Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation:

The organization requires a Recovery Time Objective (RTO) of 4 to 7 days, meaning it can tolerate moderate downtime but not weeks of outage. A warm site—which provides a secured facility with pre-installed hardware (configurable) and available data backups—is the most efficient strategy for this timeframe. It requires some configuration and restoration work, typically allowing recovery within several days, while being significantly less expensive than a fully operational hot site. This matches the RTO of 4–7 days perfectly.

Why the other options are incorrect:

A. A recovery strategy whereby a separate site has not yet been determined, but hardware has been reserved for purchase and data backups. This describes a cold site with no secured facility—the site is not yet determined. It would take weeks or months to establish, far exceeding the 7-day RTO.

B. A recovery strategy whereby a separate site has been secured and is ready for use, with fully configured hardware and real-time synchronized data. This is a hot site, designed for recovery within minutes to hours. While it meets the RTO, it is over-engineered and not the most efficient (cost-effective) for a 4–7 day tolerance.

C. A recovery strategy whereby a separate site has been secured and the necessary funds for hardware and data backups have been reserved. This describes funds reserved but no hardware is actually in place. It would still require procurement, shipping, installation, and configuration—likely taking longer than 7 days.

References:

IIA GTAG – Business Continuity Management: Defines warm sites as having hardware and connectivity in place but requiring configuration and data restoration, with RTOs typically ranging from 1 to 7 days.

IIA CIA Part 3 Syllabus – IT / Business Continuity & Disaster Recovery: Tests the candidate's ability to match recovery strategies to RTOs: cold (weeks), warm (days), hot (hours/minutes).

Explanation:

A directive control is a control that establishes policies, procedures, or contractual requirements to guide behavior and ensure compliance with organizational objectives. Including a data protection clause in the contract with the outsourced HR service provider is the most appropriate directive control because it formally directs the provider to handle sensitive employee data in a specific, legally binding manner—covering requirements for confidentiality, permitted use, security measures, breach notification, and data disposal. This sets the expectations and obligations upfront, providing a foundational governance mechanism that other controls (e.g., SOC reports, NDAs, encryption) support.

Why the other options are incorrect:

A. Require a Service Organization Controls (SOC) report from the service provider. This is a detective/reporting control—it provides an independent assessment of the provider's controls after the fact. It does not direct the provider's behavior; it only verifies compliance periodically.

C. Obtain a nondisclosure agreement from each employee at the service provider who will handle sensitive data. This is a deterrent control (legal recourse after a breach). While it sets confidentiality expectations, it is applied to individual employees rather than establishing the overall governance framework with the provider. It is also administratively burdensome for a large provider.

D. Encrypt the employees' data before transmitting it to the service provider. This is a preventive technical control that protects data during transmission. It does not direct the provider's behavior regarding how they handle, store, or use the data after receipt.

References:

IIA GTAG – Auditing Outsourced Services and Third-Party Relationships: Defines directive controls as those that guide behavior through policies, standards, and contracts. A data protection clause in the service contract is explicitly cited as a foundational directive control for outsourcing arrangements.

Explanation:

Depreciation is the systematic and rational allocation of the cost of a tangible fixed asset (less its salvage value) over its useful life. It is not a valuation technique; rather, it is a cost allocation process that matches the asset's expense with the revenues it helps generate over multiple accounting periods, in accordance with the matching principle. This allocation reflects the consumption of the asset's economic benefits over time, regardless of changes in its market value.

Why the other options are incorrect:

B. It is a process of assets valuation. Depreciation does not measure fair market value or current worth. It is an allocation of historical cost, not a revaluation to reflect market prices. Asset valuation is a separate concept (e.g., impairment testing).

C. It is a process of accumulating adequate funds to replace assets. Depreciation is a non-cash accounting entry—it does not set aside actual cash for replacement. Cash accumulation for asset replacement is a financing decision, not an accounting function.

D. It is a process of measuring decline in the value of assets because of obsolescence. While obsolescence is one cause of value decline, depreciation is not a measure of value decline—it is a systematic allocation of cost. Market value may decline faster or slower than depreciation; they are not the same.

References:

GAAP – ASC 360 (Property, Plant, and Equipment): Defines depreciation as the systematic allocation of the depreciable amount of an asset over its useful life, not a valuation technique.

IFRS – IAS 16 (Property, Plant and Equipment): States that depreciation is the systematic allocation of the depreciable amount of an asse over its useful life.

Explanation:

When a third party manages critical IT functions, the primary responsibility shifts to ensuring they adhere to the organization's security and risk management standards. The best first step is proactive and preventative, implemented during the contracting phase:

Establishing a Contractual Foundation: This is the primary tool for governing a third-party relationship. A "strong contract" legally binds the third party to specific performance and security obligations.

Right-to-Audit Clause: This clause grants the organization (or its internal auditors) the explicit right to inspect the third party's facilities, systems, and controls. It ensures that the organization retains oversight after the contract is signed, which is critical for ongoing assurance.

Regular Vendor Control Reports: This requirement (often fulfilled by Service Organization Control, or SOC, reports) provides independent, periodic verification that the third party's controls are designed effectively and operating as intended.

Why the other options are incorrect:

A. Creating a comprehensive reporting system for vendors: This is a subsequent step that is implemented after the contract is in place. The first step is to set the legal and governance requirements in the contract itself.

C. Applying administrative privileges to ensure right to access controls are appropriate: This is an internal technical control for managing access within the organization's own systems. It does not address the risk inherent in the third party's management of the network and data.

D. Creating a standing cyber-security committee: This is an important internal governance structure for managing cybersecurity overall. However, it is a general best practice, whereas a strong contract is a specific, targeted, and foundational control when dealing with a new third-party provider.

References

IIA IPPF - Third-Party Topical Requirement: This mandatory guidance from the IIA emphasizes governance over the full third-party lifecycle, highlighting that the contract should include clauses addressing risk management, compliance, and performance expectations.

Explanation:

IT general controls (ITGCs) are the foundational controls that apply to all systems, applications, and data across an organization. They provide the overall framework for the IT environment and ensure the stability, security, and integrity of the infrastructure. ITGCs are typically categorized into:

Systems development and change management controls – Policies and procedures for developing, testing, implementing, and maintaining applications and systems.

Access / Security controls – Logical and physical access restrictions.
Computer operations controls – Job scheduling, backups, and incident management.
Segregation of duties – Separation of incompatible IT functions.

Systems development controls (e.g., requirements approval, testing, migration, change management) are a classic example of IT general controls because they apply across the entire application portfolio and affect the reliability of all systems.

Why the other options are incorrect:

A. Error listings. These are output controls or application controls—they report errors generated by specific application processing (e.g., payroll or accounts payable). They are not foundational controls that apply across all systems.

B. Distribution controls. This typically refers to access or authorization controls over the distribution of reports or sensitive information—often considered an application control or a specific operational procedure, not a broad ITGC.

C. Transaction logging. This is an application control or a monitoring/detective control that records transactions processed by a specific system. It does not govern the overarching IT environment.

References:

IIA GTAG – Information Security Governance: Defines IT general controls as including systems development and change management, access controls, and computer operations. Application controls (e.g., error listings, transaction logging) are distinguished from ITGCs.

Explanation:

Waterfall is a classical, sequential systems development methodology where each phase of the software development life cycle (SDLC)—requirements, design, implementation, testing, deployment, and maintenance—must be completed in its entirety before the next phase begins. It is linear and structured, making it one of the oldest and most established frameworks for building information systems. Other established systems development methodologies include Agile, Scrum, Rapid Application Development (RAD), and Spiral.

Why the other options are incorrect:

B. Projects in Controlled Environments (PRINCE2). This is a project management methodology that provides structured processes for managing projects of all types (not just IT systems development). It is not a systems development methodology for building software.

C. Information Technology Infrastructure Library (ITIL). This is a framework for IT service management (ITSM)—covering service strategy, design, transition, operation, and continual improvement. It does not prescribe how to develop software applications; it governs how IT services are delivered and supported.

D. COBIT (Control Objectives for Information and Related Technology). This is a framework for IT governance and management—aligning IT with business strategy, managing risk, and ensuring compliance. It is not a systems development methodology.

References:

IIA GTAG – Auditing IT Projects: Distinguishes between systems development methodologies (e.g., Waterfall, Agile) and project management frameworks (e.g., PRINCE2), IT service management frameworks (ITIL), and governance frameworks (COBIT).

Explanation:

Immediately following a software upgrade, the most critical activity is software testing and validation to ensure that the new accounting system functions correctly, processes data accurately, and meets the organization's requirements without introducing errors or disruptions. This includes verifying that all modules work as intended, data migrations were successful, integrations with other systems are intact, and user access controls are properly configured. While the organization's internal teams perform user acceptance testing (UAT), the IT software vendor is primarily responsible for conducting rigorous technical testing and validation to confirm that the upgraded software operates according to specifications before handing it over for final user sign-off.

Why the other options are incorrect:

A. Market analysis to identify trends.
This is a strategic marketing or business intelligence activity unrelated to a software upgrade. The vendor's immediate post-upgrade responsibility is technical assurance, not market research.

B. Services to manage and maintain the IT infrastructure.
This describes ongoing IT infrastructure management (e.g., network, servers, help desk), which is typically the organization's internal IT team's or a separate managed services provider's responsibility—not the software vendor's immediate post-upgrade activity.

C. Backup and restoration.
While backups are critical before an upgrade (to roll back if needed), the vendor does not perform the organization's backups. The organization's IT team ensures backups are taken; the vendor focuses on validating the upgraded software's functionality.

References:

IIA GTAG – Auditing IT Projects / System Implementations: Emphasizes that post-implementation testing and validation by the vendor and the organization are critical success factors to ensure system reliability.

Explanation:

In contract law, consideration is something of legal value that is given in exchange for the execution of a promise by the other party. It is the "bargained-for" element that distinguishes a legally enforceable contract from a gratuitous promise. Consideration can be money, goods, services, a forbearance (refraining from an action), or a return promise. It represents the mutual exchange of value that makes a promise binding. Without consideration, a promise is generally unenforceable as a contract (subject to limited exceptions like deeds or promissory estoppel).

Why the other options are incorrect:

A. Lawfulness. This refers to the requirement that the contract's subject matter must be legal (not against public policy or statutory law). It is a prerequisite for validity, but it is not what is given in exchange for a promise.

C. Agreement. This refers to mutual assent (offer and acceptance). It is the meeting of the minds necessary to form a contract, but it is not the thing exchanged for a promise.

D. Discharge. This refers to the termination or release of contractual obligations (e.g., by performance, mutual agreement, or breach). It is the ending of duties, not the exchange for a promise.

References:

Contract Law – Restatement (Second) of Contracts § 71: Defines consideration as a bargain for exchange—a performance or return promise that is bargained for and given in exchange for the promise.

CIA Part 3 Syllabus – Legal & Regulatory Issues: Tests the candidate's understanding of basic contract law elements: offer, acceptance, consideration, capacity, and legality.

Explanation:

The technique described—Define, Measure, Analyze, Improve, and Control—is the DMAIC methodology, which is the core problem-solving and process improvement framework used in Six Sigma.

Define the problem and project goals.
Measure current performance and collect data.
Analyze root causes of defects or inefficiencies.
Improve the process by implementing solutions.
Control the improved process to sustain gains.

DMAIC is a data-driven, structured approach specifically designed to reduce variation, eliminate defects, and improve quality in existing processes. It is the most recognized and widely used Six Sigma methodology.

Why the other options are incorrect:

B. Quality circle. This is a small group of employees who voluntarily meet regularly to identify and solve work-related problems. While it involves problem-solving, it does not have the formal five-step DMAIC structure and is less data-driven.

C. Value chain analysis. This is a strategic management tool used to analyze a firm's internal activities to identify sources of competitive advantage and value creation. It does not follow the DMAIC steps and is not a process improvement methodology.

D. Theory of constraints. This is a management philosophy that focuses on identifying and managing the single most limiting constraint (bottleneck) in a process to improve overall throughput. It does not use the DMAIC framework.

References:

IIA CIA Part 3 Syllabus – Operations / Quality Management: Explicitly tests the candidate's knowledge of Six Sigma and its DMAIC methodology as a key process improvement tool.

Six Sigma Literature (Motorola, GE, ASQ): DMAIC is universally recognized as the structured problem-solving framework for Six Sigma projects.

Explanation:

When determining the level of physical controls required for a workstation (e.g., locks, secure rooms, surveillance, access badges), the primary factor to consider is the value to the business—which encompasses the sensitivity and criticality of the data processed, the importance of the applications hosted, and the cost of replacement or recovery. This value directly drives the risk assessment that dictates the appropriate level of physical security. Higher-value workstations (e.g., those handling financial records, personally identifiable information, or trade secrets) require stronger physical controls, while lower-value assets may warrant minimal protection. This aligns with the fundamental principle of risk-based security: protect assets in proportion to their value and the risk of loss.

Why the other options are incorrect:

A. Ease of use. Physical controls should not be compromised for convenience. Security and usability must be balanced, but ease of use is not a primary driver for determining the level of physical control—it is a secondary consideration in control design.

C. Intrusion prevention.This is a category of controls, not a factor to consider. Intrusion prevention systems (e.g., locks, alarms) are the means of physical protection, but the level of such controls is determined by the asset's business value and risk exposure.

D. Ergonomic model. Ergonomics relates to user comfort, health, and productivity (keyboard height, monitor placement, chair design). It has no bearing on the physical security requirements for preventing unauthorized access or theft.

References:

IIA GTAG – Information Security Governance: Emphasizes that physical security controls must be commensurate with the value and sensitivity of the assets being protected. A risk-based approach is fundamental.

Explanation:

Integration testing is a phase of the software development life cycle (SDLC) where individual software modules, subsystems, and hardware components are combined and tested as a group to ensure they interact correctly and function together as a cohesive system. The primary purpose is to identify interface defects, data flow issues, and communication errors between components that may not be detectable when each unit is tested in isolation. It verifies that the integrated system meets its overall design specifications and that all dependencies work harmoniously.

Why the other options are incorrect:

A. To verify that the application meets stated user requirements. This is the purpose of User Acceptance Testing (UAT), which occurs after integration testing and validates that the system fulfills business needs from the end-user perspective.

B. To verify that standalone programs match code specifications.This describes Unit Testing, where individual modules are tested in isolation against their specific code specifications. Integration testing occurs after unit testing.

C. To verify that the application would work appropriately for the intended number of users. This is the purpose of Performance/Load Testing, which evaluates system behavior under expected or peak user loads. It is not the goal of integration testing.

References:

IIA GTAG – Auditing IT Projects / System Implementations: Defines integration testing as the phase where software and hardware components are combined and tested to verify interoperability and interface integrity.

Explanation:

When an organization implements Mobile Device Management (MDM) with remote wipe capabilities on employees' personal smart devices, it creates a significant privacy risk—the ability to delete all data on the device, including the employee's personal photos, contacts, and files. In exchange for obtaining the employee's consent to install such intrusive software, the organization has a corresponding ethical and legal obligation to ensure that system administrators cannot access or delete the employee's personal data. This is typically achieved through containerization (separating corporate and personal data) or by configuring the MDM to wipe only the corporate partition, leaving personal content untouched. This balances the organization's security needs with the employee's privacy rights.

Why the other options are incorrect:

A. That those employees who do not consent to MDM software cannot have an email account. This is a possible enforcement mechanism, but it is not the exchange the organization must provide for consent. The question asks what the organization should ensure in exchange for consent—privacy protection, not a penalty for refusal.

C. That monitoring of employees' online activities is conducted in a covert way to avoid upsetting them. Covert monitoring is generally unethical and often illegal. Organizations must have clear, transparent policies regarding monitoring; secrecy undermines trust and violates privacy laws.

D. That employee consent includes appropriate waivers regarding potential breaches to their privacy. A waiver of privacy rights is not an adequate "exchange." Employees cannot fully waive fundamental privacy protections, and the organization should proactively protect personal data, not merely seek to limit liability through waivers.

References:

IIA GTAG – Auditing Bring Your Own Device (BYOD): Emphasizes that organizations must balance security controls (like remote wipe) with employee privacy rights, typically through containerization and clear policies that ensure personal data is not accessed or deleted by administrators.