IIA-CIA-Part3 Exam Dumps - Internal Audit Function

Customer departmentalization groups organizational activities based on customer type or customer segment. In this case, community banking, institutional banking, and agricultural banking represent different customer groups with distinct needs, products, risk profiles, regulatory requirements, and service expectations. Product departmentalization would group activities by products or services, such as loans, deposits, or wealth management. Process departmentalization would group work by process steps, such as underwriting, processing, and servicing. Functional departmentalization groups activities by functions such as finance, operations, human resources, or marketing. Internal auditors need to understand departmentalization because it affects accountability, performance reporting, risk ownership, and control design. Since the bank is organized around customer categories, the correct answer is customer departmentalization, Option D.

Malware Defense as a Cybersecurity Monitoring Activity:

Malware defense refers to the use of antivirus software, endpoint detection and response (EDR), behavior analysis, and real-time monitoring to detect and block malicious code before it can be installed on an organization ' s systems.

It helps prevent infections from viruses, ransomware, spyware, trojans, and worms that can disrupt business operations.

IIA GTAG (Global Technology Audit Guide) on Cybersecurity states that monitoring tools should proactively detect and neutralize threats before they can execute malicious actions.

A. Boundary defense (Incorrect)

Boundary defense includes firewalls, intrusion detection/prevention systems (IDS/IPS), and network segmentation, which control external access but do not directly monitor and remove malware.

Malware can still enter through phishing emails, infected USB drives, or compromised internal systems.

C. Penetration tests (Incorrect)

Penetration tests simulate attacks to identify vulnerabilities, but they do not actively monitor and prevent malware from being installed.

They help improve security but are not a continuous monitoring activity.

D. Wireless access controls (Incorrect)

Wireless security helps prevent unauthorized network access, but it does not specifically monitor and block malware installation.

Malware can still spread via legitimate access points, infected devices, or phishing attacks.

Explanation of Answer Choice B (Correct Answer):Explanation of Incorrect Answers:Conclusion:To deter disruptive codes (malware) from being installed, organizations should implement continuous malware defense (Option B), including antivirus software, endpoint security, and behavioral analytics.

IIA References:

IIA GTAG - Cybersecurity

IIA Standard 2120 - Risk Management

Contracting department personnel are the most appropriate source because they are directly involved in the bidding process, tender documentation, vendor communications, evaluation procedures, and contract award practices. Their information is both relevant and reliable for understanding whether questionable practices occurred. Senior management may explain business justification, but it may not have detailed process-level knowledge. Fraud hotline personnel may provide allegation data, but they may not understand the bidding mechanics. Potential vendors may provide useful external perspectives, but their information may be incomplete or biased by self-interest. Internal auditors should first obtain process evidence from those responsible for the contracting activity, then corroborate it with documentation, vendor records, approvals, and exception analysis. Therefore, Option D is correct.

The most recent backup is primarily used to restore lost data in the event of a system failure, data corruption, or cyberattack. If a data center failure occurs, the latest backup is the best source to recover the human resources database and resume operations.

(A) Incorrect – An incorrect program fix was implemented just prior to the database backup.

If an incorrect fix was applied before the backup, restoring the latest backup would still contain the error.

The organization would need to restore an earlier version before the faulty update.

(B) Incorrect – The organization is preparing to train all employees on the new self-service benefits system.

The latest backup is not needed for training; the live system or historical data would be used instead.

(C) Correct – There was a data center failure that requires restoring the system at the backup site.

In the event of a system failure, restoring from the most recent backup minimizes data loss and downtime.

This is the primary reason for maintaining regular backups.

(D) Incorrect – There is a need to access prior year-end training reports for all employees in the human resources database.

Historical records would likely be stored in archived backups or reports, not the latest backup.

The most recent backup contains current data, not old reports.

IIA’s GTAG (Global Technology Audit Guide) – IT Disaster Recovery and Backup Strategies

Covers the importance of backups in system restoration.

NIST Cybersecurity Framework – Data Recovery and Business Continuity

Recommends frequent backups to protect against system failures.

ISO 22301 – Business Continuity Management

Defines recovery procedures and best practices for backup site restoration.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

Diagnostic analytics is used to understand why something happened. In this scenario, the internal auditor has already identified an anomaly: a significant drop in accounts payable volume. The auditor then creates scenarios to explain the possible causes of that anomaly, which is diagnostic analysis. Descriptive analytics summarizes what happened, such as reporting the volume decline. Predictive analytics estimates what is likely to happen in the future. Prescriptive analytics recommends actions based on expected outcomes or optimization. Internal auditors use diagnostic analysis to investigate variances, exceptions, unusual patterns, control failures, and root causes. Since the auditor is trying to explain the cause of the accounts payable change, Option B is correct.

The waterfall systems development approach follows a sequential structure in which one phase is substantially completed before the next begins. The expected flow is requirements definition, design, analysis or detailed specification, program design, coding, testing, and operation or maintenance. Among the available options, Option C presents the best sequence because it places requirements first, coding after design work, testing after coding, and operations last. Options A and D start with or place coding too early. Option B incorrectly places testing before coding. Internal audit should evaluate whether development projects have approved requirements, documented design, controlled coding, independent testing, user acceptance, and implementation approval. Therefore, Option C is the best answer from the options provided.

Inventory obsolescence risk is driven mainly by whether inventory on hand can be sold before it becomes outdated, unsellable, or requires markdown. Monitoring inventory balances is essential because excessive quantities, slow-moving items, or aging stock indicate potential obsolescence. Monitoring sales trends is equally important because declining sales may show reduced demand, product substitution, seasonal changes, or market rejection. Together, these measures help management identify items requiring discounting, production changes, procurement reduction, or write-down evaluation. Market share forecasts may provide broader strategic insight, but they are less direct for managing existing inventory obsolescence. Sales returns may indicate quality or customer satisfaction problems, but returns alone do not adequately measure whether inventory is becoming obsolete. Therefore, the necessary monitoring items are inventory balances and sales trends, making Option C correct.