Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation

This question focuses on identifying the control type that functions as a feedback mechanism for management. The control must provide ongoing, timely information about operations and performance, allowing management to detect deviations from plans and respond to unforeseen risks as they occur, rather than just setting up a static framework.

Correct Option:

A. Measure product performance against an established standard:
This is the correct answer. This activity describes a feedback control, which is a core component of a dynamic control system. By continuously measuring actual performance and comparing it to a standard or benchmark, management receives timely information. Significant variances signal that unforeseen risks may be materializing or processes are going off-track, enabling immediate investigation and corrective action to mitigate those risks.

Incorrect Option:

B. Develop standard methods for performing established activities:
This is a preventive control. It establishes rules and procedures to guide actions and prevent errors before they occur. While crucial, it is a static framework and does not, by itself, provide timely feedback on whether the standards are being met or if new risks have emerged.

C. Require the grouping of activities under a single manager:
This relates to organizational structure and is a form of directive control. It aims to improve accountability and oversight but is an administrative setup, not an active feedback mechanism that provides data on performance and risks.

D. Assign each employee a reasonable workload:
This is a directive/preventive control aimed at promoting efficiency and preventing burnout or errors caused by fatigue. It is a policy decision made in advance and does not function as a system to provide ongoing, timely feedback to management about operational performance or emerging risks.

Reference:
The IIA's International Professional Practices Framework (IPPF), particularly standards and guidance related to governance, risk management, and control (e.g., Standard 2130 on Control), emphasizes the importance of monitoring activities and using performance indicators. Feedback controls, which involve measuring performance against standards, are a fundamental management tool for ensuring objectives are achieved and risks are managed.

Explanation

This question addresses how the choice of an inventory costing method can be used to manipulate reported profitability, especially in an inflationary environment where costs are rising. The method that allows management to increase net income by strategically selling lower-cost inventory is the one that assumes the oldest (and usually cheapest) goods are sold first.

Correct Option:

A. First-in, first-out method (FIFO):
In a period of rising prices, FIFO assigns the oldest, lowest-cost inventory to Cost of Goods Sold (COGS). This results in a lower COGS and a higher reported net income. Management can "boost" income by selling units that were purchased at historically lower costs. This is the primary method that facilitates this type of earnings management under inflation.

Incorrect Option:

B. Last-in, first-out method (LIFO):
LIFO has the opposite effect. It assigns the newest, highest-cost inventory to COGS. This leads to a higher COGS and a lower reported net income during inflation. It does not allow for boosting income by selling low-cost units.

C. Specific identification method:
This method directly tracks the actual cost of each specific unit sold. It cannot be manipulated for broad income boosting unless management selectively chooses which specific units to sell, which is often impractical and easily verifiable, reducing its potential for manipulation in this context.

D. Average-cost method:
This method smooths out price fluctuations by using a weighted average cost for all units. It eliminates the ability to choose between high or low-cost layers to impact COGS, as every unit has the same cost. Therefore, it is not a tool for manipulating net income in the manner described.

Reference:
The IIA's syllabus for Part 3 includes understanding financial accounting concepts and the potential for earnings management. The differential impact of FIFO and LIFO on net income during inflation is a fundamental principle in generally accepted accounting principles (GAAP) and International Financial Reporting Standards (IFRS), which are key knowledge areas for internal auditors assessing financial reporting risks.

Explanation

This question focuses on the core motivational principle behind the management technique of job enrichment. Job enrichment is a strategy designed to make jobs more intrinsically rewarding by adding dimensions such as increased responsibility, autonomy, and opportunities for growth. The question specifically asks for the primary value from the employee's perspective, not the organization's.

Correct Option:

C. Support for personal growth and a meaningful work experience:
This is the fundamental value of job enrichment for an employee. It is based on Herzberg's Two-Factor Theory, which states that true motivation comes from intrinsic factors like achievement, recognition, responsibility, and the work itself. By providing these elements, job enrichment directly supports an employee's sense of personal accomplishment and makes their work feel more meaningful.

Incorrect Option:

A. Validation of the achievement of their goals and objectives:
While feedback is important, this describes a result or an outcome of performing the work. The primary value of enrichment is the work experience itself—the opportunity to take on challenging and significant tasks that lead to that sense of achievement.

B. Increased knowledge through the performance of additional tasks:
This describes job enlargement, which simply adds more tasks of a similar nature. Job enrichment is more profound; it adds depth and complexity, not just volume. The value is in the growth and challenge, not merely the accumulation of more duties.

D. An increased opportunity to manage better the work done by their subordinates:
This describes a promotion into a supervisory or management role. Job enrichment is about enhancing the current job, not necessarily changing the job title to one that involves managing other people.

Reference:
The underlying theory for job enrichment is primarily attributed to Frederick Herzberg's Motivation-Hygiene Theory. This concept is integral to the human resources and behavioral aspects covered in the IIA's syllabus for Part 3, which includes understanding how organizational structure and management practices influence behavior and performance.

Explanation

This question focuses on selecting a staffing model that aligns with the principles of Total Quality Management (TQM) to improve efficiency (reduce time) and customer satisfaction (improve ratings). TQM emphasizes continuous improvement, employee empowerment, and process efficiency. The correct approach should leverage expertise and streamline decision-making to achieve these goals.

Correct Option:

D. Assign a team of personnel who have similar specialties to specific engagements that would benefit from those specialties and limit Key decisions to the senior person.
This approach is most aligned with a TQM goal of reducing time and improving quality. By assigning specialists to audits that need their specific expertise, the work is done more efficiently and correctly the first time, reducing rework and duration. Limiting key decisions to the senior person streamlines the process, prevents delays from consensus-building, and ensures decisions are made by the most experienced individual, which should lead to higher-quality outcomes and better client ratings.

Incorrect Option:

A. Assign a team with a trained audit manager to plan each audit and distribute field work tasks to various staff auditors.
This is a traditional, top-down approach. While structured, it is not optimally efficient for TQM as it can create bottlenecks at the manager level and does not fully leverage or empower the specialized skills of the team for maximum speed and quality.

B. Assign a team of personnel who have different specialties to each audit and empower Team members to participate fully in key decisions.
Empowerment is a TQM principle, but having a team of different specialists on every audit is inefficient and costly. Furthermore, requiring full team participation in all key decisions can significantly slow down the audit process, working against the goal of reducing time.

C. Assign a team to each audit, designate a single person to be responsible for each phase of the audit, and limit decision making outside of their area of responsibility.
This creates silos and a rigid, assembly-line approach. It discourages collaboration and the sharing of specialized knowledge across phases, which can lead to inefficiencies, handoff errors, and a slower overall process, contrary to TQM goals.

Reference:
The core concepts of TQM, such as focusing on efficiency, quality, and customer satisfaction, are supported by the IIA's IPPF standards, particularly those related to managing the internal audit activity (Standard 2000) and promoting efficiency and effectiveness. Assigning specialized experts to relevant tasks is a direct application of leveraging resources to improve quality and performance.

Explanation

This question tests the understanding of physical security controls and their dual functions. A control is preventive if it stops an incident from occurring, and detective if it identifies that an incident has occurred. The task is to identify which single control can perform both roles effectively in a physical security context.

Correct Option:

D. Video surveillance:
This is the correct answer because it serves a dual purpose. It acts as a detective control by recording evidence of a security breach after it has happened, allowing for investigation. Simultaneously, it acts as a preventive control by deterring potential intruders or unauthorized personnel who know they are being watched and recorded, thus preventing the incident from occurring in the first place.

Incorrect Option:

A. Authentication logs:
These are purely detective controls. They provide an audit trail of access attempts (successful or failed) after the event has occurred. They do not prevent an access attempt from happening.

B. Card key readers:
These are primarily preventive controls. Their main function is to physically prevent access to a secured area by unauthorized individuals who lack a valid card. They do not, by themselves, detect or record activity beyond the basic access event.

C. Biometric devices:
Like card readers, these are primarily preventive controls. They prevent access by verifying a unique biological trait. While they may log the access attempt, their primary and most powerful function is to prevent unauthorized entry.

Reference:
The IIA's International Professional Practices Framework (IPPF) and related guidance on security management (such as GTAG) classify controls by their function. Video surveillance is consistently cited as a key example of a control that provides both deterrence (prevention) and evidence collection (detection), making it a highly efficient security measure.

Explanation

This scenario describes a major, unforeseen external event (military conflict) disrupting a critical supply chain. The question asks which type of plan was most likely absent or ineffective in mitigating this specific risk. The key is to identify the plan designed to respond to major operational disruptions and ensure business continuity when primary processes fail.

Correct Option:

C. Contingency plans:
These are broad plans designed for unexpected, disruptive events that threaten critical business operations. A military conflict disrupting supply lines is a classic scenario a contingency plan should address. Such a plan would include alternative suppliers, pre-identified logistics routes, or safety stock strategies to maintain production despite the primary delivery failure.

Incorrect Option:

A. Just-in-time (JIT) delivery plans:
JIT is an operational strategy, not a failure-response plan. The scenario highlights a key risk of relying on JIT without adequate safeguards; JIT itself failed because it has no inherent resilience to such shocks. The failure was the lack of a backup to the JIT system.

B. Backup plans:
This term is generally more specific, often referring to data/IT recovery (backup plans for data) or a secondary option for a single task. It is narrower in scope than a full contingency plan, which would cover a wide range of operational disruptions like this one.

D. Standing plans:
These are ongoing policies and procedures for routine, repetitive operations (e.g., employee leave policies, standard operating procedures). They are not designed to handle unique, non-routine emergencies like a military conflict.

Reference:
The IIA's guidance on business continuity and disaster recovery, as reflected in the Global Technology Audit Guide (GTAG) and the International Professional Practices Framework (IPPF), emphasizes the need for contingency planning. This type of planning specifically addresses how an organization will continue its critical functions in the face of significant disruptions, such as the failure of a key supplier due to a geopolitical event.

Explanation

This question focuses on the fundamental characteristics of a centralized organizational structure. Centralization means that authority for significant decisions is concentrated at the top levels of management, such as at the corporate or executive level. Lower-level managers primarily implement these decisions rather than creating their own.

Correct Option:

D. Reliance is placed on top management decision making by few of the organization's departments.
This is the correct answer, but its phrasing is slightly ambiguous. The intended meaning is that most, not few, departments rely on top management for key decisions. In a highly centralized structure, the authority to make important decisions is retained by a small group of top managers. Therefore, many departments across the organization are reliant on and must seek approval from this central authority for their significant actions, rather than having autonomous decision-making power.

Incorrect Option:

A. Top management does little monitoring of the decisions made at lower levels.
This describes a decentralized structure. In a centralized organization, top management is heavily involved in and monitors key decisions precisely because they have not delegated that authority away.

B. The decisions made at the lower levels of management are considered very important.
This is also a trait of decentralization. In a centralized structure, the most important decisions are made at the top. The decisions made at lower levels are typically routine, operational, and of lesser strategic importance.

C. Decisions made at lower levels in the organizational structure are few.
While this might seem plausible, it is not the most direct characteristic. A centralized structure limits the type and significance of decisions at lower levels, not necessarily the raw quantity. Lower-level managers may still make many small, daily operational decisions.

Reference:
The core concepts of centralization and decentralization are fundamental to organizational governance and are covered extensively in the IIA's materials related to organizational structure and risk management, as found in the International Professional Practices Framework (IPPF). The shift to centralization concentrates authority and decision-making at the top of the organization.

Explanation

This question assesses understanding of business continuity planning terminology, specifically the state of recovery preparedness. It describes a scenario where data is backed up (a positive step), but there are no documented or tested procedures for how to actually use those backups to restore operations. This represents an incomplete plan that lacks the actionable details required for a timely recovery.

Correct Option:

C. Cold recovery plan:
This best describes the situation. A cold recovery plan (or "cold site") scenario typically involves having backups of data and hardware available, but it lacks the immediate, pre-configured systems and detailed procedures for a swift restoration. The recovery process is largely undefined and would be developed from scratch after a disaster occurs, leading to a significantly longer recovery time.

Incorrect Option:

A. Hot recovery plan:
A hot recovery plan implies a fully operational, mirrored site with synchronized data and defined processes that allow for almost immediate recovery. This is the opposite of the described situation, as recovery processes are fully defined and tested.

B. Warm recovery plan:
A warm site has the necessary hardware and network infrastructure pre-installed, and recovery processes are defined. While data may need to be restored from backups, the procedures for doing so exist, which is not the case in the question.

D. Absence of a recovery plan:
This is incorrect because a backup plan is a component of a recovery plan. The organization has taken the first step by ensuring data is backed up. The flaw is the lack of defined recovery and restore processes, not the complete absence of any plan.

Reference:
The IIA's Global Technology Audit Guide (GTAG) series, particularly those covering business continuity and disaster recovery, outlines the differences between hot, warm, and cold recovery strategies. These definitions are standard in IT governance frameworks and emphasize that having backups without tested restoration procedures constitutes a less mature, "cold" recovery capability.

Explanation

This question asks which component directly provides the tools and functionality to retrieve specific data from within an application's storage. The key is to identify the system specifically designed to manage, store, and query structured data. While all options are part of the IT infrastructure, only one has the primary function of handling data queries and extraction.

Correct Option:

B. Database system:
This is the correct answer. A Database Management System (DBMS) is specifically designed to store, manage, and retrieve data efficiently. It provides the direct tools and languages, such as SQL (Structured Query Language), that allow users and applications to execute queries to extract specific datasets based on defined criteria. The DBMS handles the request and returns the relevant data from its stored tables.

Incorrect Option:

A. Application program code:
The code defines the application's logic and may initiate a request for data, but it does not facilitate the extraction itself. It relies on the underlying database system to perform the actual data retrieval.

C. Operating system:
The OS manages hardware resources (memory, CPU) and provides a platform for applications to run, but it is not designed for complex data querying. It manages files as whole objects, not the structured data within them.

D. Networks:
Networks facilitate the transmission of data between different systems and components. They are the pipeline that carries the extracted data but do not perform the extraction process itself.

Reference:
The IIA's International Professional Practices Framework (IPPF) and related guidance on auditing data management (such as GTAG) recognize the database system as the core layer responsible for data integrity, security, and accessibility. Auditors often use direct database queries to test application controls and extract data for analysis, highlighting the DBMS's primary role in data extraction.

Explanation

This question focuses on identifying the most relevant control category to test specifically at the workstation level within an IT infrastructure. Workstations are the endpoints where users directly interact with systems to input and process data. The review must prioritize controls that are directly applicable to the risks present at this user-access point, such as the accuracy and authorization of data entered into the system.

Correct Option:

A. Input controls:
These are the most appropriate controls to test at the workstation level. Input controls are designed to ensure that data entered into the system is accurate, complete, and authorized. Testing these controls directly addresses risks like data entry errors, invalid transactions, and unauthorized data submission, which are primary threats originating from user workstations. Examples include field validations, drop-down menus, and authorization checks at the point of data entry.

Incorrect Option:

B. Segregation of duties:
This is a critical entity-level or application-level control, but it is not typically tested as a control on the workstation itself. Segregation of duties is an organizational policy that is enforced through system access rights and process design, not a technical control embedded within a single user's workstation.

C. Physical controls:
While physical security (e.g., locking a workstation) is important, the question is focused on reviewing the IT infrastructure of workstations in the context of their operational use. Physical controls are generally considered part of facility security and are not the primary IT control tested for workstation processing functionality.

D. Integrity controls:
These are broader system-level controls that ensure processing is accurate and complete and that data is not altered unauthorizedly. They are often implemented at the database, server, or network level (e.g., hash totals, encryption), not primarily at the individual workstation input stage.

Reference:
The IIA's Global Technology Audit Guide (GTAG) and the International Professional Practices Framework (IPPF) emphasize a risk-based approach to auditing IT. This involves reviewing application controls, such as input controls, at the points where data enters the system, which is most commonly at the workstation level for end-users.

Explanation:

IT governance is the framework of leadership, organizational structures, and processes that ensure IT supports and enables the organization's business strategy and objectives. IT governance begins with the definition of IT objectives, because objectives provide the direction and purpose for all subsequent IT governance activities. Before risks can be identified, assessed, or mitigated, and before risk responses or performance measures can be established, the organization must first define what it is trying to achieve with IT. IT objectives are derived from and aligned with the organization's overall business strategy, and they establish the basis for decision-making, resource allocation, performance measurement, and risk management within the IT function. Without clearly defined IT objectives, there is no benchmark against which to evaluate risks, controls, or performance. This makes the definition of IT objectives the starting point of IT governance, and option B is the correct answer.

Why the other options are incorrect:

A. Identification of risk-mitigating options
– Identifying risk-mitigating options is a risk management activity that occurs after risks have been identified and assessed. It is a subsequent step in the risk management process, not the starting point of IT governance. Risk mitigation presupposes that objectives and risks have already been defined.

C. Identification of IT risk events
– Identifying IT risk events is part of the risk assessment process, which follows the definition of objectives. Risk identification cannot meaningfully occur until the organization has defined its IT objectives, because risks are defined in relation to the potential impact on those objectives. Therefore, this is not the first step.

D. Definition of risk response policies
– Defining risk response policies comes after risks have been identified, assessed, and evaluated. It is a later stage in the risk management process, not the beginning of IT governance. Risk response policies depend on the prior establishment of objectives and the identification and assessment of risks.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically IT governance, IT objectives, and the alignment of IT with organizational strategy.

Explanation:

Logs of user identification and authentication record who accessed the network, when, and under what credentials. The primary purpose of maintaining these logs is to enable tracking of user access and privileges over time. By recording identification and authentication events, the organization can trace which users accessed the network, what privileges they used, and how access patterns change over time. This supports accountability, security monitoring, incident investigation, and verification that access rights remain appropriate. This makes option D the correct answer.

Why the other options are incorrect:

A. To ensure proper segregation of duties
– Segregation of duties is a control achieved through the design of roles and responsibilities, ensuring that no single individual has control over incompatible functions. While access logs can support the review of segregation of duties, they do not by themselves ensure it, and this is not the primary purpose of identification and authentication logs.

B. To create a master repository of user passwords
– Authentication logs record access events; they do not store passwords in a usable form. Storing a master repository of passwords would be a serious security weakness and is not the purpose of these logs.

C. To enable monitoring for systems efficiencies
– System efficiency monitoring focuses on performance, capacity, and resource utilization. Identification and authentication logs are maintained for security, accountability, and access tracking purposes, not primarily for efficiency monitoring.

Reference:

IIA-CIA-Part3 content area on Information Technology — specifically access controls, authentication, audit trails, and logging.

GTAG (Global Technology Audit Guide) — Identity and Access Management (IIA), which describes identification and authentication logs as audit trail controls that enable tracking of user access and privileges over time, supporting accountability, monitoring, and investigation.