IIA-CIA-Part3 Exam Dumps - Business Knowledge for Internal Auditing

When an organization buys equity securities for trading purposes, it means that these securities are classified as trading securities. According to International Financial Reporting Standards (IFRS) and Generally Accepted Accounting Principles (GAAP):

Trading securities are measured at fair value.

Unrealized gains and losses from changes in fair value are recognized in net income, not in shareholders' equity.

A. At fair value with changes reported in the shareholders' equity section. (Incorrect)

This treatment applies to available-for-sale (AFS) securities under previous GAAP rules, but not to trading securities.

Under IFRS 9, AFS classification has been removed, and most equity investments are recorded at fair value through profit or loss (FVTPL).

B. At fair value with changes reported in net income. (Correct)

This is the correct treatment for trading securities, as per IFRS 9 and ASC 320 (FASB).

C. At amortized cost in the income statement. (Incorrect)

Amortized cost is used for held-to-maturity (HTM) debt securities, not for equity securities held for trading.

D. As current assets in the balance sheet. (Partially Correct but Incomplete)

While trading securities are usually classified as current assets, this answer does not address valuation and reporting of changes in fair value.

IIA Practice Guide: Auditing Investments highlights the importance of correctly valuing securities based on accounting standards.

IFRS 9 – Financial Instruments mandates fair value measurement for trading securities with gains/losses reported in profit or loss.

GAAP ASC 320 – Investments – Debt and Equity Securities aligns with IFRS, requiring fair value reporting through net income.

Explanation of Answer Choices:IIA References:Thus, the correct answer is B. At fair value with changes reported in net income.

A Value-Added Network (VAN) is a private, third-party managed network that provides secure electronic data interchange (EDI) and other communication services between business partners. VANs offer enhanced security, reliability, and efficiency in transmitting business-critical data, making them ideal for companies engaged in manufacturing and distribution that require secure and structured communication channels with trading partners.

Secure Network for Business Partners: The scenario describes a network that facilitates EDI between a company and its trading partners. A VAN specializes in providing secure and structured business communications.

Enhanced Efficiency and Customer Service: VANs streamline business operations by reducing transaction errors, improving order fulfillment, and increasing operational efficiencies.

Third-Party Management: Unlike traditional internal networks, VANs are managed by external service providers that offer additional security, compliance, and encryption measures.

Alignment with Internal Auditing Standards: The IIA emphasizes the importance of secure and reliable communication networks in governance, risk management, and internal controls. Secure data exchanges through a VAN mitigate risks associated with unauthorized access and data breaches.

B. A Local Area Network (LAN): LANs are confined to a limited geographical area, such as an office or a factory, and are used for internal communication rather than secure external partner communication.

C. A Metropolitan Area Network (MAN): MANs connect multiple LANs within a city or a metropolitan region but are not specifically designed for business-to-business data exchange.

D. A Wide Area Network (WAN): While WANs connect geographically dispersed networks, they do not inherently provide the secure, structured EDI services that a VAN does.

IIA Standard 2110 - Governance: Emphasizes the importance of IT governance and secure communication channels in protecting business data.

IIA Standard 2120 - Risk Management: Highlights the need for secure data transmission to mitigate cyber risks.

IIA Standard 2201 - Planning the Engagement: Requires auditors to assess IT infrastructure, including networks used for business operations.

COBIT Framework (Control Objectives for Information and Related Technologies): Supports the use of secure, managed networks like VANs for business data exchange.

Key Reasons Why Option A is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is A. A Value-Added Network (VAN).

Understanding a Man-in-the-Middle (MITM) Attack:

A Man-in-the-Middle (MITM) attack occurs when a cybercriminal intercepts, alters, or steals data while it is being transmitted between two parties.

The attacker can modify messages, inject malicious content, or eavesdrop on sensitive communications without the knowledge of the sender or receiver.

How MITM Attacks Work:

Attackers position themselves between two communicating parties (e.g., a user and a banking website) and intercept the data exchange.

This allows them to steal login credentials, financial information, or confidential communications.

Common MITM attack methods include:

Wi-Fi eavesdropping (public network interception).

Session hijacking (stealing active user sessions).

HTTPS spoofing (tricking users into thinking they are on a secure website).

Why Other Options Are Incorrect:

A. The perpetrator is able to delete data on the network without physical access to the device – Incorrect.

This describes a remote cyberattack, such as malware or ransomware, rather than MITM, which focuses on data interception.

B. The perpetrator is able to exploit network activities for unapproved purposes – Incorrect.

This is too broad and could refer to insider threats, malware, or privilege escalation attacks, rather than specifically MITM.

D. The perpetrator is able to disable default security controls and introduce additional vulnerabilities – Incorrect.

This describes a system exploitation attack, such as a rootkit or backdoor installation, not an MITM attack.

IIA’s Perspective on Cybersecurity and IT Risk Management:

IIA Standard 2110 – Governance requires organizations to implement cybersecurity controls to mitigate risks like MITM attacks.

IIA GTAG (Global Technology Audit Guide) on Cybersecurity Risks advises organizations to use encryption (e.g., TLS, VPNs) to protect data in transit.

NIST Cybersecurity Framework recommends multi-factor authentication (MFA) and secure protocols to prevent MITM attacks.

IIA References:

IIA Standard 2110 – IT Security and Cyber Risk Governance

IIA GTAG – Cybersecurity Controls and Threat Mitigation

NIST Cybersecurity Framework – Secure Data Transmission

Thus, the correct and verified answer is C. The perpetrator is able to take over control of data communication in transit and replace traffic.

The internal auditor compared vendor addresses (Finance Department records) with employee addresses (Payroll Department records). This process is an example of "Joining Data Sources", which involves merging different datasets to identify relationships, discrepancies, or anomalies.

Definition of Joining Data Sources:

This technique is used in data analytics when an auditor merges two or more datasets based on a common field (e.g., addresses in this case).

It helps identify potential conflicts of interest or fraudulent transactions, such as employees creating fake vendors to receive unauthorized payments.

Application in Auditing:

The auditor is cross-referencing records from two different departments to check for potential fraud, duplicate payments, or unauthorized vendor relationships.

If vendor addresses match employee addresses, it could indicate a fraud risk (e.g., an employee making payments to a shell company they control).

A. Duplicate Testing: ❌

Involves identifying duplicate records within a single dataset, such as repeated invoice numbers or duplicate payments to the same vendor.

Here, the auditor is comparing two datasets, not searching for duplicates in one dataset.

C. Gap Analysis: ❌

Identifies missing data or discrepancies between expected and actual records (e.g., missing vendor payments).

In this case, the auditor is not looking for missing data but rather comparing records.

D. Classification: ❌

Involves categorizing data into predefined groups (e.g., classifying vendors as high-risk or low-risk).

The auditor is not categorizing vendors but matching addresses across datasets.

IIA GTAG (Global Technology Audit Guide) – Data Analytics for Internal Auditors: Discusses joining data sources to detect fraud, errors, and conflicts of interest.

IIA Standard 1220 (Due Professional Care): Requires auditors to apply appropriate data analysis techniques to assess risks effectively.

ACFE (Association of Certified Fraud Examiners) – Fraud Detection Techniques: Recommends cross-referencing employee and vendor records to detect fraud schemes.

Step-by-Step Justification:Why Not the Other Options?IIA References:Thus, the correct answer is B. Joining data sources. ✅

Understanding Strategic Levels in an Organization:

Corporate-Level Strategy: Defines overall company direction, including mergers, acquisitions, and diversification.

Business-Level Strategy: Focuses on how the company competes in its industry (e.g., cost leadership, differentiation).

Functional-Level Strategy: Relates to specific departments (marketing, HR, IT) supporting business-level goals.

Why Option C (Business-Level Strategy) Is Correct?

The question "How does our organization compete?" directly relates to business-level strategy.

It focuses on competitive positioning within the industry, such as:

Cost leadership (competing on price)

Differentiation (unique product offerings)

IIA Standard 2110 – Governance requires auditors to evaluate strategic alignment with competitive positioning.

Why Other Options Are Incorrect?

Option A (Functional-Level Strategy):

Focuses on departmental decisions, not overall competition.

Option B (Corporate-Level Strategy):

Corporate strategy defines broad company direction, not specific competition strategies.

Option D (Department-Level Strategy):

Similar to functional strategy, it does not define how the company competes in the industry.

Business-level strategy answers "How does our organization compete?" by defining industry-specific competitive approaches.

IIA Standard 2110 supports governance over strategic positioning.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (Strategic Planning & Competitive Advantage)

Porter’s Competitive Strategy Framework

COSO ERM – Strategic Risk Management