IIA-CIA-Part3 Exam Dumps - Internal Audit Function

Understanding Net Income Overstatement:

Net Income (NI) = Revenue - Expenses

If net income is overstated, then expenses must be understated or revenue must be overstated.

Cost of Goods Sold (COGS) is an expense that directly affects net income.

Why Understated COGS Causes Overstated Net Income:

COGS = Beginning Inventory + Purchases - Ending Inventory

If COGS is understated, expenses are lower than they should be, resulting in a higher net income.

Why Other Options Are Incorrect:

A. Beginning inventory overstated: This would increase COGS (not decrease it), leading to a lower net income.

C. Ending inventory understated: This would increase COGS, reducing net income.

D. COGS overstated: This would result in a lower net income, not an overstatement.

IIA Standards and References:

IIA Standard 2120 – Risk Management: Internal auditors must assess financial misstatements and risks.

IIA Practice Guide: Auditing Financial Statement Close Processes (2018): Emphasizes accuracy in inventory and expense reporting.

COSO Internal Control – Integrated Framework: Supports accuracy in financial reporting and controls over misstated financial data.

Thus, the correct answer is B: Cost of goods sold was understated for the year.

In contract law, a witness's primary role is to confirm that the signatures on the contract were made by the actual parties (promisor and promisee) and that they signed it in the witness’s presence. This helps prevent disputes regarding forgery or coercion.

(A) A witness verifies the quantities of the copies signed.

Incorrect: The witness's role is not to verify how many copies were signed but rather to confirm authenticity.

(B) A witness verifies that the contract was signed with the free consent of the promisor and promisee.

Partially correct but not the primary role: The witness’s presence may discourage coercion, but their main function is not to confirm free consent (that is a legal principle covered by contract law and not necessarily the witness's duty).

(C) A witness ensures the completeness of the contract between the promisor and promisee.

Incorrect: The completeness of the contract is the responsibility of the parties involved, not the witness.

(D) A witness validates that the signatures on the contract were signed by the promisor and promisee. (Correct Answer)

This aligns with the legal definition of a witness in contract law: verifying the identity of signatories and ensuring that they physically signed the contract.

The witness does not interpret the contract's terms or validate its content, only the signatures.

IIA Standard 2410 – Criteria for Communicating: Requires auditors to confirm the authenticity and validity of documents.

IIA Standard 2330 – Documenting Information: Supports the principle of ensuring reliable and complete documentation.

Contract Law Principles: A witness’s role is to verify the signatories’ identities and confirm they signed the document in their presence.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) because a witness’s main duty is to validate that the contract was signed by the identified parties, ensuring authenticity and reducing legal disputes.

The CAE’s role is to provide assurance that risks are identified and managed appropriately. When residual risk appears to exceed the organization’s tolerance, the CAE should first communicate the matter with senior management to discuss the issue and understand management’s acceptance of risk. Only if the risk remains unresolved should it be escalated to the board.

Option A is management’s responsibility, not internal audit’s. Option B is incomplete as evidence alone does not fulfill the communication requirement. Option C is premature because immediate escalation to the board skips management dialogue.

A preventive control is designed to stop security breaches before they happen. In data center security, preventing unauthorized physical access is crucial.

Prevents Unauthorized Entry – Restricts access only to authorized personnel.

Tracks and Logs Access – Records who enters and exits the data center, enhancing security monitoring.

Enhances Security Layers – Often combined with biometric authentication or PINs for stronger access control.

Meets IT Security Standards – Aligns with ISO 27001, NIST, and IIA’s GTAG recommendations on physical security.

A. Motion detectors – These are detective controls, identifying movement but not preventing unauthorized access.

C. Security cameras – Also detective, as they record events but do not prevent physical breaches.

D. Monitoring access to data center workstations – This ensures data integrity but does not prevent physical access.

IIA’s GTAG (Global Technology Audit Guide) on Information Security – Recommends strong physical access controls like key cards.

NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) – Emphasizes access control as a preventive security measure.

ISO 27001 Annex A.11 (Physical and Environmental Security) – Requires access control for secure areas, including data centers.

Why Key Card Access is the Best Preventive Control?Why Not the Other Options?IIA References:

Data and system backups are a critical part of business continuity and disaster recovery (BC/DR) strategies, ensuring that organizations can restore data and systems to a prior state in the event of system failure, cyberattacks, or disasters.

Primary Purpose of Backup Systems:

The core objective of data and systems backup is to restore data and systems to a previous point in time in case of an unexpected incident.

According to IIA GTAG on Business Continuity Management, backups enable organizations to recover lost, corrupted, or compromised data from an earlier state.

Why Not Other Options?

A. To restore all data and systems immediately after the occurrence of an incident:

This is a misconception because restoration times depend on the Recovery Time Objective (RTO) and the complexity of the incident.

B. To set the maximum allowable downtime to restore systems and data after the occurrence of an incident:

This describes RTO, which is part of business continuity planning but not the primary purpose of backups.

C. To set the point in time to which systems and data must be recovered after the occurrence of an incident:

This describes the Recovery Point Objective (RPO), which determines the acceptable amount of data loss but does not define the main goal of backups.

IIA GTAG – Business Continuity Management

IIA Practice Guide: Auditing Business Continuity and Disaster Recovery

IIA Standard 2120 – Risk Management and IT Controls

Step-by-Step Justification:IIA References:Thus, the correct and verified answer is D. To restore data and systems to a previous point in time after the occurrence of an incident

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is the primary control for preventing unauthorized external access to an organization's network, making it the best answer.

A. Firewall (Correct Answer) – Firewalls prevent unauthorized access by filtering traffic, blocking malicious connections, and securing the network perimeter.

B. Encryption – While encryption protects data confidentiality, it does not actively prevent unauthorized access to a network.

C. Antivirus – Antivirus software protects against malware and viruses but does not prevent unauthorized network access.

D. Biometrics – Biometrics controls physical or logical access (e.g., fingerprint authentication) but does not secure a network from external threats.

IIA GTAG 15 – Information Security Governance highlights firewalls as a critical security control for network protection.

IIA IPPF Standard 2110 – Governance emphasizes the need for network security policies that include firewalls.

NIST SP 800-41 Rev. 1 – Guidelines on Firewalls and Firewall Policy states that firewalls are the first line of defense in securing organizational networks.

Explanation of Each Option:IIA References: