IIA-CIA-Part3 Exam Dumps - Internal Audit Function

The annual rate of return method estimates profitability by dividing expected annual net income by the average investment. It is an accounting-based capital budgeting technique and does not directly consider the time value of money. Option A is incorrect because a proposal is normally acceptable under net present value when NPV is positive, not negative. Option B incorrectly describes internal rate of return; IRR is the discount rate at which the present value of cash inflows equals the present value of cash outflows. Option C is incorrect because the payback method measures how long it takes to recover the original investment, not the investment plus expected return. Internal auditors should understand capital budgeting methods when reviewing investment decisions. Therefore, Option D is correct.

Comprehensive and Detailed In-Depth Explanation:

Password selection is the most dependent on the user, as it involves choosing and setting a secure password that meets organizational security requirements.

Option B (Password aging) – Controlled by system settings, not directly by the user.

Option C (Password lockout) – Automatically triggered after failed login attempts.

Option D (Password rotation) – Enforced by system policies, not the individual user’s decision.

Since password security starts with user selection, Option A is correct.

The strongest reason to test an IT contingency plan is to determine whether the test results contribute to improving the continuity and recovery program. A contingency plan cannot guarantee prevention of all significant interruptions; its real purpose is to maintain or restore operations within acceptable recovery objectives after disruption. Testing reveals weaknesses in procedures, roles, communications, backups, recovery sites, and dependencies. Security weaknesses may be identified, but that is not the primary purpose of contingency testing. Following up audit deficiencies is important, but it is separate from the reason for testing the plan. Internal audit should evaluate whether tests are realistic, documented, reviewed, and used to update the plan. Therefore, Option C is correct.

When examining risk management, internal audit must evaluate risk exposures relating to governance, operations, and information systems. Governance risks concern oversight, ethics, accountability, and decision-making. Operational risks concern efficiency, effectiveness, asset protection, and achievement of business objectives. Information systems risks concern confidentiality, integrity, availability, reliability, and security of information. Organizational structure may influence risk ownership and control accountability, but it is not listed here as one of the main required exposure categories in the same way as governance, operations, and information systems. Internal audit planning should therefore assess whether key risk exposures across governance, operations, and technology are identified, assessed, and managed within risk appetite. The correct combination is items 1, 2, and 3 only. Therefore, Option C is correct.

When a limiting factor exists, production should prioritize the product with the highest contribution per unit of scarce resource. Material is limited to 500 kg. Product X has contribution of $10 − $2 material cost = $8 per unit, or $4 per kg. Product Y has contribution of $13 − $6 material cost = $7 per unit, or about $1.17 per kg. Product X gives higher contribution per kg, so the organization should satisfy full demand for X first. Producing 100 units of X uses 200 kg, leaving 300 kg. Product Y requires 6 kg per unit, so 300 kg allows production of 50 units. Internal audit should verify that scarce-resource decisions use contribution per limiting factor, not contribution per unit alone. Therefore, Option A is correct.

The IIA defines conciseness in audit communications as avoiding redundancy and excluding unnecessary or irrelevant details. This ensures reports remain focused, easy to read, and useful to stakeholders.

Option A (constructive) means helping to add value and improve operations. Option B (complete) refers to covering all essential issues. Option D (clear) refers to understandable language. The correct characteristic here is concise (Option C).

When employees work from home, secure remote access to the organization ' s network is essential to protect data and ensure confidentiality. A Virtual Private Network (VPN) is the best option for enabling this securely.

Correct Answer (D - A Virtual Private Network (VPN))

A VPN creates a secure, encrypted connection between the employee ' s device and the organization’s internal network.

It prevents unauthorized access by ensuring that data is transmitted securely over the internet.

The IIA GTAG 17: Auditing Network Security recommends VPNs for secure remote work environments to prevent cyber threats.

Why Other Options Are Incorrect:

Option A (A Wireless Local Area Network - WLAN):

A WLAN is used within an office or home environment, but it does not provide secure remote access to an organization ' s network.

Option B (A Personal Area Network - PAN):

A PAN connects devices like smartphones and laptops within a short range (e.g., Bluetooth), but it is not suitable for secure remote access.

Option C (A Wide Area Network - WAN):

A WAN connects multiple locations, but it does not provide encryption or remote security like a VPN.

IIA GTAG 17: Auditing Network Security – Recommends VPNs for secure remote access.

IIA Practice Guide: Auditing IT Security Controls – Covers VPNs as a key security control for remote work.

Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because a VPN ensures secure, encrypted communication for employees working from home.