IIA-CIA-Part3 Exam Dumps - Internal Audit Function

Software licenses commonly permit the purchaser to make one backup copy for protection against loss or damage, provided it is not used as an additional installed copy. Copy 1, made solely for backup purposes, is therefore generally legal. Copy 2, made for use by another member of the department, is not legal unless the license permits multiple installations or concurrent users. Making an additional working copy without authorization violates license terms and copyright law. Internal auditors should review software asset management controls, license inventories, installation monitoring, procurement records, and user awareness. Unauthorized copying exposes the organization to legal penalties, vendor claims, reputational damage, and compliance findings. Therefore, only Copy 1 is legal, making Option B correct.

The most effective CSR strategy for minimizing confrontations with activists and lobbyists is continual evaluation of stakeholder needs and opinions. Activists and lobbyists often challenge organizations when they believe stakeholder concerns are ignored, concealed, or handled reactively. Ongoing stakeholder engagement allows the organization to identify concerns early, understand expectations, adjust practices, and communicate credibly. Strict legal compliance is necessary but may not satisfy broader social expectations. Publicity campaigns can backfire if they appear superficial or unsupported by action. Philanthropy may build goodwill but does not address underlying stakeholder concerns. Internal audit can assess whether CSR governance includes stakeholder mapping, grievance mechanisms, transparent reporting, and escalation procedures. Therefore, Option A is correct.

A multi-domestic strategy is effective when large differences exist between countries in customer preferences, culture, regulation, distribution, pricing, language, or competitive conditions. Under this strategy, local subsidiaries or country managers are given flexibility to adapt products, marketing, operations, and customer approaches to local needs. Option A describes a global standardization strategy, not multi-domestic strategy. Option B is incorrect because multi-domestic strategy requires decentralized decision-making rather than centralized control. Option D describes advantages more commonly associated with global or transnational coordination, not local adaptation. Internal auditors reviewing multinational operations should understand the strategy because it affects authority, control consistency, compliance risk, reporting structures, and performance measurement. Therefore, Option C is correct.

A sales conversion rate measures the percentage of prospects, leads, visitors, or sales opportunities that become actual customers or completed sales. Moving from 5 percent to 12 percent indicates that the organization is converting a higher proportion of opportunities into sales. This reflects better sales activity, more effective sales processes, improved targeting, better customer engagement, or stronger conversion controls. It does not directly measure inventory usage, because inventory turnover, stockout rates, carrying costs, and inventory days are separate metrics. Option A is the opposite of the trend. Internal auditors reviewing performance metrics should confirm that indicators are properly defined and linked to business objectives. Since the conversion rate improved, Option C is correct.

Treasury stock transactions are equity transactions, not income statement transactions. The organization originally acquired the treasury shares at $10 per share, so the treasury stock cost is $10,000. When it sells 1,000 shares at $15 per share, it receives cash of $15,000 and removes treasury stock at its $10,000 cost. The excess of $5,000 is credited to additional paid-in capital from treasury stock transactions. It is not recorded as a gain because treasury stock transactions do not create income. Option B is incorrect because treasury stock should be credited, not debited, when reissued. Option D is also incorrect. Therefore, Option C is correct.

Physical controls are security measures that prevent unauthorized physical access to critical assets, such as IT infrastructure, sensitive documents, or restricted areas.

(A) Preventing database administrators from initiating program changes:

This is a logical (IT) control rather than a physical control. Logical controls manage access permissions and prevent unauthorized software changes.

(B) Blocking technicians from getting into the network room (Correct Answer):

This is a physical control because it prevents unauthorized personnel from physically accessing critical IT infrastructure, such as servers and networking devices.

Unauthorized access to a network room could lead to data breaches, hardware manipulation, or cyberattacks.

(C) Restricting system programmers ' access to database facilities:

This is an access control measure, which can be either logical (permissions, role-based access) or physical. However, it primarily refers to IT access controls rather than a physical security measure.

(D) Using encryption for data transmitted over the public internet:

This is a technical control, not a physical one. Encryption protects data but does not prevent physical breaches.

IIA GTAG 17: Auditing IT Security – Emphasizes the role of physical security in protecting IT infrastructure.

COBIT Framework – DSS05 (Manage Security Services) – Highlights physical access restrictions as a key security measure.

ISO/IEC 27001: Information Security Management System – Identifies physical security as a fundamental control for IT risk management.

Analysis of Each Option:IIA References:Conclusion:Since physical security controls prevent unauthorized physical access, option (B) is the correct answer.