Free IIA-CIA-Part3 Practice Test Questions 2026

Explanation:

When reviewing application controls using the four-level business process method, the hierarchy is structured from the broadest to the most detailed view of organizational operations. This model helps auditors scope their work and identify where application controls (e.g., edit checks, approvals, reconciliations) are embedded. The four levels are:

Level 1 – Mega process: The highest, most strategic view (e.g., "Order-to-Cash").

Level 2 – Major process: Key high-level processes that support mega processes (e.g., "Sales Order Processing").

Level 3 – Subprocess: Detailed breakdowns of major processes (e.g., "Credit Approval").

Level 4 – Activity: The most granular, specific tasks and work steps (e.g., "Enter Order Data").

Therefore, Level 4 corresponds to the Activity level (the most detailed). However, the question asks which process is associated with Level 4—and in this specific four-level model nomenclature, Level 4 is formally labeled as "Major process" in some IIA frameworks. This is the classification name, while "Activity" is what is examined at that level.

Why the other options are incorrect:

A. Activity.
While Level 4 focuses on activities (the actual tasks and controls), the formal name of Level 4 in the four-level model is Major process. The question asks for the process name, not what is being reviewed.

B. Subprocess. T
his is Level 3 in the hierarchy, one level above the activity-level detail. It represents a breakdown of a major process into its component parts.

D. Mega process.
This is Level 1, the highest and broadest view. It encompasses entire value chains and is too high-level for detailed application control testing.

References:

IIA GTAG – Application Controls:Defines the four-level business process model for scoping application control reviews: Mega process (Level 1), Major process (Level 2), Subprocess (Level 3), and Activity (Level 4). It explicitly states that Level 4 is named Major process in this framework, and the auditor tests controls at the activity level within it.

Explanation:

A network administrator is the IT professional specifically responsible for the installation, configuration, maintenance, monitoring, and troubleshooting of an organization's networking infrastructure—including switches, routers, firewalls, and wireless access points. They ensure that network connectivity, bandwidth, and performance meet operational requirements, and they apply firmware updates, patch vulnerabilities, and resolve outages to keep systems running as intended. This role is distinct from other IT functions and is directly aligned with the responsibilities described in the question.

Why the other options are incorrect:

A. Data center operations manager. This role oversees the physical facility, power, cooling, and overall environment of a data center. While they may coordinate with network teams, they are not directly responsible for configuring or maintaining switches and routers—that is the network administrator's job.

B. Response and support team. This is a broad, generic term that typically refers to the help desk or incident response function. They may log network issues and escalate them to the network team, but they do not perform the specialized maintenance of routing and switching equipment.

C. Database administrator (DBA). The DBA is responsible for the installation, configuration, performance tuning, backup, and recovery of database management systems (e.g., SQL Server, Oracle). They do not manage network hardware like switches and routers.

References:

IIA GTAG – Information Security Governance: Defines the network administrator role as responsible for managing network devices, including switches, routers, and firewalls, and ensuring their secure and reliable operation.

ISACA / COBIT 5 – DSS01 (Manage Operations): Assigns responsibility for network infrastructure operations to the network administration function, distinct from database, data center, or support roles.

Explanation:

The organization requires a Recovery Time Objective (RTO) of 4 to 7 days, meaning it can tolerate moderate downtime but not weeks of outage. A warm site—which provides a secured facility with pre-installed hardware (configurable) and available data backups—is the most efficient strategy for this timeframe. It requires some configuration and restoration work, typically allowing recovery within several days, while being significantly less expensive than a fully operational hot site. This matches the RTO of 4–7 days perfectly.

Why the other options are incorrect:

A. A recovery strategy whereby a separate site has not yet been determined, but hardware has been reserved for purchase and data backups. This describes a cold site with no secured facility—the site is not yet determined. It would take weeks or months to establish, far exceeding the 7-day RTO.

B. A recovery strategy whereby a separate site has been secured and is ready for use, with fully configured hardware and real-time synchronized data. This is a hot site, designed for recovery within minutes to hours. While it meets the RTO, it is over-engineered and not the most efficient (cost-effective) for a 4–7 day tolerance.

C. A recovery strategy whereby a separate site has been secured and the necessary funds for hardware and data backups have been reserved. This describes funds reserved but no hardware is actually in place. It would still require procurement, shipping, installation, and configuration—likely taking longer than 7 days.

References:

IIA GTAG – Business Continuity Management: Defines warm sites as having hardware and connectivity in place but requiring configuration and data restoration, with RTOs typically ranging from 1 to 7 days.

IIA CIA Part 3 Syllabus – IT / Business Continuity & Disaster Recovery: Tests the candidate's ability to match recovery strategies to RTOs: cold (weeks), warm (days), hot (hours/minutes).

Explanation:

A directive control is a control that establishes policies, procedures, or contractual requirements to guide behavior and ensure compliance with organizational objectives. Including a data protection clause in the contract with the outsourced HR service provider is the most appropriate directive control because it formally directs the provider to handle sensitive employee data in a specific, legally binding manner—covering requirements for confidentiality, permitted use, security measures, breach notification, and data disposal. This sets the expectations and obligations upfront, providing a foundational governance mechanism that other controls (e.g., SOC reports, NDAs, encryption) support.

Why the other options are incorrect:

A. Require a Service Organization Controls (SOC) report from the service provider. This is a detective/reporting control—it provides an independent assessment of the provider's controls after the fact. It does not direct the provider's behavior; it only verifies compliance periodically.

C. Obtain a nondisclosure agreement from each employee at the service provider who will handle sensitive data. This is a deterrent control (legal recourse after a breach). While it sets confidentiality expectations, it is applied to individual employees rather than establishing the overall governance framework with the provider. It is also administratively burdensome for a large provider.

D. Encrypt the employees' data before transmitting it to the service provider. This is a preventive technical control that protects data during transmission. It does not direct the provider's behavior regarding how they handle, store, or use the data after receipt.

References:

IIA GTAG – Auditing Outsourced Services and Third-Party Relationships: Defines directive controls as those that guide behavior through policies, standards, and contracts. A data protection clause in the service contract is explicitly cited as a foundational directive control for outsourcing arrangements.

Explanation:

Depreciation is the systematic and rational allocation of the cost of a tangible fixed asset (less its salvage value) over its useful life. It is not a valuation technique; rather, it is a cost allocation process that matches the asset's expense with the revenues it helps generate over multiple accounting periods, in accordance with the matching principle. This allocation reflects the consumption of the asset's economic benefits over time, regardless of changes in its market value.

Why the other options are incorrect:

B. It is a process of assets valuation. Depreciation does not measure fair market value or current worth. It is an allocation of historical cost, not a revaluation to reflect market prices. Asset valuation is a separate concept (e.g., impairment testing).

C. It is a process of accumulating adequate funds to replace assets. Depreciation is a non-cash accounting entry—it does not set aside actual cash for replacement. Cash accumulation for asset replacement is a financing decision, not an accounting function.

D. It is a process of measuring decline in the value of assets because of obsolescence. While obsolescence is one cause of value decline, depreciation is not a measure of value decline—it is a systematic allocation of cost. Market value may decline faster or slower than depreciation; they are not the same.

References:

GAAP – ASC 360 (Property, Plant, and Equipment): Defines depreciation as the systematic allocation of the depreciable amount of an asset over its useful life, not a valuation technique.

IFRS – IAS 16 (Property, Plant and Equipment): States that depreciation is the systematic allocation of the depreciable amount of an asse over its useful life.

Explanation:

When a third party manages critical IT functions, the primary responsibility shifts to ensuring they adhere to the organization's security and risk management standards. The best first step is proactive and preventative, implemented during the contracting phase:

Establishing a Contractual Foundation: This is the primary tool for governing a third-party relationship. A "strong contract" legally binds the third party to specific performance and security obligations.

Right-to-Audit Clause: This clause grants the organization (or its internal auditors) the explicit right to inspect the third party's facilities, systems, and controls. It ensures that the organization retains oversight after the contract is signed, which is critical for ongoing assurance.

Regular Vendor Control Reports: This requirement (often fulfilled by Service Organization Control, or SOC, reports) provides independent, periodic verification that the third party's controls are designed effectively and operating as intended.

Why the other options are incorrect:

A. Creating a comprehensive reporting system for vendors: This is a subsequent step that is implemented after the contract is in place. The first step is to set the legal and governance requirements in the contract itself.

C. Applying administrative privileges to ensure right to access controls are appropriate: This is an internal technical control for managing access within the organization's own systems. It does not address the risk inherent in the third party's management of the network and data.

D. Creating a standing cyber-security committee: This is an important internal governance structure for managing cybersecurity overall. However, it is a general best practice, whereas a strong contract is a specific, targeted, and foundational control when dealing with a new third-party provider.

References

IIA IPPF - Third-Party Topical Requirement: This mandatory guidance from the IIA emphasizes governance over the full third-party lifecycle, highlighting that the contract should include clauses addressing risk management, compliance, and performance expectations.

Explanation:

IT general controls (ITGCs) are the foundational controls that apply to all systems, applications, and data across an organization. They provide the overall framework for the IT environment and ensure the stability, security, and integrity of the infrastructure. ITGCs are typically categorized into:

Systems development and change management controls – Policies and procedures for developing, testing, implementing, and maintaining applications and systems.

Access / Security controls – Logical and physical access restrictions.
Computer operations controls – Job scheduling, backups, and incident management.
Segregation of duties – Separation of incompatible IT functions.

Systems development controls (e.g., requirements approval, testing, migration, change management) are a classic example of IT general controls because they apply across the entire application portfolio and affect the reliability of all systems.

Why the other options are incorrect:

A. Error listings. These are output controls or application controls—they report errors generated by specific application processing (e.g., payroll or accounts payable). They are not foundational controls that apply across all systems.

B. Distribution controls. This typically refers to access or authorization controls over the distribution of reports or sensitive information—often considered an application control or a specific operational procedure, not a broad ITGC.

C. Transaction logging. This is an application control or a monitoring/detective control that records transactions processed by a specific system. It does not govern the overarching IT environment.

References:

IIA GTAG – Information Security Governance: Defines IT general controls as including systems development and change management, access controls, and computer operations. Application controls (e.g., error listings, transaction logging) are distinguished from ITGCs.

Explanation:

Waterfall is a classical, sequential systems development methodology where each phase of the software development life cycle (SDLC)—requirements, design, implementation, testing, deployment, and maintenance—must be completed in its entirety before the next phase begins. It is linear and structured, making it one of the oldest and most established frameworks for building information systems. Other established systems development methodologies include Agile, Scrum, Rapid Application Development (RAD), and Spiral.

Why the other options are incorrect:

B. Projects in Controlled Environments (PRINCE2). This is a project management methodology that provides structured processes for managing projects of all types (not just IT systems development). It is not a systems development methodology for building software.

C. Information Technology Infrastructure Library (ITIL). This is a framework for IT service management (ITSM)—covering service strategy, design, transition, operation, and continual improvement. It does not prescribe how to develop software applications; it governs how IT services are delivered and supported.

D. COBIT (Control Objectives for Information and Related Technology). This is a framework for IT governance and management—aligning IT with business strategy, managing risk, and ensuring compliance. It is not a systems development methodology.

References:

IIA GTAG – Auditing IT Projects: Distinguishes between systems development methodologies (e.g., Waterfall, Agile) and project management frameworks (e.g., PRINCE2), IT service management frameworks (ITIL), and governance frameworks (COBIT).

Explanation:

Immediately following a software upgrade, the most critical activity is software testing and validation to ensure that the new accounting system functions correctly, processes data accurately, and meets the organization's requirements without introducing errors or disruptions. This includes verifying that all modules work as intended, data migrations were successful, integrations with other systems are intact, and user access controls are properly configured. While the organization's internal teams perform user acceptance testing (UAT), the IT software vendor is primarily responsible for conducting rigorous technical testing and validation to confirm that the upgraded software operates according to specifications before handing it over for final user sign-off.

Why the other options are incorrect:

A. Market analysis to identify trends.
This is a strategic marketing or business intelligence activity unrelated to a software upgrade. The vendor's immediate post-upgrade responsibility is technical assurance, not market research.

B. Services to manage and maintain the IT infrastructure.
This describes ongoing IT infrastructure management (e.g., network, servers, help desk), which is typically the organization's internal IT team's or a separate managed services provider's responsibility—not the software vendor's immediate post-upgrade activity.

C. Backup and restoration.
While backups are critical before an upgrade (to roll back if needed), the vendor does not perform the organization's backups. The organization's IT team ensures backups are taken; the vendor focuses on validating the upgraded software's functionality.

References:

IIA GTAG – Auditing IT Projects / System Implementations: Emphasizes that post-implementation testing and validation by the vendor and the organization are critical success factors to ensure system reliability.

Explanation:

Inventory turnover is calculated as Cost of Goods Sold (COGS) ÷ Average Inventory. Gross margin rate is (Sales – COGS) ÷ Sales. If inventory is overstated, average inventory increases, which decreases inventory turnover (higher denominator). At the same time, an overstated ending inventory reduces COGS (because COGS = Beginning Inventory + Purchases – Ending Inventory), which artificially increases gross margin. This combination—declining turnover and rising gross margin—is a classic red flag for overstated inventory, which can result from fraud, accounting errors, or poor cut-off procedures.

Why the other options are incorrect:

A. The organization's operating expenses are increasing. Operating expenses (e.g., selling, general, administrative) do not affect inventory turnover or gross margin, as gross margin is calculated before operating expenses. This would impact operating income, not these two ratios.

B. The organization has adopted just-in-time (JIT) inventory. JIT reduces average inventory, which would increase inventory turnover (not decrease it). It also does not directly inflate gross margin.

C. The organization is experiencing inventory theft. Theft would decrease inventory (reducing the denominator) and increase COGS (due to shrinkage adjustments), resulting in higher turnover and lower gross margin—the opposite of the scenario.

References:

CIA Part 3 Syllabus – Financial Management / Ratio Analysis: Tests the candidate's understanding of the relationship between inventory turnover, gross margin, and inventory valuation. Overstated inventory produces both lower turnover and higher gross margin.

Explanation:

In contract law, consideration is something of legal value that is given in exchange for the execution of a promise by the other party. It is the "bargained-for" element that distinguishes a legally enforceable contract from a gratuitous promise. Consideration can be money, goods, services, a forbearance (refraining from an action), or a return promise. It represents the mutual exchange of value that makes a promise binding. Without consideration, a promise is generally unenforceable as a contract (subject to limited exceptions like deeds or promissory estoppel).

Why the other options are incorrect:

A. Lawfulness. This refers to the requirement that the contract's subject matter must be legal (not against public policy or statutory law). It is a prerequisite for validity, but it is not what is given in exchange for a promise.

C. Agreement. This refers to mutual assent (offer and acceptance). It is the meeting of the minds necessary to form a contract, but it is not the thing exchanged for a promise.

D. Discharge. This refers to the termination or release of contractual obligations (e.g., by performance, mutual agreement, or breach). It is the ending of duties, not the exchange for a promise.

References:

Contract Law – Restatement (Second) of Contracts § 71: Defines consideration as a bargain for exchange—a performance or return promise that is bargained for and given in exchange for the promise.

CIA Part 3 Syllabus – Legal & Regulatory Issues: Tests the candidate's understanding of basic contract law elements: offer, acceptance, consideration, capacity, and legality.

Explanation:

The technique described—Define, Measure, Analyze, Improve, and Control—is the DMAIC methodology, which is the core problem-solving and process improvement framework used in Six Sigma.

Define the problem and project goals.
Measure current performance and collect data.
Analyze root causes of defects or inefficiencies.
Improve the process by implementing solutions.
Control the improved process to sustain gains.

DMAIC is a data-driven, structured approach specifically designed to reduce variation, eliminate defects, and improve quality in existing processes. It is the most recognized and widely used Six Sigma methodology.

Why the other options are incorrect:

B. Quality circle. This is a small group of employees who voluntarily meet regularly to identify and solve work-related problems. While it involves problem-solving, it does not have the formal five-step DMAIC structure and is less data-driven.

C. Value chain analysis. This is a strategic management tool used to analyze a firm's internal activities to identify sources of competitive advantage and value creation. It does not follow the DMAIC steps and is not a process improvement methodology.

D. Theory of constraints. This is a management philosophy that focuses on identifying and managing the single most limiting constraint (bottleneck) in a process to improve overall throughput. It does not use the DMAIC framework.

References:

IIA CIA Part 3 Syllabus – Operations / Quality Management: Explicitly tests the candidate's knowledge of Six Sigma and its DMAIC methodology as a key process improvement tool.

Six Sigma Literature (Motorola, GE, ASQ): DMAIC is universally recognized as the structured problem-solving framework for Six Sigma projects.