Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation:

Coordinating project resources is a fundamental activity of the Planning phase of the project life cycle. During this phase, the project manager creates the foundational plans that determine how, when, and what resources (personnel, equipment, budget) will be used to achieve project objectives . This is when the project manager assesses resource needs, identifies and secures the team, and establishes the project's constraints . While execution is when resources are used and monitoring is when their use is tracked , the critical decisions and coordination regarding their procurement, allocation, and scheduling occur during the planning stage .

Why the other options are incorrect:

A. Initiation. The project is authorized at this high-level stage, but detailed coordination of resources takes place in the subsequent planning phase .

C. Execution. During execution, the project manager manages and directs the resources that were already planned and acquired , but the coordination of their need and assignment is an upstream planning activity.

D. Monitoring. This phase is for tracking progress, managing risks, and taking corrective action , but resource coordination (e.g., who gets what) is established in the plan created during the Planning phase.

References:

IIA GTAG – Auditing IT Projects: Emphasizes that a structured project methodology, including a robust planning phase, is critical for ensuring resource allocation and stakeholder coordination .

IIA CIA Part 3 Syllabus – Project Management: The exam tests the distinction between project phases; resource planning is a core activity of the Planning phase, not Execution or Monitoring.

Explanation:

Predictive analytics uses historical data, statistical algorithms, and machine learning techniques to identify the likelihood of future outcomes. It answers the question, "What is likely to happen?" In this scenario, the supplier analyzes sales data and applies assumptions about future weather conditions to predict which locations will experience faster stock depletion. This goes beyond simply describing the past (descriptive) or diagnosing why something happened (diagnostic)—it forecasts future stock-level decreases so the organization can take proactive action.

Why the other options are incorrect:

A. A supplier analyzed instances where different types of spare parts were out of stock prior to scheduled deliveries. This is descriptive analytics—it summarizes what has happened in the past (e.g., historical out-of-stock instances). It does not project future outcomes.

C. A supplier discovered that increases in sales consistently correlated with stormy weather. This is diagnostic analytics—it identifies the reason or correlation behind an event (why sales increased). While it could be used as input for predictive models, the analysis itself is diagnostic, not predictive.

D. A supplier analyzed sales and stock information and modeled different scenarios for making decisions on stock reordering. This is prescriptive analytics—it uses scenarios and optimization to recommend what actions to take (e.g., when and how much to reorder). Prescriptive analytics builds on predictive insights but goes further by providing actionable recommendations.

References:

IIA GTAG – Data Analysis Technologies: Clearly distinguishes predictive analytics (forecasting future events) from descriptive (summarizing past), diagnostic (explaining causes), and prescriptive (recommending actions). Applying weather assumptions to forecast stock depletion is a textbook predictive example.

Explanation:

Two-factor authentication (2FA) requires the use of two distinct authentication factors from three recognized categories: (1) something you know (password, PIN), (2) something you have (key fob, smart card), and (3) something you are (biometrics like fingerprint, facial geometry, voice). Option D combines a fingerprint (something you are) with a PIN (something you know)—two factors from entirely different categories. This significantly enhances security because compromising one factor (e.g., stealing a PIN via phishing) still leaves the biometric factor intact, making unauthorized access far more difficult. 2FA is a critical control for protecting sensitive systems and data, and is widely mandated by security frameworks for remote access and privileged accounts.

Why the other options are incorrect:

A. Facial geometry and voice recognition. Both are biometrics (something you are), belonging to the same factor category. This is a single-factor method with two steps, not true 2FA. It offers incremental security but does not mitigate the risk of biometric spoofing.

B. Password and a separate passphrase. Both are knowledge-based credentials (something you know). This is still single-factor authentication—if an attacker steals one, they can likely steal the other through the same vector (e.g., keylogging or phishing). No distinct factor category is added.

C. Key fob and a smart card. Both are possession factors (something you have). This is also single-factor authentication; if both physical items are lost or stolen together, the account is fully compromised. Two items from the same category do not constitute multi-factor authentication.

References:

IIA GTAG – Information Security Governance:Defines 2FA as requiring credentials from at least two different categories (knowledge, possession, inherence) to establish identity, and highlights fingerprint + PIN as a standard implementation.

NIST SP 800-63B – Digital Identity Guidelines: Explicitly mandates that multi-factor authentication must use two or more distinct authentication factors. A PIN combined with a biometric is cited as a strong, accepted 2FA method.

Explanation:

The matching principle is a fundamental accrual accounting concept that requires expenses to be recognized in the same accounting period as the revenues they helped to generate. This ensures that net income accurately reflects the true economic performance of the period. For example, the cost of goods sold is recognized in the same period as the sales revenue from those goods, and sales commissions are expensed when the related sales occur. This principle directly ties expense recognition to revenue recognition—option C captures this cause-and-effect relationship precisely.

Why the other options are incorrect:

A. Revenues should be recognized when earned. This describes the revenue recognition principle, not the matching principle. It governs when to record revenue (when earned and realizable), but does not address expense timing.

B. Revenue recognition is matched with cash. This describes cash basis accounting, which is the opposite of accrual accounting. Under the matching principle, revenue is matched with expenses, not with cash receipts.

D. Expenses are recognized at each accounting period. This is vague and incomplete. While expenses are recognized periodically, the matching principle specifically requires them to be recognized in the period in which the related revenue is recognized, not merely at arbitrary intervals.

References:

GAAP – ASC 606 (Revenue Recognition) & ASC 720 (Expense Recognition): The matching principle is embedded in accrual accounting, requiring that expenses be matched with associated revenues to properly measure periodic income.

CIA Part 3 Syllabus – Financial Management / Accounting: Tests the candidate's understanding of fundamental accounting concepts, including the distinction between revenue recognition, matching principle, and cash vs. accrual basis.

Explanation:

Stock options grant senior management the right to purchase company shares at a fixed price (exercise price) on or after a future vesting date. Because the ultimate value of these options depends entirely on the company's stock price appreciation over time, they create a powerful, direct link between management's personal financial gain and the organization's sustained market performance. This is the most effective way to achieve the board's goal of incentivizing the long-term health of the organization for several reasons: (1) options typically have multi-year vesting schedules (e.g., 3–5 years), which discourages short-term myopic decisions; (2) they reward absolute stock price growth, which reflects the market's composite judgment of the company's future earnings, innovation, brand strength, and competitive positioning; and (3) they align management's interests directly with those of shareholders, mitigating the principal-agent problem by ensuring executives share in both the upside (and downside) of long-term value creation. By tying compensation to a future-oriented metric that encapsulates the organization's overall strategic success, stock options are the superior tool for promoting sustainable growth and financial resilience.

Why the other options are incorrect:

A. Commissions.
Commissions are transaction-based incentives tied to specific, immediate outcomes such as sales volume or contract closures. They encourage short-term revenue generation and often lead to aggressive selling practices, discounting, or customer churn—all of which can harm the organization's long-term reputation, profitability, and customer relationships. They provide no incentive for strategic thinking or investment in future capabilities.

C. Gain-sharing bonuses.
Gain-sharing plans reward employees for achieving defined operational targets within a specific period, such as cost reduction, production efficiency, or defect reduction. While they promote teamwork and operational excellence, these targets are typically measured quarterly or annually and focus on internal processes, not on the company's long-term strategic positioning, market valuation, or shareholder returns. They can also incentivize short-term cost-cutting at the expense of long-term investment (e.g., deferring maintenance or R&D).

D. Allowances.
Allowances are fixed, non-performance-based stipends provided for specific purposes like travel, housing, or vehicle expenses. They are not performance incentives at all and do not motivate executives to improve organizational outcomes, whether short-term or long-term. They are merely administrative benefits with zero alignment to corporate goals.

References:

IIA CIA Part 3 Syllabus – Human Resources / Compensation & Motivation: Explicitly tests the understanding that equity-based compensation (stock options, restricted stock) is the primary mechanism for aligning executive behavior with long-term organizational sustainability and shareholder value creation.

Explanation:

Data mining is an exploratory, predictive analytical technique used to discover previously unknown patterns, anomalies, correlations, or trends within large datasets. It is applied when the user does not have a specific hypothesis or question in mind, but rather wants to explore the data to uncover new insights. In the context of internal audit, using data mining exploratorily to perform a risk assessment across the entire organization—analyzing diverse data sources (e.g., financial metrics, operational incidents, compliance history, whistleblower reports) to detect emerging risk clusters or correlations—is a perfect example. This process helps auditors identify potential audit subjects that may not have been obvious through traditional judgment-based scoping, providing objective, data-driven input for the annual audit plan.

Why the other options are incorrect:

A. Internal auditors perform reconciliation procedures to support an external audit of financial reporting. Reconciliation is a substantive analytical procedure or descriptive analytics—it compares two sets of records (e.g., bank statements vs. general ledger) to verify accuracy and completeness. It is a structured, known test with a specific expected outcome, not exploratory data mining.

B. Internal auditors perform a systems-focused analysis to review relevant controls. This describes a control testing or walkthrough procedure, often involving process mapping or reviewing access logs against a standard. It is a targeted, hypothesis-driven test of control design or operating effectiveness, not an open-ended exploration of patterns.

D. Internal auditors test IT general controls with regard to operating effectiveness versus design. This is detailed control testing (e.g., reviewing user access provisioning, change management logs) with a clear pass/fail criterion. It does not involve mining large datasets to discover unknown relationships—it verifies whether existing controls are operating as intended.

References:

IIA GTAG – Data Analysis Technologies: Distinguishes between data mining (exploratory discovery of unknown patterns) and other analytical techniques (descriptive, diagnostic). Risk assessment using data mining to identify audit subjects is cited as a key exploratory application.

IIA Standard 2120 – Risk Management:Requires internal auditors to evaluate the effectiveness of the organization's risk management processes. Using data-driven exploratory analysis to inform the audit plan directly supports this standard.

Explanation:

A fundamental principle of project management is that the cost of change (rework, design modifications, scope adjustments) increases exponentially as the project progresses through its life cycle. In the early stages (initiation and planning), changes are relatively inexpensive because little work has been executed, and designs are still flexible. However, as the project moves into execution and especially toward completion, changes require redoing completed work, retesting, re-procuring materials, and potentially delaying delivery—all of which incur significant costs. This is a well-documented phenomenon in project management literature and is a critical concept for auditors to understand when assessing change control processes and project governance.

Why the other options are incorrect:

A. Risk and uncertainty increase over the life of the project.
This is false. Risk and uncertainty are highest at the beginning of the project (when requirements are unclear, resources are unproven, and external factors are unknown) and decrease as the project progresses and more information becomes available (requirements freeze, designs are finalized, testing validates outcomes).

B. Costs and staffing levels are typically high as the project draws to a close.
This is incorrect. Staffing levels and cost burn rates are typically highest during the execution phase (when most of the active work occurs) and ramp down during the closing phase as deliverables are finalized, teams are released, and administrative closure takes place.

D. The project life cycle corresponds with the life cycle of the product produced by or modified by the project.
This is not necessarily true. The project life cycle (initiation, planning, execution, closure) is distinct from the product life cycle (introduction, growth, maturity, decline). A project may produce a product that continues to exist, operate, and evolve long after the project itself has ended, often through subsequent maintenance or enhancement projects.

References:

Project Management Institute (PMI)– A Guide to the Project Management Body of Knowledge (PMBOK® Guide): Explicitly states that the ability to influence project outcomes is highest at the start, but the cost of changes increases dramatically as the project progresses.

Explanation:

Inventory fraud often involves the deliberate manipulation of inventory records to cover up theft, spoilage, or misappropriation. One of the most common methods is through unauthorized or fictitious inventory adjustments (write-offs, shrinkage adjustments, or transfers). By performing a stratified analysis of inventory adjustments by warehouse location, the auditor can compare adjustment patterns across different sites. A location with a disproportionately high volume, frequency, or dollar amount of adjustments relative to its inventory size or sales volume is a red flag for potential fraud. Stratification allows the auditor to isolate outliers and focus investigative procedures on high-risk locations, making it an effective detection technique.

Why the other options are incorrect:

A. Analyze invoice payments just under individual authorization limits.
This technique is designed to detect procurement fraud or payment splitting (where an employee deliberately keeps invoices below their approval threshold to bypass controls). It does not target inventory fraud, which involves physical stock or inventory record manipulation.

C. Analyze inventory invoice amounts and compare with approved contract amounts.
This procedure checks for pricing or billing errors/vendor fraud—whether the organization is being overcharged compared to agreed contract prices. While this is a valid procurement audit test, it does not detect fraud involving physical inventory (e.g., theft, false adjustments).

D. Analyze differences discovered during duplicate payment testing.
This targets accounts payable fraud or system errors where the same invoice is paid twice. It relates to cash disbursements, not inventory balances or adjustments, and would not uncover theft of physical goods or falsified inventory counts.

References:

IIA GTAG – Data Analysis Technologies: Identifies stratification and outlier analysis as powerful techniques for detecting anomalies in inventory adjustments, which may indicate fraud, theft, or control weaknesses.

IIA Practice Guide – Auditing Inventory and Warehouse Operations: Recommends analyzing inventory adjustment patterns by location, product type, and employee to identify red flags for misappropriation.

Explanation:

Activity-Based Costing (ABC) is a costing methodology that assigns overhead costs to products based on their consumption of activities (cost drivers) rather than using a single volume-based allocation base (like direct labor hours or machine hours). ABC is not a standalone costing system; rather, it is an enhancement or refinement that can be integrated into both job order costing (for custom, unique products or batches) and process costing (for continuous, homogeneous production). In a job order environment, ABC helps accurately allocate overhead to individual jobs based on diverse activities; in a process environment, it refines overhead allocation across multiple processes or departments. This flexibility makes ABC applicable across virtually all manufacturing and service settings.

Why the other options are incorrect:

A. An ABC costing system is similar to conventional costing systems in how it treats the allocation of manufacturing overhead.
This is false. The primary distinction of ABC is that it uses multiple activity cost pools and multiple cost drivers (unit-level, batch-level, product-level, facility-level) to allocate overhead, whereas conventional systems typically use a single, volume-based allocation base (e.g., direct labor hours or machine hours) for all overhead. They are fundamentally different in methodology.

B. An ABC costing system uses a single unit-level basis to allocate overhead costs to products.
This is the opposite of ABC. Conventional costing uses a single unit-level basis; ABC uses multiple cost drivers across various activity levels (unit, batch, product, facility) to achieve more accurate cost assignment.

D. The primary disadvantage of an ABC costing system is less accurate product costing.
This is false. The primary advantage of ABC is more accurate product costing because it better reflects the actual consumption of resources. Its primary disadvantages are the high implementation cost, complexity, and data collection burden—not inaccuracy.

References:

CIA Part 3 Syllabus – Financial Management / Cost Accounting: Explicitly tests the candidate's understanding that ABC is a refinement of traditional costing and can be applied to both job order and process costing environments.

Horngren / Managerial Accounting Textbooks: Define ABC as using multiple activity drivers across different levels and confirm it is adaptable to any production environment.

Explanation:

User-developed applications (UDAs)—also known as end-user computing (EUC)—are applications created by non-IT users (e.g., spreadsheets, databases, small scripts) to address specific business needs. Because they are developed outside formal IT governance, they often lack version control, proper testing, segregation of duties, and change management procedures. When users make updates, corrections, or adjustments to these applications (e.g., modifying a macro, changing a formula, or copying a spreadsheet), they can inadvertently introduce errors, break existing functionality, or create data integrity issues without any oversight or quality assurance. This is a well-documented risk of UDAs, as even minor changes can have unintended cascading effects on critical business processes or financial reports that rely on them.

Why the other options are incorrect:

A. UDAs are less flexible and more difficult to configure than traditional IT applications. This is the opposite of reality. UDAs are typically highly flexible and easy to configure by end-users (e.g., creating pivot tables, writing custom formulas) without going through formal IT processes. Traditional IT applications are more rigid and require formal development cycles to modify.

C. UDAs typically are subjected to application development and change management controls. This is false. The defining risk of UDAs is that they are not subject to the same rigorous development, testing, and change management controls as formal IT applications. They are often created informally without documentation, peer review, or approval.

D. Using UDAs typically enhances the organization's ability to comply with regulatory factors. This is incorrect. UDAs often increase compliance risk because they lack audit trails, version control, and data validation—all critical for regulatory compliance (e.g., SOX, GDPR, HIPAA). Organizations must implement compensating controls to mitigate these risks.

References:

IIA GTAG – Auditing User-Developed Applications / End-User Computing: Explicitly identifies that UDAs are prone to errors when updated due to lack of formal change controls, testing, and segregation of duties.

IIA CIA Part 3 Syllabus – IT / Application Controls: Tests the candidate's understanding of the risks associated with EUC, including spreadsheet errors, lack of version control, and unauthorized modifications.

Explanation:

The most effective control for preventing the disclosure of confidential electronic information is to ensure that employees can only access the data they absolutely need to perform their specific job functions—a principle known as least privilege or need-to-know. By implementing role-based access controls (RBAC) that limit access based on employee duties, the organization drastically reduces the number of individuals who can view or download sensitive data, thereby minimizing the attack surface and the potential for both accidental and intentional disclosures. This is a preventive control that stops unauthorized access from occurring in the first place, which is far more effective than detective or corrective measures.

Why the other options are incorrect:

A. Nondisclosure agreements (NDAs) between the firm and its employees. NDAs are deterrent controls that legally prohibit employees from sharing information, but they do not physically or technically prevent disclosure. An employee who signs an NDA can still intentionally or accidentally leak data; the NDA only provides legal recourse after the breach occurs.

B. Logs of user activity within the information system.Activity logs are detective controls—they record who accessed what and when, but they do not prevent the disclosure from happening. They help identify breaches after they occur, but the damage may already be done.

C. Two-factor authentication for access into the information system. 2FA is an authentication control that verifies the identity of the user. While it prevents unauthorized users from gaining access, it does not limit what an authorized user can view or download. An authenticated user with broad access rights could still disclose all confidential information.

References:

IIA GTAG – Information Security Governance:Defines need-to-know and least privilege as foundational preventive controls for protecting confidential data. Access should be granted only to the minimum data necessary for job performance.

IIA Standard 1220.A2 – Due Professional Care: mplicitly supports the use of preventive controls, as they are more effective and efficient than relying solely on detective controls.

Explanation:

Centralization concentrates decision-making authority at top management. This structure decreases collusion risk because fewer individuals hold approval power, transactions follow uniform processes, and oversight is concentrated. Conversely, decentralization disperses authority across multiple managers, locations, and business units, creating more opportunities for local employees to override controls or approve each other's transactions without immediate corporate detection. Therefore, collusion is more likely in a decentralized environment, not a centralized one. Additionally, centralization increases strategic alignment because all policies and resource allocations flow from a single source, ensuring consistency across the organization.

Why the other options are incorrect:

A & B. Fraud committed through collusion is more likely when authority is centralized. – False. Collusion risk increases with decentralization, not centralization. This is a fundamental internal control principle.

C. When authority is centralized, the alignment of activities to achieve business goals typically is decreased. – False. Centralization increases alignment by ensuring uniform strategic direction from the top. Decentralization reduces alignment as local units pursue divergent priorities.

D. Using separation of duties to mitigate collusion is reduced only when authority is centralized. – False. Separation of duties (SoD) is a universal control applicable in both structures. It is not "reduced" by centralization; in fact, centralization often makes SoD easier to enforce due to shorter, more standardized approval chains.

References:

IIA CIA Part 3 Syllabus – Organizational Structure: Teaches that decentralization increases collusion risk due to dispersed authority, while centralization enhances strategic alignment and uniformity.

COSO Internal Control – Control Environment: States that organizational structure directly impacts control effectiveness; decentralized entities require stronger monitoring to mitigate collusion.