IIA IIA-CIA-Part3 - Business Knowledge for Internal Auditing

Understanding Outsourcing and Its Impact:

Outsourcing refers to contracting external vendors to handle business functions that were previously managed in-house.

While it can reduce costs and improve efficiency, it increases reliance on external suppliers for critical services.

Why Increased Dependence on Suppliers is the Most Likely Result:

Loss of Internal Control: Companies lose direct oversight over quality, delivery times, and operational processes, depending on the supplier’s performance.

Risk of Supplier Disruptions: If the supplier faces financial difficulties, operational failures, or compliance issues, the outsourcing company is directly affected.

Vendor Lock-in: Over time, switching suppliers becomes difficult due to integration costs and proprietary dependencies.

Why Other Options Are Incorrect:

B. Increased importance of market strategy – Incorrect.

While outsourcing can free up resources to focus on core business strategy, it does not necessarily increase the importance of market strategy.

C. Decreased sensitivity to government regulation – Incorrect.

Outsourcing often increases regulatory risks, as companies must ensure third-party compliance with data protection, labor laws, and industry regulations.

D. Decreased focus on costs – Incorrect.

Outsourcing is typically done to reduce costs, not decrease cost focus. Organizations still monitor costs closely to ensure vendor contracts remain cost-effective.

IIA’s Perspective on Outsourcing and Risk Management:

IIA Standard 2120 – Risk Management requires internal auditors to evaluate risks associated with outsourcing.

IIA GTAG (Global Technology Audit Guide) on Third-Party Risk Management highlights risks related to supplier dependence, service quality, and compliance.

COSO ERM Framework recommends ongoing supplier performance monitoring to mitigate risks of over-dependence.

IIA References:

IIA Standard 2120 – Risk Management & Vendor Oversight

IIA GTAG – Third-Party Risk Management

COSO ERM – Managing Outsourcing Risks

Thus, the correct and verified answer is A. Increased dependence on suppliers.

System software controls refer to security measures and protocols that protect an organization's IT infrastructure from unauthorized access, cyber threats, and system failures. Intrusion testing (penetration testing) is a key system software control used to detect vulnerabilities in IT environments.

Correct Answer (D - Performing Intrusion Testing on a Regular Basis)

Intrusion testing is a critical system software security measure that helps identify weaknesses in software configurations and security defenses.

This falls under system software controls because it directly tests the security of operating systems, applications, and network software.

The IIA’s GTAG 11: Developing IT Security Audits highlights penetration testing as a necessary control for system software security.

Why Other Options Are Incorrect:

Option A (Restricting server room access to specific individuals):

This is a physical access control, not a system software control.

Option B (Housing servers away from environmental hazards):

This is an environmental control, focusing on disaster prevention rather than software security.

Option C (Ensuring that all user requirements are documented):

This relates to project documentation and system development, but it does not control software security.

IIA GTAG 11: Developing IT Security Audits – Recommends regular penetration testing as a system software control.

IIA Practice Guide: Auditing IT Security – Discusses system software security measures.

IIA References for Validation:Thus, D is the correct answer because intrusion testing is a core system software control ensuring security.

Hacking refers to unauthorized access to an IT system, typically with the intent to disrupt, steal, or manipulate data. In this scenario, activists attacking an oil company's IT system as a protest falls under hacking because they are illegally breaking into the company’s digital infrastructure to make a statement.

Let’s analyze each option:

Option A: Tampering

Incorrect. Tampering refers to physically altering or interfering with a system (e.g., changing sensor readings in an oil rig), rather than attacking an IT system digitally.

Option B: Hacking

Correct.

The individuals are gaining unauthorized access to the company’s IT system.

This action is commonly associated with hacktivism, where hackers attack organizations for political or ideological reasons.

IIA Reference: Internal auditors assess cybersecurity threats, including hacking and unauthorized access risks. (IIA GTAG: Auditing Cybersecurity Risks)

Option C: Phishing

Incorrect. Phishing involves tricking individuals into revealing sensitive information (e.g., login credentials) through fraudulent emails or websites, but this scenario describes a direct attack on the IT system.

Option D: Piracy

Incorrect. Piracy typically refers to copyright infringement (e.g., unauthorized software use) rather than hacking an IT system.

Thus, the verified answer is B. Hacking.

A decentralized organizational structure distributes decision-making authority across different business units or geographic regions. One major advantage is the ability to tap into a larger talent pool, as decision-making is not restricted to headquarters, and leadership opportunities exist at multiple levels.

(A) Greater cost-effectiveness.

Incorrect. A decentralized structure often increases costs due to duplicate resources, additional oversight, and inefficiencies from fragmented decision-making.

(B) Increased economies of scale.

Incorrect. Centralized organizations benefit more from economies of scale because they can standardize processes and consolidate purchasing power. Decentralization reduces these benefits by spreading decision-making across multiple locations.

(C) Larger talent pool. ✅

Correct. Decentralization allows organizations to recruit, develop, and retain talent in different locations, rather than relying solely on headquarters for leadership roles.

This aligns with IIA Standard 2110 – Governance, which emphasizes the importance of leadership distribution and talent management in organizations.

(D) Strong internal controls.

Incorrect. Centralized structures typically have stronger internal controls, as decision-making and risk management are closely monitored. Decentralization increases the risk of inconsistent controls across different units.

IIA Standard 2110 – Governance

COSO Framework – Organizational Structure and Risk Management

IIA GTAG – "Auditing Business Strategy Alignment"

Analysis of Answer Choices:IIA References:Thus, the correct answer is C, as decentralization expands the talent pool by enabling local decision-making and leadership development.

Absorption costing is a costing method that allocates all manufacturing costs (both variable and fixed) to the cost of a product. In this method, fixed manufacturing overhead costs are treated as indirect product costs because they are not directly traceable to a single unit of production but are still part of the total cost of producing goods.

Let’s analyze each option:

Option A: Direct, product costs.

Incorrect. Direct costs are costs that can be traced directly to a specific product, such as direct materials and direct labor. Fixed manufacturing overhead is not a direct cost because it is spread across all units produced.

Option B: Indirect product costs.

Correct. Fixed manufacturing overhead costs (such as rent, depreciation, and utilities for the production facility) are indirect costs because they support the entire production process rather than a specific product. However, under absorption costing, they are still treated as product costs and allocated to inventory.

IIA Reference: The IIA’s guidance on cost allocation states that absorption costing assigns all manufacturing costs (including fixed overhead) to products. (IIA Practice Guide: Cost and Profitability Analysis)

Option C: Direct period costs.

Incorrect. Period costs are expensed in the period they occur, while absorption costing treats fixed manufacturing overhead as part of inventory (product cost) until sold.

Option D: Indirect period costs.

Incorrect. Fixed manufacturing overhead is not expensed immediately as a period cost under absorption costing; it is capitalized into inventory and expensed as Cost of Goods Sold (COGS) when the product is sold.

Thus, the verified answer is B. Indirect product costs.

Understanding the Call Center Performance Issue:

The key performance indicators (KPIs) show a positive trend, meaning the call center appears to be performing well.

However, customer complaints are increasing, indicating that the KPIs are not accurately reflecting service quality.

This suggests that employees may be prioritizing call quantity over call quality, likely due to pressure to meet call quotas.

Why De-Emphasizing Call Quotas is the Best Solution:

Encourages Quality Over Speed: Reducing the emphasis on call volume allows agents to spend more time resolving customer issues effectively.

Improves Customer Satisfaction: Agents can provide more thorough assistance, reducing repeat calls and complaints.

Aligns KPIs with Service Quality: Shifting focus from quantity-based KPIs to quality-based KPIs ensures performance measurements reflect actual customer experience.

Why Other Options Are Incorrect:

A. Review the call center script used by customer service agents to interact with callers, and update the script if necessary – Incorrect.

While updating scripts may help, it does not address the root issue of employees rushing through calls to meet quotas.

C. Retrain call center staff on area processes and common technical issues that they will likely be asked to resolve – Incorrect.

Training is useful, but if agents are pressured to complete calls quickly, training alone will not resolve the issue.

D. Increase the incentive for call center employees to complete calls quickly and raise the number of calls completed daily – Incorrect.

This would worsen the issue by further incentivizing speed over customer satisfaction, leading to more complaints.

IIA’s Perspective on Performance Metrics and Customer Service Quality:

IIA Standard 2120 – Risk Management requires organizations to ensure that performance metrics align with actual business objectives.

IIA GTAG (Global Technology Audit Guide) on Performance Measurement recommends balancing quantitative KPIs (e.g., call volume) with qualitative KPIs (e.g., customer satisfaction scores).

COSO Internal Control Framework supports adjusting performance incentives to ensure alignment with business objectives.

IIA References:

IIA Standard 2120 – Risk Management & KPI Alignment

IIA GTAG – Performance Metrics in Customer Service

COSO Internal Control Framework – Effective KPI Design

Thus, the correct and verified answer is B. De-emphasize the importance of call center employees completing a certain number of calls per hour.

In a vertically centralized organization, decision-making authority is concentrated at the top levels of management. As a company rapidly expands, maintaining tight control by a small management team can lead to inefficiencies, delays, and suboptimal decision-making due to limited input from operational and frontline staff.

Let’s analyze each option:

Option A: Lack of coordination among different business units

Incorrect. While coordination challenges can exist in a large, decentralized organization, a tightly controlled, centralized structure typically ensures strong coordination but at the cost of slower decision-making.

Option B: Operational decisions are inconsistent with organizational goals

Incorrect. In a centralized structure, top management closely controls decision-making, making goal misalignment less likely.

Option C: Suboptimal decision making

Correct.

Decentralized decision-making allows managers closer to operations to make informed, timely decisions.

A small centralized team may lack specialized knowledge about different departments, leading to inefficient or outdated decisions.

As the company expands, delays in decision-making and lack of responsiveness to market conditions increase risk exposure.

IIA Reference: Internal auditors assess organizational structures to identify risks associated with inefficient decision-making and control bottlenecks. (IIA Standard 2110: Governance)

Option D: Duplication of business activities

Incorrect. Duplication of activities is more common in decentralized structures, where different departments operate independently. A tightly controlled, centralized structure reduces redundancy but at the cost of decision-making efficiency.

Thus, the verified answer is C. Suboptimal decision making.

Understanding Mobile Device Risks in an Organization:

When an organization allows third parties (vendors and visitors) to use outside smart devices to access its proprietary networks and systems, it introduces significant compliance risks.

These risks include violations of regulatory requirements, industry standards, and internal security policies.

Compliance Risks in Smart Device Usage:

Unauthorized Access: External users may bypass security controls, leading to data breaches or regulatory non-compliance (e.g., GDPR, HIPAA, or PCI-DSS violations).

Lack of Encryption and Data Protection: If smart devices access sensitive information without proper security protocols, the organization may fail to comply with industry regulations.

Failure to Enforce Mobile Device Management (MDM): Without proper policy enforcement, organizations risk failing audits and facing penalties.

Why Other Options Are Incorrect:

B. Privacy:

Privacy concerns relate to handling personal data, but in this scenario, the focus is on third-party access risks, which fall under compliance.

C. Strategic:

Strategic risks relate to long-term business objectives, whereas compliance risks are more immediate and regulatory in nature.

D. Physical security:

Physical security deals with preventing unauthorized access to buildings or devices, not cybersecurity risks from external smart devices.

IIA’s Perspective on Compliance and IT Security:

IIA Standard 2110 – Governance emphasizes the need to evaluate IT security risks, including third-party access risks.

IIA GTAG (Global Technology Audit Guide) on IT Risks highlights compliance risks in Bring Your Own Device (BYOD) and third-party access policies.

ISO 27001 Information Security Standard mandates controls to manage external device access risks.

IIA References:

IIA Standard 2110 – Governance and IT Security

IIA GTAG – IT Risks and BYOD Policies

ISO 27001 Information Security Standard

NIST Cybersecurity Framework for Mobile Device Security

Thus, the correct and verified answer is A. Compliance.

Data cleaning and normalization are essential steps in the data analytics process to ensure that data is accurate, complete, and useful for analysis. The primary purpose of these steps is to identify and correct anomalies, inconsistencies, and errors, making the data usable for decision-making.

(A) The auditor eliminated duplicate information. ❌

Incorrect. Removing duplicates is one part of data cleaning, but it does not encompass the full process of making data usable.

(B) The auditor organized data to minimize useless information. ❌

Incorrect. While organizing data helps improve efficiency, it does not necessarily involve error detection and correction, which is key to data cleaning.

(C) The auditor made data usable for a specific purpose by ensuring that anomalies were identified and corrected. ✅

Correct. The primary goal of cleaning and normalizing data is to detect and fix anomalies (e.g., missing values, inconsistencies, formatting errors), ensuring that data is reliable for analysis.

IIA GTAG "Data Analytics: Elevating Internal Audit Performance" highlights that correcting data anomalies is a critical step in preparing data for effective use.

(D) The auditor ensured data fields were consistent and that data could be used for a specific purpose. ❌

Incorrect. While consistency in data fields is part of normalization, it does not fully address the broader purpose of identifying and fixing errors.

IIA GTAG – "Data Analytics: Elevating Internal Audit Performance"

IIA Standard 2320 – Analysis and Evaluation

NIST Data Quality Framework – Data Cleaning and Normalization

Analysis of Answer Choices:IIA References:Thus, the correct answer is C, as data cleaning and normalization ensure that anomalies are detected and corrected, making the data usable for a specific purpose

IT governance controls ensure that an organization's IT systems align with business objectives, manage risks, and comply with regulatory requirements. These controls cover areas such as security, financial oversight, change management, and operational efficiency.

Let’s analyze each option:

Option A: Controls that focus on segregation of duties, financial, and change management.

Correct.

Segregation of duties (SoD) prevents conflicts of interest and reduces fraud risk.

Financial controls ensure IT expenditures align with budgets and policies.

Change management controls ensure system modifications follow formal approval and testing procedures.

These areas are core components of IT governance, ensuring security, compliance, and efficiency.

IIA Reference: Internal auditors evaluate IT governance using frameworks like COBIT (Control Objectives for Information and Related Technologies) and ISO 27001. (IIA GTAG: Auditing IT Governance)

Option B: Personnel policies that define and enforce conditions for staff in sensitive IT areas.

Incorrect.

While personnel policies support IT security, they do not fully represent IT governance controls. IT governance is broader and includes risk management, compliance, and operational efficiency.

Option C: Standards that support IT policies by more specifically defining required actions.

Incorrect.

Standards are part of IT governance but are not controls themselves. IT governance requires enforcement mechanisms like segregation of duties and change management to ensure compliance.

Option D: Controls that focus on data structures and the minimum level of documentation required.

Incorrect.

While data governance is a subset of IT governance, IT governance includes wider financial, security, and operational controls.

Thus, the verified answer is A. Controls that focus on segregation of duties, financial, and change management.

Understanding the Accounting for Office Supplies:

The organization maintains an account for office supplies on hand, which represents unused office supplies at any given time.

The expense recorded during the year represents the cost of office supplies purchased.

At year-end, the adjusting entry is made to reflect the actual amount of supplies on hand and adjust the supplies expense accordingly.

Formula to Determine the Supplies Used:

Supplies Used=Beginning Balance+Purchases−Ending Balance\text{Supplies Used} = \text{Beginning Balance} + \text{Purchases} - \text{Ending Balance}Supplies Used=Beginning Balance+Purchases−Ending Balance

Plugging in the given values:

Supplies Used=9,000+45,000−11,500=42,500\text{Supplies Used} = 9,000 + 45,000 - 11,500 = 42,500Supplies Used=9,000+45,000−11,500=42,500

This amount ($42,500) represents the actual office supplies used and should be recorded as an expense.

The adjusting entry would include:

A debit to Office Supplies on Hand for $42,500

A credit to Office Supplies Expense for $42,500

Why Other Options Are Incorrect:

A. A debit to office supplies on hand for $2,500 – Incorrect, as this figure does not represent supplies used or purchased.

B. A debit to office supplies on hand for $11,500 – Incorrect, as this is the ending balance and not the adjustment amount.

C. A debit to office supplies on hand for $20,500 – Incorrect, as this does not align with the formula for calculating used supplies.

IIA’s Perspective on Financial Reporting and Adjusting Entries:

IIA Standard 1220 – Due Professional Care emphasizes accurate financial reporting and proper adjustments for year-end entries.

GAAP Accounting Principles require accrual-based adjustments to ensure that expenses are recognized in the period they are incurred.

COSO Internal Control Framework supports proper inventory and expense adjustments to avoid misstated financials.

IIA References:

IIA Standard 1220 – Due Professional Care (Financial Reporting Accuracy)

GAAP Accounting Standards – Adjusting Entries for Supplies and Inventory

COSO Internal Control – Accurate Expense Recognition

Thus, the correct and verified answer is D. A debit to office supplies on hand for $42,500.

Understanding the Cash Conversion Cycle (CCC):

The Cash Conversion Cycle (CCC) measures the time taken for a company to convert raw materials into cash flow.

CCC is calculated using the formula: CCC=DaysInventoryOutstanding(DIO)+DaysSalesOutstanding(DSO)−DaysPayableOutstanding(DPO)CCC = Days Inventory Outstanding (DIO) + Days Sales Outstanding (DSO) - Days Payable Outstanding (DPO)CCC=DaysInventoryOutstanding(DIO)+DaysSalesOutstanding(DSO)−DaysPayableOutstanding(DPO)

Where:

DIO (Days Inventory Outstanding) = 55 days (time to convert raw materials to finished products).

DSO (Days Sales Outstanding) = 42 days (time to collect receivables).

DPO (Days Payable Outstanding) = 10 days (time to pay for raw materials).

Applying the Formula:

CCC=55+42−10CCC = 55 + 42 - 10CCC=55+42−10 CCC=100 daysCCC = 100 \text{ days}CCC=100 days

Why Option C (100 Days) Is Correct?

The CCC represents the time the company’s cash is tied up in production and sales before receiving payment.

This calculation aligns with IIA Standard 2120 – Risk Management, which requires auditors to assess financial liquidity and operational efficiency.

Why Other Options Are Incorrect?

Option A (26 days): Incorrect calculation.

Option B (90 days): Does not subtract DPO correctly.

Option D (110 days): Incorrect addition of all components instead of following the CCC formula.

The correct cash conversion cycle is 100 days, calculated using standard CCC methodology.

IIA Standard 2120 and financial management principles confirm the correct calculation.

Final Justification:IIA References:

IPPF Standard 2120 – Risk Management (Financial Performance & Liquidity Risk)

COSO ERM – Working Capital & Cash Flow Management

Financial Management Best Practices – Cash Conversion Cycle Analysis

Understanding BYOD Risks and Legal Implications

Bring-your-own-device (BYOD) policies allow employees to use personal devices for work, but they introduce compliance risks.

Jailbreaking is the process of bypassing manufacturer-imposed security restrictions on a device (e.g., iPhones or Android devices).

This significantly increases the risk of privacy law violations, copyright infringements, and security breaches.

Why Option D is Correct?

Jailbreaking allows users to:

Install unauthorized software, which may violate software licensing agreements and copyright laws.

Remove security restrictions, increasing exposure to data breaches, malware, and non-compliance with privacy regulations (e.g., GDPR, HIPAA, or CCPA).

Bypass digital rights management (DRM), leading to potential copyright infringement issues.

IIA Standard 2110 – Governance mandates that internal auditors evaluate IT risks, including legal compliance related to mobile device usage.

ISO 27001 – Information Security Management also highlights the risks of unapproved software on enterprise devices.

Why Other Options Are Incorrect?

Option A (Not installing anti-malware software):

While a security risk, this primarily exposes devices to cyber threats rather than directly causing regulatory infringements.

Option B (Updating operating software in a haphazard manner):

Irregular updates pose security risks, but they do not directly violate copyright or privacy laws.

Option C (Applying a weak password):

Weak passwords increase security risks, but they do not inherently cause regulatory infringements like jailbreaking does.

Jailbreaking increases risks of copyright infringement (through unauthorized apps) and privacy violations (by removing security controls).

IIA Standard 2110 and ISO 27001 emphasize legal and regulatory compliance in IT security audits.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (IT & Legal Compliance Risks)

ISO 27001 – Information Security Compliance

GDPR, HIPAA, and CCPA – Privacy Law Considerations for BYOD

The most effective way to prevent the unauthorized disclosure of confidential information is to limit access based on employee roles and duties. This follows the principle of least privilege (PoLP), ensuring that employees only access the data necessary for their job functions.

(A) Nondisclosure agreements between the firm and its employees. ❌

Incorrect. While NDAs help deter leaks, they do not prevent unauthorized access to information. An employee who signs an NDA can still access and leak data.

(B) Logs of user activity within the information system. ❌

Incorrect. Activity logs help detect and investigate breaches but do not actively prevent unauthorized disclosure.

(C) Two-factor authentication for access into the information system. ❌

Incorrect. While two-factor authentication enhances system security, it does not prevent employees with authorized access from leaking confidential data.

(D) Limited access to information, based on employee duties. ✅

Correct. Role-based access control (RBAC) ensures that employees only access the information necessary for their job responsibilities, reducing the risk of leaks.

IIA GTAG "Identity and Access Management" highlights restricted access as the most effective control for preventing unauthorized disclosure of confidential data.

IIA GTAG – "Identity and Access Management"

IIA Standard 2120 – Risk Management (Data Protection Controls)

COBIT Framework – Information Security and Access Control

Analysis of Answer Choices:IIA References:Thus, the correct answer is D (Limited access to information, based on employee duties), as restricting access is the most effective preventive control against data disclosure.

Understanding Maslow’s Hierarchy of Needs

Maslow’s theory categorizes human needs into five levels:

Physiological Needs (Basic survival: food, water, shelter)

Safety Needs (Job security, stability, financial security)

Social Needs (Belonging, relationships, team interactions)

Esteem Needs (Recognition, achievement, respect)

Self-Actualization (Self-Fulfillment) – Reaching one’s full potential, professional growth, and personal development

Why Option B is Correct?

Offering an assignment for professional growth and advancement supports self-actualization (self-fulfillment).

This aligns with Maslow’s highest level, where individuals seek to maximize their potential and achieve personal excellence.

IIA Standard 1100 – Independence and Objectivity emphasizes the importance of professional growth in auditing and management roles.

Why Other Options Are Incorrect?

Option A (Esteem by colleagues):

Professional growth may increase esteem, but the focus here is on self-fulfillment, not external recognition.

Option C (Sense of belonging in the organization):

Belonging is a lower-level need (social level), while professional growth aligns with self-actualization.

Option D (Job security):

Job security falls under safety needs, which is a lower-tier concern.

Professional development aligns with self-actualization, the highest level in Maslow’s hierarchy, which focuses on maximizing potential.

IIA Standard 1100 supports professional growth as part of career advancement in internal auditing.

Final Justification:IIA References:

Maslow’s Hierarchy of Needs (Self-Actualization Level)

IPPF Standard 1100 – Independence and Objectivity