IIA IIA-CIA-Part3 - Internal Audit Function

A disaster recovery plan (DRP) ensures that critical systems and data can be restored after an incident. If backup plans exist but no recovery and restore processes are defined, then the organization lacks a functional recovery plan altogether.

(A) Hot recovery plan.

Incorrect. A hot recovery plan includes real-time data replication and immediate failover systems, allowing for almost instant recovery in case of an outage. Since the scenario mentions that no restore process is defined, this cannot be a hot recovery plan.

(B) Warm recovery plan.

Incorrect. A warm recovery plan involves regular backups and a standby system that can be activated within hours or days. However, without defined restore procedures, the organization does not even have a warm recovery plan.

(C) Cold recovery plan.

Incorrect. A cold recovery plan means that backups exist but recovery takes significant time because systems and infrastructure need to be rebuilt. However, a cold plan still includes a recovery process, which the scenario lacks.

(D) Absence of recovery plan. ✅

Correct. If data backup plans exist but no restore processes are defined, then there is no functional recovery plan. Without a structured approach to data recovery, backups alone are useless in an actual disaster scenario.

IIA GTAG "Business Continuity and Disaster Recovery" highlights the need for detailed recovery processes as part of an overall disaster recovery plan.

IIA GTAG – "Business Continuity and Disaster Recovery"

IIA Standard 2120 – Risk Management

COBIT Framework – IT Disaster Recovery Controls

Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as data backups without recovery procedures indicate the absence of a recovery plan.

The scenario describes a security breach where an employee’s smart card access was not updated after relocation. The best way to prevent such incidents is to regularly review access logs to detect and revoke outdated permissions.

Timely Detection of Unauthorized Access:

Regular log reviews allow security teams to identify anomalies, such as an employee accessing a location where they no longer work.

Access Control Auditing:

Periodic reviews help update access rights, ensuring that only authorized personnel have access to specific areas.

Compliance with Security Standards:

IIA Standard 2110 - Governance emphasizes ensuring security measures are effective.

ISO 27001 - Access Control Policies recommends regular access reviews to prevent unauthorized access.

B. Two-level authentication:

While multi-factor authentication enhances security, it would not remove outdated access rights from the system.

C. Photos on smart cards:

A photo helps in identity verification, but it does not prevent unauthorized access if the card remains active.

D. Restriction of access hours:

Limiting access times would not stop an unauthorized user from entering during valid hours.

IIA Standard 2110 - Governance: Internal auditors must assess IT and physical security controls.

IIA Standard 2120 - Risk Management: Ensures risks associated with unauthorized access are managed.

COBIT Framework - Identity and Access Management: Recommends reviewing user access logs for anomalies.

Key Reasons Why Option A is Correct:Why Other Options Are Incorrect:IIA References:Thus, the correct answer is A. Regular review of logs.

The first step in a project management plan is to break the project into manageable components, known as Work Breakdown Structure (WBS). This step ensures clarity, task allocation, and effective tracking.

(A) Estimate time required to complete the whole project.

Incorrect: Time estimation comes after breaking the project into smaller tasks.

(B) Determine the responses to expected project risks.

Incorrect: Risk management is important but is planned after defining project tasks and scope.

(C) Break the project into manageable components. (Correct Answer)

Dividing the project into smaller tasks (WBS) helps in resource allocation, scheduling, and risk assessment.

IIA GTAG 12 – Project Risk Management suggests using WBS to define tasks clearly.

(D) Identify resources needed to complete the project.

Incorrect: Resources can only be allocated effectively after defining project components.

IIA GTAG 12 – Project Risk Management: Recommends Work Breakdown Structure (WBS) as the first step in project planning.

PMBOK (Project Management Body of Knowledge): Defines WBS as the foundation of project planning.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (C) Break the project into manageable components, as this is the first step in structuring and planning a successful project.

According to the IIA Standards, follow-up is mandatory only for assurance engagements, where corrective action plans are agreed and tracked. Advisory services are intended to add value and offer recommendations but do not require formal follow-up by internal audit. Responsibility for implementing recommendations lies with management.

Options A and B improperly delegate follow-up responsibilities, and Option D incorrectly suggests mandatory follow-up for advisory engagements.

Comprehensive and Detailed In-Depth Explanation:

Partnership contributions should be recorded at their fair market value (FMV) at the time of contribution, ensuring equitable financial representation.

Option A (Original cost of the equipment) – Not appropriate since the asset’s current fair value is relevant, not its historical cost.

Option B (Weighted average approach) – Not applicable; capital accounts should reflect actual contributed value.

Option C (No action necessary) – Incorrect because partners contributed assets of different values, making an equal capital credit unfair.

Since partnership accounting requires fair market value for capital accounts, Option D is correct.

Under International Financial Reporting Standards (IFRS 10 – Consolidated Financial Statements), an entity is required to consolidate its financial statements based on the control principle rather than ownership percentage alone.

Why Option B (Control ownership) is Correct:

According to IFRS 10, consolidation is required when an entity has control over another entity.

Control is defined as having power over the investee, exposure to variable returns, and the ability to influence those returns.

Even if an entity owns less than 50% of voting rights, it may still have control through contractual arrangements, rights over key decisions, or majority board influence.

Why Other Options Are Incorrect:

Option A (Variable entity approach):

This is a concept used in U.S. GAAP (ASC 810 – Variable Interest Entities) rather than IFRS. IFRS focuses on the broader control model.

Option C (Risk and reward):

IFRS previously considered risk and reward under IAS 27/SIC-12, but IFRS 10 replaced this with the control model.

Option D (Voting interest):

Voting rights alone do not determine consolidation under IFRS. Control can exist even without majority voting rights through contractual arrangements or potential voting rights.

IFRS 10 – Consolidated Financial Statements: Defines the principle of control for consolidation.

IIA GTAG – "Auditing Financial Reporting Risks": Discusses the impact of IFRS consolidation principles.

COSO ERM Framework: Emphasizes risk assessment in financial reporting, including consolidation decisions.

IIA References:Thus, the correct answer is B. Control ownership.

Descriptive Analytics – Answers "What happened?" by summarizing past data.

Diagnostic Analytics – Answers "Why did it happen?" by identifying causes of trends or issues.

Prescriptive Analytics – Answers "What should we do?" by providing data-driven recommendations and optimal solutions for decision-making.

Prolific Analytics – This is not a recognized category in standard analytics models.

The model makes specific recommendations for store operations (extended hours, staffing adjustments).

It optimizes resource allocation based on demand patterns.

It goes beyond identifying past trends (descriptive) or diagnosing causes (diagnostic) and provides actionable solutions.

A. Descriptive – Would only summarize sales data but not suggest changes.

B. Diagnostic – Would explain why luxury stores see higher traffic on weekends but would not recommend actions.

D. Prolific – Not a standard analytics category.

IIA’s GTAG on Data Analytics – Describes prescriptive analytics as the highest level of business intelligence, driving decision-making.

COSO’s Enterprise Risk Management (ERM) Framework – Encourages data-driven decision-making using prescriptive models.

COBIT 2019 on IT Governance – Recommends leveraging prescriptive analytics for operational efficiency.

Types of Analytical Models in Business Intelligence:Why Prescriptive Analytics is the Best Choice?Why Not the Other Options?IIA References:✅ Final Answer: C. Prescriptive.

The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least-privilege access to restrict users based on their job responsibilities.

(A) Incorrect – The authentication process relies on a simple password only, which is a weak method of authorization.

While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.

(B) Correct – The system authorization of the user does not correctly reflect the access rights intended.

The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.

Proper role-based access controls (RBAC) should limit user permissions based on job functions.

(C) Incorrect – There was no periodic review to validate access rights.

While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.

(D) Incorrect – The application owner apparently did not approve the access request during the provisioning process.

Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.

IIA’s GTAG (Global Technology Audit Guide) – Access Control and Authorization

Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.

COBIT Framework – IT Security Governance

Discusses proper authorization mechanisms to align system access with business needs.

NIST Cybersecurity Framework – Access Management Controls

Recommends restricting access rights based on the principle of least privilege (PoLP).

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The FIFO (First-In, First-Out) method values inventory based on the assumption that older, lower-cost inventory is sold first, leaving newer, higher-cost inventory in stock. During periods of rising prices, FIFO results in lower cost of goods sold (COGS) and higher net income, making it susceptible to manipulation by management.

(A) Correct – First-in, first-out method (FIFO).

FIFO lowers COGS when older, cheaper inventory is sold first, inflating net income.

Management can manipulate earnings by selectively selling older, lower-cost inventory.

(B) Incorrect – Last-in, first-out method (LIFO).

LIFO assumes newer, higher-cost inventory is sold first, resulting in higher COGS and lower net income.

LIFO is typically used to reduce taxable income, not to inflate net income.

(C) Incorrect – Specific identification method.

This method tracks the exact cost of each unit, eliminating the ability to manipulate costs easily.

(D) Incorrect – Average-cost method.

The average-cost method smooths out fluctuations in inventory costs, preventing significant income manipulation.

IIA’s Global Internal Audit Standards – Financial Reporting and Inventory Valuation Risks

Discusses inventory accounting methods and their impact on financial statements.

IFRS and GAAP Accounting Standards – Inventory Valuation

Defines how FIFO can be used to influence financial performance.

COSO’s ERM Framework – Financial Manipulation Risks

Identifies inventory valuation as an area where earnings management can occur.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

An intangible asset is an asset that lacks physical substance but has value due to its legal rights or expected economic benefits. Some intangible assets have finite useful lives (e.g., copyrights, patents) and are amortized, while others have indefinite useful lives and are not amortized but tested for impairment.

(A) Underground oil deposits. ❌

Incorrect. Oil deposits are natural resources, not intangible assets. They are classified as depletable assets because their value declines as they are extracted.

(B) Copyright. ❌

Incorrect. A copyright grants exclusive rights to reproduce and distribute creative works, but it has a finite legal life (typically 50-100 years, depending on jurisdiction). It is amortized over time.

(C) Trademark. ✅

Correct. A trademark (e.g., a company’s logo or brand name) is considered an indefinite-life intangible asset because it can be renewed indefinitely as long as the business continues to use it and follows renewal requirements.

According to IIA GTAG – "Auditing Intangible Assets", trademarks are subject to impairment testing, but they are not amortized unless their useful life becomes definite.

(D) Land. ❌

Incorrect. Land is a tangible asset, not an intangible one. While it has an indefinite life, it does not fit the category of intangible assets.

IIA GTAG – "Auditing Intangible Assets"

IIA Standard 2130 – Control Activities (Asset Management)

IFRS and GAAP Guidelines – Indefinite and Finite-Lived Intangible Assets

Analysis of Answer Choices:IIA References:Thus, the correct answer is C (Trademark), as trademarks have indefinite lives unless there is evidence to the contrary.

The immediate corrective action should be to restrict technicians’ access to live production data to prevent accidental deletions from recurring. This addresses the condition directly and mitigates immediate risk exposure.

Option A (root cause project) is important but takes time and should follow immediate corrective action. Option C (reconciliation) helps detect issues but does not prevent them. Option D (dismissal) is inappropriate since the issue was accidental, not fraudulent.

Fixed manufacturing costs refer to costs that do not vary with the level of production activity within a relevant range. These costs include expenses such as depreciation, rent, property taxes, and salaries of permanent employees in the production facility. Their primary purpose is to ensure the availability and operational readiness of production facilities, regardless of fluctuations in production levels.

(A) Correct – To ensure availability of production facilitiesFixed manufacturing costs are incurred to maintain and operate production facilities, ensuring that they remain functional and available for production when needed. These costs exist even if no units are produced, emphasizing their role in sustaining the production infrastructure.

(B) Incorrect – To decrease direct expenses related to productionFixed manufacturing costs are unrelated to direct expenses, such as raw materials and labor, which vary with production volume. Instead, they remain constant regardless of output levels.

(C) Incorrect – To incur stable costs despite operating capacityWhile fixed costs remain stable within a relevant range, their primary purpose is not just cost stability but ensuring production facilities' availability and functionality.

(D) Incorrect – To increase the total unit cost under absorption costingUnder absorption costing, fixed manufacturing costs are allocated to units produced, affecting per-unit cost calculations. However, this is an accounting treatment rather than the core purpose of fixed manufacturing costs.

IIA’s Global Internal Audit Standards – Managing Resources Effectively

Fixed manufacturing costs ensure operational resources are available and managed efficiently.

IIA’s Guide on Cost Management and Internal Control

Highlights the role of cost structures, including fixed costs, in ensuring business continuity.

IIA’s Practice Advisory on Cost Accounting Controls

Discusses the importance of maintaining production facilities to ensure operational readiness.

Breakdown of Answer Choices:IIA References and Internal Auditing Standards:Would you like further clarification on any point?

Extrinsic rewards are external incentives that motivate an employee to perform a task or stay in a job. These rewards include salary, bonuses, benefits, promotions, and other tangible incentives. In this case, the sales manager explicitly states that she remains in the organization because of the high bonuses, making this an example of extrinsic motivation.

(A) Incorrect – Intrinsic reward.

Intrinsic rewards are derived from internal satisfaction, such as personal growth, job fulfillment, or passion for work.

Since the manager stays primarily for monetary bonuses rather than job satisfaction, this is not intrinsic motivation.

(B) Incorrect – Job enrichment.

Job enrichment involves enhancing job roles by adding responsibilities, autonomy, or variety to improve motivation.

The scenario does not mention job enhancement as a reason for staying.

(C) Correct – Extrinsic reward.

High bonuses are a classic example of extrinsic motivation.

The manager is staying for financial incentives rather than job satisfaction.

(D) Incorrect – The hierarchy of needs.

Maslow’s Hierarchy of Needs explains different levels of human motivation, but the question asks for a specific type of motivation rather than a broad theoretical framework.

IIA’s Guide on Human Resources Risk Management

Highlights the impact of extrinsic vs. intrinsic motivation on employee retention.

COSO’s ERM Framework – Employee Retention and Performance Management

Discusses the role of financial incentives in retaining employees.

IIA’s Global Internal Audit Standards – Organizational Behavior and Employee Motivation

Explains intrinsic vs. extrinsic rewards in workforce management.

Analysis of Answer Choices:IIA References and Internal Auditing Standards: