IIA-CIA-Part3 Exam Dumps - Internal Audit Function

Among the options, monitored closed circuit television is most likely to support corrective action because security personnel can observe an incident and respond to it. Although CCTV is often classified as a detective control, when actively monitored it can trigger real-time intervention, dispatch of guards, incident response, or corrective follow-up. Doors that lock automatically, biometric locks, and identification badges are primarily preventive controls because they restrict access before unauthorized entry occurs. Internal auditors should distinguish between preventive, detective, and corrective control characteristics, recognizing that some controls may support more than one function depending on how they are used. Since monitored CCTV can support response to physical security incidents, Option A is the best answer.

Depreciation is the systematic allocation of an asset’s cost over its useful life. It reflects how much of the asset’s value is used up in each accounting period.

Spreads Cost Over Time – Instead of expensing the total cost immediately, depreciation distributes it across multiple periods.

Matches Expenses with Revenue – Ensures that the cost of long-term assets is allocated in the periods they generate revenue.

Required for Financial Reporting – Compliance with GAAP and IFRS requires proper allocation of asset costs.

B. It is a process of asset valuation – Incorrect because depreciation does not determine market value; it only spreads cost over time.

C. It is a process of accumulating adequate funds to replace assets – Incorrect because depreciation is an accounting concept, not a savings mechanism.

D. It is a process of measuring decline in the value of assets because of obsolescence – Incorrect because depreciation allocates cost, not necessarily measuring value decline (which is impairment).

IIA’s GTAG on Financial Controls and Reporting – Defines depreciation as a cost allocation method.

International Financial Reporting Standards (IFRS 16) & US GAAP (ASC 360) – State that depreciation is used to allocate asset costs over time.

COSO’s Internal Control Framework – Covers accounting treatments for fixed assets.

Why Depreciation is an Allocation Process?Why Not the Other Options?IIA References:✅ Final Answer: A. It is a process of allocating cost of assets between periods.

The internal audit strategy must be aligned with the organization’s business objectives. This ensures that the internal audit function provides assurance and advisory services that support the achievement of strategic goals. While risk assessment (Option B), controls (Option C), and compliance (Option A) are important inputs, they are secondary to aligning with organizational objectives, which is the foundation of strategy.

The control environment is most negatively affected when unrealistic performance targets pressure employees or management into questionable financial reporting. The control environment includes ethical values, integrity, tone at the top, management philosophy, accountability, and human resource practices. If management creates excessive pressure to meet targets, employees may rationalize manipulation or override controls. Monitoring, control activities, and risk assessment may also be affected, but the root problem is cultural and behavioral. Control activities cannot compensate fully for a weak tone at the top. Internal auditors should treat unrealistic targets, aggressive earnings pressure, and tolerance of questionable reporting as red flags for fraud risk and governance weakness. Therefore, the internal control component most negatively affected is the control environment, making Option D correct.

When performing follow-up work, the first step for an auditor—especially one not previously involved in the engagement—is to review the prior audit report, findings, and management’s agreed response/action plan. This provides context on what needs to be validated before collecting new evidence.

Interviewing management (Option A), requesting documentation (Option B), or performing walkthroughs (Option D) are important steps, but they come only after the auditor has reviewed the original findings and corrective commitments.

Ensuring the confidentiality of transmitted information is crucial to protect data from unauthorized access during transmission. Here ' s an analysis of the provided options:

A. Firewall:

A firewall monitors and controls incoming and outgoing network traffic based on predetermined security rules. While it helps prevent unauthorized access to or from a private network, it doesn ' t encrypt the data being transmitted. Therefore, it doesn ' t ensure the confidentiality of the data during transmission.

B. Antivirus Software:

Antivirus software is designed to detect, prevent, and remove malicious software. It protects the system from malware but doesn ' t play a role in securing the confidentiality of data during transmission.

C. Passwords:

Passwords are used to authenticate users and control access to systems and data. While they help ensure that only authorized users can access certain information, they don ' t protect data during transmission from interception or eavesdropping.

D. Encryption:

Encryption involves converting plaintext data into a coded form (ciphertext) that is unreadable to unauthorized parties. Only those possessing the correct decryption key can convert the data back into its original form. By encrypting data before transmission, even if the data is intercepted, it remains unintelligible without the decryption key, thereby ensuring confidentiality. Encryption is widely recognized as one of the most effective methods for protecting data confidentiality during transmission.

Wikipedia

In conclusion, among the options provided, encryption is the most effective control for ensuring the confidentiality of transmitted information, making option D the correct answer.

The CAE may engage external experts to provide specialized knowledge when the internal audit function lacks expertise. However, the CAE and internal audit activity must remain responsible for the engagement and for forming the final opinion.

Options A and B are inappropriate because they outsource the responsibility and independence of internal audit to the consultant. Option D improperly delegates forming the opinion to an external party. The correct approach is collaborating with the consultant while retaining responsibility (Option C).

To effectively mitigate and manage risks during a crisis, organizations must implement a combination of preventive and reactive measures:

Preventive measures: These are proactive steps taken before a crisis to reduce the likelihood of occurrence (e.g., risk assessments, internal controls, security protocols).

Reactive measures: These are actions taken after a crisis occurs to minimize damage, restore operations, and recover from the event (e.g., business continuity plans, incident response strategies).

(A) Incorrect – Only preventive measures.

While prevention is essential, not all crises can be avoided. Organizations also need response mechanisms.

(B) Incorrect – Alternative and reactive measures.

Alternative measures (e.g., backup systems) are part of risk management, but without prevention, risks may escalate.

(C) Incorrect – Preventive and alternative measures.

Alternative measures (e.g., backup resources) help maintain operations but do not directly address crisis response.

(D) Correct – Preventive and reactive measures.

Best practice in risk management includes both preventing crises and responding effectively when they occur.

IIA’s Global Internal Audit Standards – Crisis Management and Business Resilience

Emphasizes the need for both prevention and response strategies.

COSO’s ERM Framework – Risk Management in Crisis Situations

Recommends a combination of risk avoidance, mitigation, and crisis response.

ISO 22301 – Business Continuity Management

Highlights the importance of preventive controls and reactive response planning.

Analysis of Answer Choices:IIA References and Internal Auditing Standards: