Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation:

When auditing an Enterprise Resource Planning (ERP) system, software auditors uncover technical deficiencies such as configuration errors, access control gaps, or interface failures. However, the primary audience for internal audit reports—senior management, the audit committee, and the board—are not IT specialists; they are business leaders focused on strategic objectives, operational performance, and risk management.

Why the other options are incorrect:

A. Draft separate audit reports for business and IT management.
This is inefficient and creates silos. The IIA recommends a single, cohesive report with an executive summary for leadership and technical details placed in appendices for IT staff.

C. Include technical details to support IT issues.
While technical details are necessary for remediation, including them in the main body distracts leadership. Such details belong in workpapers or appendices; the main report must focus on business risks.

D. Include an opinion on financial reporting accuracy and completeness.
A software auditor reviewing ERP controls does not opine on the entire financial statements. That broader assurance is the responsibility of the external financial audit or a comprehensive finance function audit; ERP findings merely feed into that larger picture.

References:

IIA Standard 2410 – Criteria for Communicating: Requires that communications include engagement results presented in terms of risks and opportunities relevant to the organization's objectives.

Explanation:

Cybersecurity controls are fundamentally designed to protect the CIA Triad, which is the cornerstone of information security.

Confidentiality ensures that data is accessible only to authorized users (e.g., encryption, access controls).

Integrity ensures that data is accurate, complete, and has not been tampered with (e.g., hashing, digital signatures, change logs).

Availability ensures that data and systems are accessible and functional when needed by authorized users (e.g., redundancy, backup, disaster recovery).

Every cybersecurity control—whether technical, administrative, or physical—ultimately maps back to safeguarding one or more of these three core attributes.

Why the other options are incorrect:

A. Veracity, velocity, and variety. These are three of the "Five V's" of Big Data (volume, velocity, variety, veracity, value). They describe data characteristics, not security objectives.

C. Accessibility, accuracy, and effectiveness. These are generic performance or quality metrics. "Accessibility" is similar to availability but lacks confidentiality and integrity; "accuracy" and "effectiveness" are not standard cybersecurity protection goals.

D. Authorization, logical access, and physical access. These are controls or mechanisms (how we protect data), not the attributes of data that we are protecting. They are means to an end, not the end itself.

References:

IIA GTAG – Information Security Governance: Explicitly defines the CIA Triad as the primary objectives of any information security program.

ISO/IEC 27001 – Information Security Management: The standard's core framework is built upon protecting confidentiality, integrity, and availability of information assets.

Explanation:

A culture of high performance is built upon motivation, engagement, and the clear reinforcement of desired behaviors. Celebrating individual excellence—through recognition, awards, public acknowledgment, or performance-based incentives—directly reinforces meritocracy, encourages discretionary effort, and signals to all employees that outstanding contributions are valued and rewarded. This practice drives intrinsic motivation, boosts morale, and sets a visible benchmark for what "excellence" looks like, inspiring others to emulate high performance. It aligns individual goals with organizational objectives, which is a key driver of a high-performance culture.

Why the other options are incorrect:

A. Reiterating the importance of compliance with established policies and procedures.
This promotes a culture of risk aversion, rule-following, and control, not high performance. While compliance is necessary, it does not inspire innovation, excellence, or going above and beyond—it merely sets the minimum acceptable standard.

C. Periodically rotating operational managers.
This is a developmental tool for succession planning and cross-functional exposure, but frequent rotation can disrupt stability, team cohesion, and strategic continuity. It does not, by itself, drive a culture of high performance; it often creates short-termism.

D. Avoiding status differences among employees.
While reducing hierarchy can foster openness and collaboration, completely "avoiding status differences" is unrealistic in most organizations and does not inherently drive performance. In fact, high-performance cultures often embrace status differentiation based on merit, expertise, and results, rather than eliminating it entirely.

References:

IIA CIA Part 3 Syllabus – Organizational Behavior & HR Management: The exam tests understanding of motivational theories (e.g., Maslow, Herzberg, McClelland) and how recognition and reward systems directly impact employee performance and organizational culture.

Explanation:

In managerial and cost accounting, manufacturing costs are formally classified into three distinct categories based on their relationship to the production process:

Direct Materials – Raw materials that become an integral part of the finished product and can be physically and conveniently traced directly to it (e.g., steel for cars, wood for furniture).

Direct Labor – Wages paid to production workers who physically transform raw materials into finished goods, and whose time can be directly traced to specific products (e.g., assembly line workers).

Manufacturing Overhead – All other indirect production costs that cannot be directly traced to specific units. This includes indirect materials (e.g., glue, lubricants), indirect labor (e.g., factory supervisors, maintenance), and factory-related expenses such as utilities, property taxes, and depreciation on factory buildings.

Why the other options are incorrect:

A. Direct materials, indirect materials, raw materials.
This is redundant and incorrectly mixes categories. "Raw materials" become "direct materials" when traced to a product, while "indirect materials" are actually a subset of overhead, not a separate primary classification. This list omits direct labor and overhead entirely.

C. Direct materials, direct labor, depreciation on factory buildings.
This is partially correct but incomplete. Depreciation on factory buildings is one example of manufacturing overhead, not a primary classification on its own. This option omits the broader overhead category (e.g., utilities, indirect labor, supplies), making it an inaccurate representation of the full cost structure.

D. Raw materials, factory employees' wages, production selling expenses.
This is fundamentally flawed. "Factory employees' wages" is vague (includes both direct and indirect labor). Most critically, "production selling expenses" (e.g., advertising, sales commissions) are period costs (operating expenses), not manufacturing costs, and are expensed in the period incurred rather than included in product cost.

References:

CIA Part 3 Syllabus – Financial Management / Cost Accounting: The exam explicitly tests the distinction between product costs (manufacturing costs) and period costs (selling and administrative expenses), as well as the three standard components of product cost.

Explanation:

In partnership accounting, the ownership ratio (or profit/loss sharing ratio) is the formal basis used to allocate the partnership's net income or net loss among the partners. This ratio is typically defined in the partnership agreement and may be based on capital contributions, equal shares, or a specially negotiated formula. While the ownership ratio often reflects capital investment, its primary accounting function is to serve as the distribution key for periodic earnings or losses. This ensures that each partner's capital account is properly adjusted to reflect their agreed share of the partnership's financial performance.

Why the other options are incorrect:

A. The initial investment of each partner should be recorded at book value.
This is incorrect. Partners' initial contributions (whether cash, property, or services) must be recorded at fair market value on the date of contribution, not book value. Book value may be outdated and does not reflect the true economic value brought into the partnership.

C. A partner's capital only changes due to net income or net loss.
This is incomplete and false. A partner's capital account changes due to multiple events, including: additional contributions (investments), withdrawals or distributions (draws), and the allocation of net income or net loss. It is not limited to just earnings or losses.

D. The basis for sharing net incomes or net losses must be fixed.
This is false. The profit/loss sharing ratio can be changed if all partners mutually agree, typically through an amendment to the partnership agreement. It is not irrevocably fixed; flexibility exists to accommodate changing contributions, roles, or business conditions.

References:

CIA Part 3 Syllabus – Financial Management / Accounting: The exam tests knowledge of entity forms (sole proprietorship, partnership, corporation), including how partnerships are formed, capitalized, and how earnings are distributed.

Explanation:

The Internet of Things (IoT) refers to the network of interconnected physical devices—such as sensors, appliances, thermostats, heat pumps, and industrial machinery—that collect and exchange data over the internet without requiring human-to-human or human-to-computer interaction. A key benefit of IoT is automation and optimization based on real-time data. For example, smart thermostats and heat pumps can monitor electricity market pricing and automatically adjust energy consumption during peak-cost periods to reduce utility expenses. This directly demonstrates IoT's value in operational efficiency, cost savings, and intelligent decision-making through machine-to-machine (M2M) communication.

Why the other options are incorrect:

A. Employees can choose from a variety of devices they want to utilize to privately read work emails without their employer’s knowledge. This describes Bring Your Own Device (BYOD) and unauthorized shadow IT, not IoT. Moreover, reading work emails privately without employer knowledge violates security policies and creates significant data leakage and compliance risks—this is a threat, not a benefit.

C. Information can be extracted more efficiently from databases and transmitted to relevant applications for in-depth analytics. This describes traditional data integration, ETL (Extract, Transform, Load) processes, or middleware, which have existed long before IoT. It does not capture the unique essence of IoT, which involves physical, sensor-enabled devices interacting with the physical world.

D. Data mining and data collection from internet and social networks is easier, and the results are more comprehensive. This describes web scraping, social media analytics, or big data practices. While IoT generates massive data, this option incorrectly focuses on internet and social networks rather than physical devices. Additionally, easier collection from social networks raises significant privacy and ethical concerns, not universally accepted benefits.

References:

IIA GTAG – Auditing the Internet of Things (IoT): Defines IoT as interconnected physical devices and highlights benefits including operational efficiency, predictive maintenance, real-time monitoring, and cost optimization through automated responses to environmental or market changes.

Explanation:

An intranet is a private, internal network that uses Internet Protocol (IP) technology but is accessible only to an organization's own employees or personnel. It is securely firewalled from the public internet and is designed to host internal communications, documents, HR portals, and business applications exclusively for internal staff use. Access is granted through authentication mechanisms (e.g., corporate credentials), ensuring that only authorized personnel can view or interact with the content.

Why the other options are incorrect:

A. An extranet.
This is a controlled private network that allows limited, external access to specific third parties such as suppliers, vendors, or strategic customers. It extends beyond the organization's own personnel, making it incorrect for a network restricted only to internal staff.

B. A local area network (LAN).
While a LAN is a private network within a physical location (e.g., an office building), it is defined by geographic scope and connectivity, not by access policy. A LAN can be used by employees, but it also physically connects any device within range—it does not inherently restrict access only to personnel across the entire enterprise, nor does it differentiate between employees and visitors on-site.

D. The internet.
This is a global, public network accessible by anyone with a connection. It is inherently open and does not restrict access to an organization's own personnel; it is the opposite of what the question requires.

References:

IIA GTAG – Information Security Governance: Defines intranets as internal networks restricted to employees, extranets as extended to trusted business partners, and the internet as public. Emphasizes that network classification determines the appropriate security controls.

Explanation:

Under accounting standards (e.g., GAAP and IFRS), a contingent liability must be recorded (accrued) in the financial statements if it meets both of the following criteria: (1) it is probable (likely to occur), and (2) the amount can be reasonably estimated. Product warranty costs are the classic example of a recorded contingent liability because past historical data allows companies to reliably estimate future warranty claims, and it is virtually certain that some claims will occur. Companies accrue this estimated cost at the time of sale to match the expense with the related revenue (matching principle).

Why the other options are incorrect:

A. A potential assessment of additional income tax.
This is typically disclosed as a contingent liability only if the tax authority has already raised an issue and the outcome is probable and estimable. However, a potential assessment is often uncertain; unless it meets the "probable and estimable" threshold, it is usually disclosed in footnotes rather than recorded as a liability.

C. The threat of a lawsuit by a competitor.
A mere threat is a possible contingent liability, but it is not recorded unless it is probable that a loss will occur and the amount can be reasonably estimated. Most lawsuit threats are disclosed in footnotes rather than accrued until the outcome becomes clear.

D. The remote possibility of a contract breach.
This is not recorded and generally not even disclosed. Contingencies that are only remotely possible (low probability) do not meet the threshold for recognition or disclosure under both GAAP (ASC 450) and IFRS (IAS 37). Only remote possibilities are ignored entirely.

References:

GAAP – ASC 450 (Contingencies): Requires accrual when a loss is probable and reasonably estimable; otherwise, disclosure is required for reasonably possible contingencies, and no action is required for remote ones. Warranty costs are explicitly cited as a typical accrued liability.

Explanation:

A Service-Level Agreement (SLA) is a formal, legally binding contract between a company and a subcontractor (or third-party vendor) that explicitly defines the expected performance standards, delivery timelines, penalties for non-compliance, and remedies for failure. Since the company relies on subcontractors to replenish shortages within a strict 24-hour window, the SLA is the authoritative document where this specific obligation, including response times, performance metrics, and accountability mechanisms, is formally codified. Internal auditors should examine the signed SLA to verify that the obligation exists, is clearly defined, and includes enforceable consequences for non-performance.

Why the other options are incorrect:

A. The company's code of ethics.
This outlines general principles of integrity, honesty, and professional conduct for employees and business partners. It does not contain specific, measurable operational obligations like replenishment timelines or performance penalties.

B. The third-party management risk register.
This is a risk management tool that identifies, assesses, and tracks risks associated with third-party relationships (e.g., supply chain disruption risk). It does not establish contractual obligations or hold subcontractors legally accountable for specific performance metrics.

D. The subcontractors' annual satisfaction survey.
This is a feedback mechanism used to gauge subcontractor sentiment or relationship quality. It has no legal or contractual weight and does not define performance obligations or consequences for failure.

References:

IIA GTAG – Auditing Third-Party Risk Management: Emphasizes that SLAs are the primary control mechanism for governing vendor performance, and auditors must verify that SLAs contain measurable metrics, reporting requirements, and remedies for non-compliance.

Explanation:

Under the variable costing method (also known as direct costing), only variable manufacturing costs are classified as product costs (inventoriable costs). These costs fluctuate with production volume and are capitalized as inventory until the goods are sold.

Item 1 (Direct labor costs) – If direct labor is truly variable (paid per unit produced or hourly with no fixed guarantee), it is a variable product cost. In most standard costing problems, direct labor is treated as a variable manufacturing cost.

Item 3 (Manufacturing supplies) – These are indirect materials (e.g., lubricants, cleaning agents, small tools) that vary with production output. They are part of variable manufacturing overhead and thus a product cost under variable costing.

Fixed manufacturing costs (like factory insurance) and period costs (like shipping) are expensed immediately under variable costing.

Why the other options are incorrect:

A. 1 and 2 (Direct labor costs and Insurance on a factory) – Insurance on a factory is a fixed manufacturing overhead cost. Under variable costing, fixed overhead is treated as a period cost (expensed immediately), not a product cost. Only direct labor qualifies from this pair.

C. 2 and 4 (Insurance on a factory and Packaging and shipping costs) – Both are incorrect. Insurance is fixed overhead (period cost under variable costing). Packaging and shipping costs are typically period costs (selling/distribution expenses), not manufacturing costs, unless they are packaging required to get the product ready for sale (which is rare and usually considered a selling expense).

D. 3 and 4 (Manufacturing supplies and Packaging and shipping costs) – Manufacturing supplies (Item 3) is correct as a variable product cost. However, packaging and shipping costs (Item 4) are generally classified as period costs (outbound freight and selling expenses), not product costs, under both variable and absorption costing.

References:

CIA Part 3 Syllabus – Financial Management / Cost Accounting: Explicitly tests the distinction between variable costing and absorption costing. Under variable costing, product costs include only direct materials, direct labor, and variable manufacturing overhead. Fixed manufacturing overhead is expensed as a period cost.

Explanation:

The customer purchased shoes from an online retailer and subsequently received unsolicited offers not only from that same retailer but also from other unrelated retailers offering similar products. This scenario indicates that the customer's personal data (purchase history, preferences, contact details) was improperly shared or sold to third-party entities without their explicit consent. This is a classic example of undue disclosure of information—a control weakness where sensitive customer data is disclosed to unauthorized external parties, violating privacy policies, data protection regulations (e.g., GDPR, CCPA), and the principle of data minimization. Strong data governance controls should restrict data sharing to only what is necessary and only with explicit customer consent.

Why the other options are incorrect:

A. Excessive collecting of information.
While collecting more data than necessary is a privacy concern, it does not explain why other retailers received the customer's data. The core issue here is the sharing of that data, not the volume collected. Excessive collection alone would not result in third parties sending offers unless the data was also disclosed.

B. Application of social engineering.
Social engineering is a manipulation technique used by attackers to trick individuals into revealing confidential information (e.g., phishing). This is an external threat vector, not a control weakness by the seller. The seller did not use social engineering; they improperly shared data.

C. Retention of incomplete information.
This refers to storing inaccurate or missing data (e.g., wrong address, missing consent records), which could lead to poor decision-making or compliance failures. However, the scenario involves accurate data being shared too broadly—the issue is disclosure, not completeness or accuracy.

References:

IIA GTAG – Privacy and Data Protection:Emphasizes that organizations must implement controls over data disclosure, including consent management, data sharing agreements, and vendor risk assessments to prevent unauthorized third-party access to personal information.

Explanation:

In a periodic inventory system, Cost of Goods Sold (COGS) is calculated using the formula: COGS = Beginning Inventory + Purchases – Ending Inventory.

If the beginning inventory is understated, this directly reduces the COGS calculation (because you are starting with a smaller number). Since COGS is an expense, a lower expense means higher gross profit and higher net income.

The impact flows through as follows:
Understated Beginning Inventory → Understated COGS → Overstated Gross Profit → Overstated Net Income.
This is a standard cause-and-effect relationship tested frequently in accounting and internal audit exams.

Why the other options are incorrect:

B. Cost of goods sold will be overstated and net income will be understated. This is the opposite effect. That would occur if beginning inventory were overstated, not understated.

C. Cost of goods sold will be understated and there will be no impact on net income. This is incorrect because any change in COGS directly impacts gross profit and net income. COGS and net income have an inverse relationship; they do not move independently.

D. There will be no impact on cost of goods sold and net income will be overstated. This is incorrect because COGS is impacted (understated). Net income is overstated, but the impact on COGS cannot be ignored, as the two are mathematically linked through the COGS formula.

References:

CIA Part 3 Syllabus – Financial Management / Accounting: Tests the candidate's understanding of inventory accounting, the periodic system, and the impact of inventory errors on financial statements.

GAAP – Inventory Measurement (ASC 330): Requires proper inventory valuation. Errors in beginning inventory have a direct reversing effect on COGS and net income, which auditors must understand to assess financial statement accuracy.