IIA-CIA-Part3 exam questions

1. Question 1

   Single answer

   Upon completing a follow-up audit engagement, the chief audit executive (CAE) noted that management has not implemented any mitigation measures to address the high risks that were reported in the initial audit report. What initial step must the CAE take to address this situation?

   • A

     Communicate the issue to senior management

   • B

     Discuss the issue with members of management responsible for the risk area

   • C

     Report the situation to the external auditors

   • D

     Escalate the issue to the board

   Reveal answer

   Correct answer

   • B

     Discuss the issue with members of management responsible for the risk area

   Explanation

   According to the International Standards for the Professional Practice of Internal Auditing, when significant risk exposures remain unaddressed after a follow-up engagement, the CAE must first discuss the matter with the appropriate level of management responsible for the area. The purpose is to determine whether there is a valid reason for not implementing the recommended corrective actions, to clarify management’s perspective, and to encourage timely resolution.

   If management still refuses to act and the risk remains high, the CAE must then escalate the issue to senior management and, if necessary, to the board. Immediate escalation to the board without first discussing with management is inappropriate, as it bypasses the chain of accountability. Reporting directly to external auditors is also not the responsibility of the CAE unless specifically mandated by regulation or law.

   Therefore, the correct initial step is to discuss the issue with management responsible for the risk area (Option B).

2. Question 2

   Single answer

   An organization's IT systems can only be accessed using the organization's virtual private network. However, organizational emails, videoconferencing, and file-sharing tools are cloud-based and can be accessed using multi-factor authentication via any device. Which of the following risks should the organization acknowledge?

   • A

     The risk that internal data can be leaked via unapproved applications

   • B

     The risk that virtual private networks are not secure

   • C

     The risk that remote access controls are usually ineffective in cloud solutions

   • D

     The risk that employees may read organizational emails outside of business hours

   Reveal answer

   Correct answer

   • A

     The risk that internal data can be leaked via unapproved applications

   Explanation

   Cloud-based applications accessible outside the VPN perimeter increase the possibility of data leakage through unapproved or unsecured applications (shadow IT). Even with multi-factor authentication, risks remain around the use of personal devices and uncontrolled storage or sharing.

   Option B is incorrect because VPNs are generally secure if configured correctly. Option C is misleading, as remote access controls can be effective in cloud solutions when properly designed. Option D (employees accessing emails after hours) is not a risk related to security but rather a work-life balance issue.

   Thus, the key risk is potential leakage of organizational data via unapproved or uncontrolled applications (Option A).

   IIA Global Technology Audit Guide (GTAG): Auditing Cloud Computing; IIA Standards – Standard 2110: Governance.

3. Question 3

   Single answer

   Which of the following data privacy concerns can be attributed specifically to blockchain technologies?

   • A

     Cybercriminals mainly resort to blockchain technologies to phish for private data

   • B

     Since blockchain transactions can be easily tampered with, the risk of private data leakage is high

   • C

     Data privacy regulations overregulate the usage of private data in blockchain transactions

   • D

     Immutability of blockchain technologies makes private data erasure a challenge

   Reveal answer

   Correct answer

   • D

     Immutability of blockchain technologies makes private data erasure a challenge

   Explanation

   A core feature of blockchain technology is immutability—once data is recorded, it cannot be altered or deleted. While this supports integrity and transparency, it also creates a conflict with data privacy regulations such as the General Data Protection Regulation (GDPR), which grants individuals the “right to be forgotten.” The inability to erase personal data stored on blockchain creates a compliance challenge.

   Options A and B are incorrect: phishing is not inherent to blockchain, and transactions are not easily tampered with (immutability actually prevents that). Option C is misleading because regulations address data use but do not “overregulate” blockchain specifically.

   IIA Global Technology Audit Guide (GTAG): Understanding Blockchain and Related Risks.

4. Getting the hang of it? 786 more IIA-CIA-Part3 questions are waiting, each with its answer. Unlock them all

5. Question 4

   Single answer

   Which of the following would be most likely found in an internal audit procedures manual?

   • A

     A summary of the strategic plan of the area under review

   • B

     Appropriate response options for when findings are disputed by management

   • C

     An explanation of the resources needed for each engagement

   • D

     The extent of the auditor's authority to collect data from management

   Reveal answer

   Correct answer

   • B

     Appropriate response options for when findings are disputed by management

   Explanation

   The internal audit procedures manual documents policies and procedures for conducting audit engagements, including steps to follow when issues arise, such as disputes with management regarding findings. It ensures consistency and standardization of audit practice.

   Option A (strategic plan) and Option C (resources) are not part of audit procedures but rather part of planning or organizational documents. Option D (authority to collect data) belongs in the internal audit charter, not in the procedures manual.

   Therefore, the correct answer is appropriate response options for disputes with management (Option B).

   IIA Practice Guide – Developing the Internal Audit Manual.

6. Question 5

   Single answer

   The sole internal auditor of a municipality wants to implement proper supervision over internal audit workpapers. Which of the following would be the most appropriate?

   • A

     According to the Global Internal Audit Standards, in this situation the internal auditor can perform a self-review of selected workpapers

   • B

     Request each engagement client to conduct a review of a sample of workpapers at the end of the engagement

   • C

     Ask the board or management to sign off on workpapers

   • D

     Engage peer reviewers from other organizations with legal precautions in place

   Reveal answer

   Correct answer

   • D

     Engage peer reviewers from other organizations with legal precautions in place

   Explanation

   The Global Internal Audit Standards require that workpapers be properly supervised and reviewed to ensure quality and compliance. A sole auditor cannot perform a meaningful self-review (Option A). Having clients review workpapers (Option B) compromises independence. Having management or the board sign off (Option C) is also inappropriate as it undermines audit objectivity.

   The most suitable solution is to arrange for peer reviews from external auditors or other organizations, with confidentiality and legal safeguards in place. This provides independent oversight while maintaining audit quality.

   IIA Standards – Standard 1312: External Assessments; Practice Guide – Quality Assurance and Improvement Program.

7. Question 6 Locked Unlock to see this question
8. Question 7 Locked Unlock to see this question

Back to the IIA-CIA-Part3 exam page