager. In this scenario, the application development team consists of employees from multiple departments who all report to a single project manager. The team members come from different functional areas, such as programming, design, and testing, but are brought together under a project manager for the duration of the project. This dual-reporting arrangement, functional department membership plus project manager oversight, is the defining characteristic of a matrix organization, making option C the correct answer.

Why the other options are incorrect:

A. Functional departmentalization – Functional departmentalization groups employees by their specialized function, such as marketing, finance, or engineering, with each function managed by a functional head. In this scenario, employees from multiple departments are brought together under a project manager, which goes beyond simple functional grouping. It represents a combination of functional and project structures, not purely functional departmentalization.

B. Product departmentalization – Product departmentalization groups activities by product line, with each product division having its own functional resources and reporting to a product manager. In this scenario, the team is organized around a project, custom application development, rather than a product line, and members come from multiple departments. The situation describes a project-based matrix, not product departmentalization.

D. Divisional organization – A divisional organization groups the company into semi-autonomous divisions based on product, geography, or customer, each with its own functional resources. This scenario does not describe separate divisions. It describes employees from multiple departments reporting to a single project manager, which is a matrix arrangement, not a divisional structure.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically organizational structures, including matrix organizations.

Explanation

Job enrichment is a job design technique that increases employee motivation by adding greater responsibility, autonomy, and opportunities for recognition to a job. It involves giving employees more control over how they perform their work, assigning them more challenging tasks, and providing them with opportunities to use their skills and make decisions. Job enrichment is based on Herzberg's motivation theory, which distinguishes between hygiene factors, which prevent dissatisfaction, and motivators, which create satisfaction and motivation, such as responsibility, achievement, recognition, and growth. By increasing responsibility and recognition, job enrichment directly addresses these motivators and enhances employee motivation. This makes job enrichment the correct answer.

Why the other options are incorrect:

A. Job complicating
– "Job complicating" is not a recognized job design technique in organizational behavior or management theory. It does not describe a method for increasing motivation through responsibility and recognition, so it is not the correct answer.

B. Job rotation
– Job rotation involves moving employees between different tasks or positions on a regular basis to reduce monotony, broaden their experience, and develop their skills. While it can reduce boredom and increase flexibility, it does not necessarily increase responsibility or recognition in a way that motivates employees through those factors. It is more focused on variety and skill development than on responsibility and recognition.

D. Job enlargement
– Job enlargement involves adding more tasks of a similar level of difficulty to an employee's job, or horizontal expansion, which increases the number and variety of tasks but not necessarily the level of responsibility or recognition. It addresses monotony and workload variety but does not provide the increased responsibility, autonomy, and recognition that job enrichment does.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically job design techniques and motivation theories, including job enrichment, job enlargement, and job rotation.

Explanation

Implementing an e-commerce system that relies heavily on electronic data interchange (EDI) and electronic funds transfer (EFT) for purchasing and billing streamlines and accelerates transactions between the organization and its trading partners. EDI speeds up the exchange of purchase orders, invoices, and shipping documents, while EFT enables immediate electronic payment and receipt of funds. Together, these technologies shorten the cash conversion cycle by accelerating collections, through faster billing and receipt of payments, and improving the timing and efficiency of disbursements. As a result, cash flows into the organization more quickly and predictably, leading to higher cash flow and higher treasury balances. This makes option A the correct answer.

Why the other options are incorrect:

B. Higher inventory balances – E-commerce and EDI systems typically enable more efficient purchasing and inventory management, often reducing inventory balances through better coordination with suppliers, such as just-in-time ordering. Higher inventory balances would generally result from inefficiency, not from implementing EDI/EFT-based e-commerce.

C. Higher accounts receivable – EFT and electronic billing generally accelerate collections, which would tend to reduce accounts receivable, not increase them. Faster payment processing means customers pay more quickly, lowering the amount outstanding in receivables. Higher accounts receivable would suggest slower collections, which is the opposite of what EDI/EFT systems typically achieve.

D. Higher accounts payable – While EDI/EFT can improve the efficiency of payables processing, the overall effect of an integrated e-commerce purchasing and billing system is typically to improve cash management and optimize payment timing, not to inflate accounts payable. Higher accounts payable could result from delaying payments, but the primary benefit of EDI/EFT is faster and more efficient transaction processing, contributing to improved cash flow and treasury balances.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically e-commerce, electronic data interchange (EDI), electronic funds transfer (EFT), and their impact on cash flow and treasury management.

Explanation

Preventive controls are designed to stop unauthorized access before it occurs, rather than detecting it after the fact. Requiring that requests for additional access rights be sent for approval and validation by direct supervisors is a preventive control because it ensures that access is granted only after proper authorization and verification. By reviewing and approving access requests before rights are granted, the organization prevents unauthorized individuals from obtaining access in the first place. This directly focuses on the prevention of unauthorized access to the power plant, making option C the correct answer.

Why the other options are incorrect:

A. An offboarding procedure is initiated monthly to determine redundant physical access rights – An offboarding procedure that is initiated monthly to identify redundant access rights is a corrective or detective control. It identifies and removes access rights after they are no longer needed, but because it operates on a monthly cycle, it does not prevent unauthorized access from occurring in the interim. It is a cleanup activity rather than a preventive control.

B. Logs generated by smart locks are automatically scanned to identify anomalies in access patterns – Scanning logs to identify anomalies in access patterns is a detective control. It identifies potential unauthorized access after it has occurred, enabling investigation and response. It does not prevent unauthorized access from happening in the first place, so it is not the best answer for prevention.

D. Automatic notifications are sent to a central security unit when employees enter the premises during nonwork hours – Sending notifications when employees enter during nonwork hours is a detective control. It alerts security personnel to unusual activity after it occurs, allowing them to respond, but it does not prevent the access itself. It is therefore not primarily a preventive control.

Reference:

IIA-CIA-Part3 content area on Information Technology / Physical Security — Specifically types of controls, including preventive, detective, and corrective controls, and physical access controls.

Explanation

When a manufacturer is deciding whether to sell a product at the split-off point or process it further, the relevant costs and revenues are those that differ between the two alternatives. The relevant items include:

Incremental processing costs – The additional costs incurred to process the product further, such as additional direct materials, direct labor, and variable overhead. These are relevant because they are incurred only if the decision to process further is made.

Incremental revenue – The additional revenue generated from selling the processed product compared to selling it at the split-off point. This is relevant because it represents the benefit of processing further.

Variable manufacturing expenses – Variable costs that change with the level of processing are relevant because they are part of the incremental cost of processing further.


Joint costs, by contrast, are sunk costs. They have already been incurred up to the split-off point and do not differ between the alternatives. Therefore, they are irrelevant to the decision. This makes option A the correct answer.

Why the other options are incorrect:

B. Joint costs, incremental processing costs, and variable manufacturing expenses
– This option includes joint costs, which are sunk costs and therefore irrelevant to the decision. Joint costs are incurred before the split-off point and do not change regardless of whether the product is sold or processed further.

C. Incremental revenue, joint costs, and incremental processing costs
– This option also includes joint costs, which are irrelevant. While incremental revenue and incremental processing costs are relevant, the inclusion of joint costs makes this option incorrect.

D. Variable manufacturing expenses, incremental revenue, and joint costs
– This option again includes joint costs, which are irrelevant. While variable manufacturing expenses and incremental revenue are relevant, the presence of joint costs makes this option incorrect.

Reference:

IIA-CIA-Part3 content area on Financial Management / Managerial Accounting — Specifically relevant costing, sell-or-process-further decisions, and the treatment of joint costs.

Explanation

Data privacy laws, such as the GDPR, CCPA, and similar regulations, are designed to protect individuals' personal information by imposing requirements on how organizations collect, use, store, and share personally identifiable information (PII). A core principle of these laws is data minimization and access limitation: personal data should be accessible only to those individuals who need it to perform their specific job responsibilities. Restricting access to PII on a need-to-know basis is a direct response to data privacy law requirements because it reduces the risk of unauthorized access, misuse, or disclosure of personal data. This makes option A the policy most likely to result from a data privacy law.

Why the other options are incorrect:

B. Confidential data must be backed up and recoverable within a 24-hour period – This is a data availability and business continuity requirement, not a data privacy requirement. While backup and recovery are important controls, they stem from operational resilience and disaster recovery needs, not specifically from data privacy laws.

C. Updates to systems containing sensitive data must be approved before being moved to production – This is a change management control designed to ensure that system changes are properly authorized, tested, and controlled. It supports data integrity and security generally, but it is not specifically mandated by data privacy laws.

D. A record of employees with access to insider information must be maintained, and those employees may not trade company stock during blackout periods – This is an insider trading policy derived from securities laws and regulations, such as SEC rules, not from data privacy laws. It is designed to prevent the misuse of material nonpublic information for trading purposes, which is a securities law concern rather than a data privacy concern.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically data privacy laws, privacy principles, and access controls over personally identifiable information.

Explanation

A flat organizational structure is characterized by few hierarchical levels and a wide span of control, which reduces the number of management and supervisory positions required. In the context of an internal audit activity, a flat structure means fewer layers of audit management between the chief audit executive and the field auditors, which reduces administrative and supervisory overhead. Because fewer managers and support layers are needed, operating and support costs are typically lower than in a hierarchical structure, which requires multiple layers of management, such as audit managers, senior managers, and directors, with corresponding salaries and administrative costs. This makes lower operating and support costs the typical benefit of a flat structure, and option A is the correct answer.

Why the other options are incorrect:

B. A flat structure results in a stable and very collaborative environment – While flat structures can encourage collaboration by reducing hierarchy and increasing interaction across levels, "stable" is not a typical benefit of a flat structure. Flat structures are often associated with greater flexibility and adaptability rather than stability. Moreover, the claim that a flat structure inherently results in a stable and very collaborative environment is too broad and not the primary benefit sought in an internal audit context.

C. A flat structure enables field auditors to report to and learn from senior auditors – In a hierarchical structure, field auditors typically report up through layers of supervision, such as to a senior auditor and then an audit manager, which provides structured opportunities for mentoring and learning from senior auditors. A flat structure reduces these layers, which may actually reduce the structured reporting and learning opportunities from senior auditors. This option therefore describes a benefit of a hierarchical structure, not a flat one.

D. A flat structure is more dynamic and offers more opportunities for advancement than a hierarchical structure – A flat structure has fewer hierarchical levels, which means fewer promotion opportunities within the audit activity, not more. Advancement opportunities are generally greater in a hierarchical structure, where there are more levels to move up. While a flat structure may be more dynamic and flexible in some respects, it does not offer more advancement opportunities. This is a disadvantage, not a benefit.

Reference:

IIA-CIA-Part3 content area on Business Acumen / Organizational Behavior — Specifically organizational structures, including flat versus hierarchical structures, and their application to the internal audit activity.

Explanation

Surveillance cameras function as both a preventive and a detective control. They are  preventive because their visible presence deters individuals from attempting unauthorized access or engaging in inappropriate behavior. Potential intruders may avoid acting when they know they are being recorded. They are also  detective because they record activity, allowing security personnel to detect, investigate, and provide evidence of unauthorized access, security breaches, or other incidents after they occur. This dual function makes surveillance cameras the correct answer.

Why the other options are incorrect:

A. Locked doors – Locked doors are primarily a preventive control. They physically block unauthorized individuals from entering a secured area, preventing access before it occurs. While they may leave evidence of forced entry, their primary function is prevention, not detection. They do not actively record or identify unauthorized activity.

B. Firewalls – Firewalls are a preventive control. They block unauthorized network traffic from entering or leaving the organization's network based on predefined rules. While they may log activity that can support detection, their primary function is prevention, and they are logical (technical) controls, not physical access controls.

D. Login IDs and passwords – Login IDs and passwords are authentication controls that primarily serve a preventive function by verifying identity and preventing unauthorized access to systems. They are logical access controls, not physical access controls, and they do not function as detective controls in the way surveillance cameras do.

Reference:

IIA-CIA-Part3 content area on Information Technology / Physical Security — Specifically types of controls, including preventive, detective, and corrective controls, and physical access controls.

Explanation

A value-added network (VAN) is a third-party or privately established network that provides secure communications and value-added services, such as electronic data interchange (EDI) messaging, data translation, and secure transmission, between trading partners. In this scenario, management established a secure network that provides a secure channel for electronic data interchange (EDI) between the company and its major trading partners. This is the defining purpose of a value-added network: to facilitate secure, reliable electronic data interchange and related services among business partners. This makes option A the correct answer.

Why the other options are incorrect:

B. A local area network – A local area network (LAN) covers a small geographic area, such as a single building or campus, and connects devices within that limited area. It is not designed to provide a secure channel for EDI between an organization and its external trading partners, so it does not match the scenario.

C. A metropolitan area network – A metropolitan area network (MAN) spans a city or metropolitan region, connecting multiple locations within that geographic area. While it covers a larger area than a LAN, it is not specifically designed to provide secure EDI channels between trading partners, so it is not the correct answer.

D. A wide area network – A wide area network (WAN) spans a large geographic area, such as multiple cities, countries, or continents, and connects multiple LANs and other networks. While a VAN may use WAN infrastructure to connect trading partners, the term "wide area network" describes the geographic scope of the network, not its specific purpose of providing secure EDI and value-added services between trading partners. The scenario specifically describes a network established to provide a secure channel for EDI between the company and its partners, which is the definition of a value-added network.

Reference:

IIA-CIA-Part3 content area on Information Technology — Specifically network types, electronic data interchange (EDI), and value-added networks.

Explanation

In the data analytics process, once data has been obtained, the first thing the auditor should do is verify its completeness and accuracy. Completeness means ensuring that all expected records, transactions, or data elements are present, so that nothing is missing from the data set. Accuracy means ensuring that the data values are correct, valid, and free from errors. Verifying completeness and accuracy is essential before performing any analysis because if the data is incomplete or inaccurate, the results of the analysis will be unreliable and any conclusions drawn from it will be invalid. This validation step ensures the integrity of the data set and provides a sound foundation for subsequent analysis. This makes option A the correct answer.

Why the other options are incorrect:

B. Verify existence and accuracy – While accuracy is important, "existence" alone is not the standard criterion for validating obtained data. The auditor needs to verify completeness, meaning that all expected data is present, as well as accuracy, meaning that the data is correct. Existence focuses on whether items exist but does not address whether the data set is complete, making this option incomplete.

C. Verify completeness and integrity – Integrity is a broad concept that relates to the overall reliability and consistency of data. While integrity is important, the first specific validation step after obtaining data is to verify completeness and accuracy, ensuring that all records are present and the values are correct. Accuracy is the more precise and standard term used alongside completeness in this context, so this option is less precise than option A.

D. Verify existence and completeness – This option omits accuracy. While verifying existence and completeness ensures that records are present, it does not confirm that the data values are correct. Accuracy must also be verified, making this option incomplete.

Reference:

IIA-CIA-Part3 content area on Information Technology / Data Analytics — Specifically the data analytics process, including data validation, completeness, and accuracy checks.