IIA IIA-CIA-Part3 - Internal Audit Function

To maximize profit with a limited material supply of 500 kg per month, the company should prioritize producing the product that generates the highest contribution margin per kg of material used.

Step 1: Calculate Contribution Margin Per Unit for Each ProductSince fixed costs are not relevant in this decision, we focus on the contribution margin per unit of raw material:

Selling price per unit = $10

Material cost per unit = 2 kg × $1/kg = $2

Contribution margin per unit = $10 - $2 = $8

Contribution margin per kg = $8 ÷ 2 kg = $4 per kg

Selling price per unit = $13

Material cost per unit = 6 kg × $1/kg = $6

Contribution margin per unit = $13 - $6 = $7

Contribution margin per kg = $7 ÷ 6 kg = $1.17 per kg

Product X ($4 per kg) is more profitable per kg than Product Y ($1.17 per kg).

To maximize profit, produce as many units of Product X as possible first, then allocate the remaining material to Product Y.

First, maximize production of Product X

Each unit of Product X requires 2 kg.

Maximum units of Product X = 500 kg ÷ 2 kg per unit = 250 units.

However, demand is only 70 units, so produce 70 units of Product X.

Material used for 70 units of X = 70 × 2 kg = 140 kg.

Material remaining = 500 kg - 140 kg = 360 kg.

Use remaining material for Product Y

Each unit of Product Y requires 6 kg.

Maximum units of Product Y = 360 kg ÷ 6 kg per unit = 60 units.

Produce 70 units of Product X (to meet demand).

Produce 60 units of Product Y (using the remaining material).

IIA GTAG 13: Business Performance Management – Discusses maximizing profit by prioritizing high contribution margin products.

IIA Practice Guide: Cost Analysis for Decision-Making – Covers constraints and resource allocation for maximizing profitability.

Product XProduct YStep 2: Prioritize Product with Higher Contribution Margin Per KgStep 3: Allocate Limited Material (500 kg)Final Decision:IIA References for Validation:Thus, B (60 units) is the correct answer because it optimally allocates the 500 kg of material to maximize profit.

Comprehensive and Detailed In-Depth Explanation:

Data privacy laws, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), emphasize restricting access to personally identifiable information (PII) to only those who require it for business purposes.

Option B (Data backup within 24 hours) is an IT best practice but is not a core requirement of privacy laws.

Option C (Approval for system updates) is a change management policy, unrelated to data privacy.

Option D (Insider trading restrictions) falls under corporate governance and securities regulations, not data privacy laws.

Thus, Option A is correct, as it aligns with legal requirements for protecting sensitive personal data.

Comprehensive and Detailed In-Depth Explanation:

The discounted payback period is a capital budgeting technique that determines how long it takes for a project to recover its initial investment, accounting for the time value of money.

Option A (Calculates the overall project value) describes Net Present Value (NPV), not the payback period.

Option B (Ignores the time value of money) applies to the simple payback period, but the discounted payback period does account for the time value of money.

Option D (Begins at time zero) is true for all capital budgeting methods, not specific to this one.

Thus, option C is correct because the discounted payback period measures the break-even time while considering the present value of cash flows.

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and maintained by end-users (not IT) that are critical to financial reporting, decision-making, or regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the complexity, significance, and control environment of such applications.

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources, reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-developed applications.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial misstatements.

User-Developed Applications (UDAs) are software tools, typically spreadsheets or small databases, created by business users rather than IT professionals. These applications often lack formal security, documentation, and control measures, increasing the risk of data errors, unauthorized access, and compliance failures.

UDAs are often created quickly to meet immediate business needs, without following IT governance, security controls, or development standards.

Unlike traditional IT applications, UDAs lack structured testing, change management, and formal documentation.

The IIA’s GTAG 14 – Auditing User-Developed Applications states that UDAs present higher risks because they are not subject to the same controls as IT-managed applications.

A. UDAs and traditional IT applications typically follow a similar development life cycle → Incorrect. Traditional IT applications follow a formal Software Development Life Cycle (SDLC), whereas UDAs are developed informally by end-users.

B. A UDA usually includes system documentation to illustrate its functions, and IT-developed applications typically do not require such documentation. → Incorrect. IT applications require extensive documentation, whereas UDAs often lack documentation entirely.

D. IT testing personnel usually review both types of applications thoroughly to ensure they were developed properly. → Incorrect. IT applications undergo rigorous testing and quality assurance, while UDAs often bypass IT reviews altogether.

IIA GTAG 14 – Auditing User-Developed Applications highlights the risks of UDAs and emphasizes the need for internal controls.

COBIT Framework (Control Objectives for Information and Related Technologies) recommends IT governance measures for all business-critical applications.

ISO 27001 (Information Security Management System) warns against uncontrolled user-developed applications due to security risks.

Why Option C is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is C. Unlike traditional IT applications, UDAs typically are developed with little consideration of controls.

A hot recovery plan (hot site) is a fully operational, duplicate site that is pre-configured and ready for immediate use in case of a disaster. This approach allows an organization to recover critical operations quickly with minimal downtime.

(A) Cold recovery plan.

Incorrect: A cold site is a facility that has infrastructure but no active IT systems or data until set up after a disaster, resulting in longer recovery times.

(B) Outsourced recovery plan.

Incorrect: Outsourcing recovery refers to third-party disaster recovery services, but does not specifically describe a fully operational duplicate site.

(C) Storage area network recovery plan.

Incorrect: A storage area network (SAN) recovery plan focuses on data storage redundancy, not a fully operational duplicate facility.

(D) Hot recovery plan. (Correct Answer)

A hot site is the fastest and most effective disaster recovery solution, ensuring immediate failover with minimal downtime.

IIA GTAG 10 – Business Continuity Management highlights hot sites as the most effective for mission-critical operations.

IIA GTAG 10 – Business Continuity Management: Recommends hot sites for critical recovery scenarios.

IIA Standard 2120 – Risk Management: Emphasizes preparedness for disaster recovery planning.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) Hot recovery plan, as it ensures a fully operational backup site for immediate disaster recovery.

Data cleaning (also called data cleansing or scrubbing) is a critical step in data analytics to ensure accuracy, consistency, and reliability. Removing duplicate records is a key data cleaning technique that improves data quality.

Improves Data Integrity – Prevents misleading results caused by duplicate values.

Enhances Data Accuracy – Ensures that analytics are based on unique and valid information.

Optimizes Performance – Reduces redundancy, improving processing speed and efficiency.

Prevents Reporting Errors – Ensures accurate insights for decision-making.

A. Deploys data visualization tool – Visualization tools help interpret data but do not clean it.

B. Adopt standardized data analysis software – Software tools support analysis but do not eliminate duplicate records automatically.

C. Define analytics objectives and establish outcomes – This step is important for analysis strategy, but it does not clean data.

IIA’s GTAG on Data Analytics – Emphasizes the importance of data cleansing in ensuring reliable analytics.

COBIT 2019 (Data Management Framework) – Highlights duplicate removal as a best practice in data governance.

ISO 8000-110 (Data Quality Standard) – Recommends eliminating duplicate records for high-quality analytics.

Why Eliminating Duplicate Records is the Correct Answer?Why Not the Other Options?IIA References:✅ Final Answer: D. Eliminate duplicate records.

Understanding Spear Phishing Attacks:

Spear phishing is a targeted cyberattack where attackers send personalized emails to trick individuals into providing sensitive data (e.g., passwords, financial information).

Unlike regular phishing, which casts a wide net, spear phishing is highly customized and often appears to come from a trusted source.

Why Option C Is Correct?

The scenario describes a highly personalized email (related to a golf membership) that tricks the recipient into clicking a malicious hyperlink and entering sensitive data.

This matches the definition of a spear phishing attack, where an attacker tailors a scam specifically for an individual.

IIA GTAG 16 – Data Analytics and ISO 27001 emphasize the need for security awareness training to mitigate such threats.

Why Other Options Are Incorrect?

Option A (Website attack causing a server crash):

This describes a Denial-of-Service (DoS) attack, not spear phishing.

Option B (Generic recorded message requesting password data):

This is vishing (voice phishing), not spear phishing. Spear phishing relies on personalized emails.

Option D (Fake social media investment opportunity):

This describes mass phishing, which targets multiple users, unlike spear phishing, which is highly targeted.

Spear phishing is a targeted attack that uses personal details to deceive individuals, making option C the best choice.

IIA GTAG 16 and ISO 27001 emphasize cybersecurity awareness to prevent such attacks.

Final Justification:IIA References:

IIA GTAG 16 – Data Analytics in Cybersecurity Audits

ISO 27001 – Cybersecurity Best Practices

NIST SP 800-61 – Incident Response Guidelines for Phishing Attacks

When determining the level of physical controls required for a workstation, the most critical factor is its value to the business. Physical controls are security measures implemented to protect assets from unauthorized access, damage, or theft.

Asset Value → Determines the level of protection required.

Risk Assessment → Identifies threats like theft, sabotage, or natural disasters.

Compliance Requirements → Ensures alignment with security regulations and best practices.

(A) Ease of use.

Incorrect: While user-friendliness is important, security measures are primarily based on asset value and risk, not convenience.

IIA Standard 2110 (Governance) emphasizes security over ease of use.

(B) Value to the business. (Correct Answer)

The higher the workstation's importance to business operations, the stronger the physical controls required.

Workstations handling sensitive data or critical systems require additional security.

COSO ERM – Risk Assessment requires evaluating asset value when designing security controls.

(C) Intrusion prevention.

Partially correct but secondary: Intrusion prevention is one of many security concerns, but the primary driver for determining physical controls is the asset’s business value.

(D) Ergonomic model.

Incorrect: Ergonomics is about user comfort and efficiency, not security.

IIA Standard 2120 – Risk Management: Requires risk-based decision-making, including evaluating asset value.

GTAG 9 – Identity and Access Management: Stresses that security measures must align with asset value and business risk.

COSO ERM – Risk Assessment: Establishes asset value as a key determinant in risk-based security controls.

Factors Considered in Physical Security Decisions:Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because the level of physical controls should be determined based on how critical the workstation is to business operations.

In the context of big data governance, the responsibilities of various stakeholders are delineated as follows:

A. Management's Responsibilities:

Management holds the primary responsibility for establishing and maintaining effective data governance frameworks. This includes ensuring that information storage systems are appropriately defined and that processes for updating critical data elements are clear and well-documented. Such measures are essential to maintain data integrity, availability, and confidentiality. The Institute of Internal Auditors (IIA) emphasizes that management is accountable for the design and implementation of data governance structures, policies, and procedures. These structures should encompass data storage solutions and the mechanisms for updating and managing critical data elements.

The Institute of Internal Auditors

B. External Auditors' Responsibilities:

External auditors are tasked with providing independent assurance on the effectiveness of an organization's financial reporting and related controls. While they may consider the implications of big data on financial reporting, their primary focus is not on the periodic monitoring and maintenance of analytical models. Instead, this responsibility typically falls under management or specialized internal functions. The IIA outlines that external auditors assess the overall control environment but do not directly manage or maintain analytical models.

C. The Board's Responsibilities:

The board of directors provides oversight and strategic direction for the organization's data governance initiatives. However, the implementation of specific controls around data quality dimensions is generally delegated to management. The board ensures that appropriate governance structures are in place and that management is effectively addressing data quality and governance issues. According to the IIA, the board's role is to oversee the data governance framework, ensuring that management has implemented effective controls and processes.

The Institute of Internal Auditors

D. Internal Auditors' Responsibilities:

Internal auditors provide independent assurance on the effectiveness of governance, risk management, and control processes, including those related to data quality and security. While they assess and report on the adequacy of controls over data, the responsibility for ensuring data quality and security rests with management. The IIA states that internal auditors evaluate the effectiveness of data governance practices but do not hold primary responsibility for data quality and security.

The Institute of Internal Auditors

In summary, option A accurately reflects management's responsibility in big data governance, aligning with the IIA's guidelines on data governance roles and responsibilities.

When disagreements occur regarding risk management or audit findings, the CAE should first escalate the matter within management levels to attempt resolution. Only if the disagreement remains unresolved after discussion with senior management should the CAE report the matter to the board or audit committee.

Options B and C are premature: the charter does not grant internal audit supremacy over management’s decisions, and documenting disagreement in the audit report should occur only after reasonable attempts at resolution. Option A (escalating immediately to the board) should occur only if discussion with management does not resolve the issue.

Understanding IT Backup Risks in Disaster Recovery:

Disaster recovery plans rely on backup data to restore operations after a system failure.

An ineffective backup system increases the risk of data loss, operational downtime, and regulatory non-compliance.

Why Option B (Empty Backup Tapes) Is Correct?

If backup tapes contain empty spaces, it indicates data corruption or incomplete backups, leading to unrecoverable data loss in a disaster.

IIA GTAG 16 – Data Management and IT Auditing emphasizes that backups must be tested for integrity and completeness.

ISO 27001 and NIST SP 800-34 recommend periodic verification of backup data to prevent critical failures.

Why Other Options Are Incorrect?

Option A (Delayed return of backup tapes):

While delayed tape retrieval affects recovery speed, it does not indicate data loss.

Option C (More frequent backups than required):

Frequent backups improve data protection, not cause unacceptable loss.

Option D (Less frequent offsite backups):

While infrequent backups increase risk, they do not directly indicate data loss upon testing.

Backup tapes containing empty spaces indicate potential data loss, making it the most critical disaster recovery risk.

IIA GTAG 16, ISO 27001, and NIST SP 800-34 highlight the need for validated backup integrity.

Final Justification:IIA References:

IIA GTAG 16 – Data Management and IT Auditing

ISO 27001 – Information Security Backup Standards

NIST SP 800-34 – Contingency Planning for IT Systems

A disaster recovery plan (DRP) outlines how an organization will restore IT operations after a disruption. The type of recovery site determines how quickly systems can be brought back online.

Why a Warm Site Recovery Plan is Correct?A warm site is a partially configured backup location with some hardware and software ready, but it requires additional configuration before it can fully support production operations.

Faster than a Cold Site – Unlike a cold site, a warm site has pre-installed infrastructure, reducing downtime.

Requires Some Setup – Unlike a hot site, which is fully operational, a warm site needs configuration and software setup before use.

Balances Cost and Readiness – Less expensive than a hot site while offering faster recovery than a cold site.

B. Hot site recovery plan – A hot site is fully operational and can immediately take over in case of failure.

C. Cool site recovery plan – This is not a standard industry term in disaster recovery.

D. Cold site recovery plan – A cold site has only basic infrastructure (e.g., power and space) and lacks pre-installed hardware/software, requiring much more setup time.

IIA’s GTAG on Business Continuity Management – Defines recovery site options based on operational risk.

ISO 22301 (Business Continuity Management System) – Specifies warm sites as an intermediate recovery solution.

NIST SP 800-34 (Contingency Planning Guide for IT Systems) – Describes warm sites as partially pre-configured recovery environments.

Why Not the Other Options?IIA References:

A decentralized organizational structure allows decision-making authority to be distributed across various levels and locations, making it more flexible and adaptable to rapid changes and uncertainties.

Why Decentralization Helps in Uncertainty?

Decentralization empowers different units or teams to make faster decisions.

It enables quick adaptation to market shifts, technological advancements, and external disruptions.

According to IIA’s Organizational Governance Guidelines, decentralized structures increase agility and responsiveness, particularly in dynamic industries like technology and finance.

Characteristics of Decentralized Structures:

Autonomy at multiple levels – decisions are not centralized at the top.

Faster decision-making – local teams react quickly to changes.

Greater innovation and flexibility – promotes problem-solving without bureaucratic delays.

Why Not Other Options?

B. Centralized:

A centralized structure concentrates decision-making at the top, slowing down responsiveness to changes.

C. Departmentalized:

While departmentalization organizes work efficiently, it may restrict cross-functional collaboration, making adaptation slower.

D. Tall Structure:

Tall structures have multiple management layers, leading to bureaucracy and slower decision-making.

IIA Practice Guide: Organizational Governance

IIA Standard 2110 – Governance and Risk Management

COBIT 2019 – Enterprise Risk and Governance Framework

Step-by-Step Justification:IIA References:Thus, the correct and verified answer is A. Decentralized.