Business Knowledge for Internal Auditing
Last Update Sep 22, 2025
Total Questions : 516
We are offering FREE IIA-CIA-Part3 IIA exam questions. All you do is to just go and sign up. Give your details, prepare IIA-CIA-Part3 free exam questions and then go for complete pool of Business Knowledge for Internal Auditing test questions that will help you more.
Which of the following is true of bond financing, compared to common stock, when alJ other variables are equal?
Which of the following controls would enable management to receive timely feedback and help mitigate unforeseen risks?
A company that supplies medications to large hospitals relies heavily on subcontractors to replenish any shortages within 24 hours. Where should internal auditors look for evidence that subcontractors are held responsible for this obligation?
An organization buys equity securities for trading purposes and sells them within a short time period. Which of the following is the correct way to value and report those securities at a financial statement date?
Which of the following application controls is the most dependent on the password owner?
An internal auditor found the following information while reviewing the monthly financial statements for a wholesaler of safety glasses: Opening inventory: 1,000 units at $2 per unit; Purchased: 5,000 units at $3 per unit; Sold: 3,000 units at $7 per unit. The cost of goods sold was reported at $8,500. Which of the following inventory methods was used to derive this value?
Which of the following is an example of a key systems development control typically found in the in-house development of an application system?
The head of the research and development department at a manufacturing organization believes that his team lacks expertise in some areas and decides to hire more experienced researchers to assist in the development of a new product. Which of the following variances are likely to occur as the result of this decision?
Favorable labor efficiency variance
Adverse labor rate variance
Adverse labor efficiency variance
Favorable labor rate variance
An internal auditor observed that the organization's disaster recovery solution will make use of a cold site in a town several miles away. Which of the following is likely to be a characteristic of this disaster recovery solution?
Which of the following is an example of a smart device security control intended to prevent unauthorized users from gaining access to a device’s data or applications?
Which of the following statements is true regarding a bring-your-own-device (BYOD) environment?
Which of the following statements is true regarding the capital budgeting procedure known as the discounted payback period?
A retail organization mistakenly did not include $10,000 of inventory in the physical count at the end of the year. What was the impact to the organization’s financial statements?
Which of the following security controls would be appropriate to protect the exchange of information?
Which of the following is a limitation of the remote wipe for a smart device?
According to UA guidance on IT, at which of the following stages of the project life cycle would the project manager most likely address the need to coordinate project resources?
How can the concept of relevant cost help management with behavioral analyses?
In an organization that produces chocolate, the leadership team decides that the organization will open a milk production facility for its milk chocolate. Which of the following strategies have the organization chosen?
A bond that matures after one year has a face value of S250,000 and a coupon of $30,000. if the market price of the bond is 5265,000, which of the following would be the market interest rate?
At what stage of project integration management would a project manager and project management team typically coordinate the various technical and organizational interfaces that exist in the project?
An organization contracted a third-party service provider to plan, design, and build a new facility. Senior management would like to transfer all of the risk to the builder. Which type of procurement contract would the organization use?
During a review of the accounts payable process, an internal auditor gathered all of the vendor payment transactions for the past 24 months. The auditor then used an Analytics tool to identify the top five vendors that received the highest sum of payments. Which of the following analytics techniques did the auditor apply?
Which of the following capital budgeting techniques considers the expected total net cash flows from investment?
Which of the following types of budgets will best provide the basis for evaluating the organization's performance?
The board of directors wants to implement an incentive program for senior management that is specifically tied to the long-term health of the organization. Which of the following methods of compensation would be best to achieve this goal?
An internal auditor for a pharmaceutical company as planning a cybersecurity audit and conducting a risk assessment. Which of the following would be considered the most significant cyber threat to the organization?
Which of the following application controls, implemented by management, monitors data being processed to ensure the data remains consistent and accurate?
An organization suffered significant damage to its local: file and application servers as a result of a hurricane. Fortunately, the organization was able to recover all information backed up by its overseas third-party contractor. Which of the following approaches has been used by the organization?
According to IIA guidance on IT, which of the following best describes a logical access control?
Which of the following backup methodologies would be most efficient in backing up a database in the production environment?
Which of the following performance measures disincentives engaging in earnings management?
Which of the following should internal auditors be attentive of when reviewing personal data consent and opt-in/opt-out management process?
An organization produces products X and Y. The materials used for the production of both products are limited to 500 Kilograms
(kg ) per month. All other resources are unlimited and their costs are fixed. Individual product details are as follows in order to maximize profit, how much of product Y should the organization produce each month?
$10 $13
2 kg
70 units
6 kg
120 units
Which of the following best describes a cyberattacK in which an organization faces a denial-of-service threat created through malicious data encryption?
Which of the following security controls would be me most effective in preventing security breaches?
An organization with a stable rating, as assessed by International rating agencies, has issued a bond not backed by assets or collateral. Payments of the interests and the principal to bondholders are guaranteed by the organization. Which type of bond did the organization issue?
Which of the following information security controls has the primary function of preventing unauthorized outside users from accessing an organization's data through the organization's network?
A new clerk in the managerial accounting department applied the high-low method and computed the difference between the high and low levels of maintenance costs. Which type of maintenance costs did the clerk determine?
Which of these instances accurately describes the responsibilities for big data governance?
A manager at a publishing company received an email that appeared to be from one of her vendors with an attachment that contained malware embedded in an Excel spreadsheet . When the spreadsheet was opened, the cybercriminal was able to attack the company's network and gain access to an unpublished and highly anticipated book. Which of the following controls would be most effective to prevent such an attack?
Which of the following is a cybersecurity monitoring activity intended to deter disruptive codes from being installed on an organizations systems?
Which of the following statements is true regarding the term "flexible budgets" as it is used in accounting?
Which of the following statements is true regarding activity-based costing (ABC)?
The head of the research arid development department at a manufacturing organization believes that his team lacks expertise in some areas, and he decides to hire more experienced researchers to assist in the development of a new product. Which of the following variances are likely to occur as the result of this decision?
1. Favorable labor efficiency variance.
2. Adverse labor rate variance.
3. Adverse labor efficiency variance.
4. Favorable labor rate variance.
According to Maslow's hierarchy of needs theory, which of the following best describes a strategy where a manager offers an assignment to a subordinate specifically to support his professional growth and future advancement?
A retail organization mistakenly did have include $10,000 of Inventory in the physical count at the end of the year. What was the impact to the organization's financial statements?
Which of the following is a disadvantage in a centralized organizational structure?
Which of the following is the most appropriate way lo record each partner's initial Investment in a partnership?
According to IIA guidance on IT, which of the following best describes a situation where data backup plans exist to ensure that critical data can be restored at some point in the future, but recovery and restore processes have not been defined?
A new manager received computations of the internal fate of return regarding the project proposal. What should the manager compare the computation results to in order to determine whether the project is potentially acceptable?
When management uses the absorption costing approach, fixed manufacturing overhead costs are classified as which of the following types of costs?
Which of the following statements is true regarding cost-volume-profit analysis?
A rapidly expanding retail organisation continues to be tightly controlled by its original small management team. Which of the following is a potential risk in this vertically centralized organization?
An Internal auditor is using data analytics to focus on high-risk areas during an engagement. The auditor has obtained data and is working to eliminate redundancies in the data. Which of the following statements is true regarding this scenario?
Which of the following is on advantage of a decentralized organizational structure, as opposed to a centralized structure?
According to IIA guidance, which of the following is a broad collection of integrated policies, standards, and procedures used to guide the planning and execution of a project?
Which of the following principles s shared by both hierarchies and open organizational structures?
1. A superior can delegate the authority to make decisions but cannot delegate the ultimate responsibility for the results of those decisions.
2. A supervisor's span of control should not exceed seven subordinates.
3. Responsibility should be accompanied by adequate authority.
4. Employees at all levels should be empowered to make decisions.
Which of the following controls would be the most effective in preventing the disclosure of an organization's confidential electronic information?
When determining the level of physical controls required for a workstation, which of the following factors should be considered?
During a routine bank branch audit, the internal audit function observed that the sole security guard at the branch only worked part time. The chief audit executive (CAE) believed that this increased the risk of loss of property and life in the event of a robbery. The branch security manager informed the CAE that a full-time guard was not needed because the branch was in close proximity to a police station. Still, the CAE found this to be an unacceptable risk due to the recent increase in robberies in that area. Which of the following is the most appropriate next step for the CAE to take?
Which approach should a chief audit executive take when preparing the internal audit plan?
In a final audit report, internal auditors drafted the following management action plan with a due date of the last day of the calendar year:
"Plan: A bank reconciliation template has been updated to address issues with formulas incorrectly calculating variances."
Which critical element of the action plan is missing?
Which of the following is an advantage of a decentralized organizational structure, as opposed to a centralized structure?
Which of the following statements is most accurate concerning the management and audit of a web server?
Capital budgeting involves choosing among various capital projects to find the one(s) that will maximize a company's return on its financial investment. Which of the following parties approves the capital budget?
Which of the following forms of compensation best indicates that an organization’s cost-saving objectives have been targeted?
Which of the following describes the most appropriate set of tests for auditing a workstation’s logical access controls?
Which of the following is classified as a product cost using the variable costing method?
Direct labor costs.
Insurance on a factory.
Manufacturing supplies.
Packaging and shipping costs.
Which of the following physical access controls is most likely to be based on the "something you have" concept?
Which of the following is a result of implementing an e-commerce system that relies heavily on electronic data interchange (EDI) and electronic funds transfer (EFT) for purchasing and billing?
An investor has acquired an organization that has a dominant position in a mature, slow-growth industry and consistently creates positive financial income. Which of the following terms would the investor most likely label this investment in her portfolio?
Which of the following risks would involve individuals attacking an oil company’s IT system as a sign of solidarity against drilling in a local area?
A rapidly expanding retail organization continues to be tightly controlled by its original small management team. Which of the following is a potential risk in this vertically centralized organization?
According to IIA guidance, which of the following best describes an adequate management (audit) trail application control for the general ledger?
Which of the following concepts of managerial accounting is focused on achieving a point of low or no inventory?
As it relates to the data analytics process, which of the following best describes the purpose of an internal auditor who cleaned and normalized data?
When using data analytics during a review of the procurement process, what is the first step in the analysis process?
According to Herzberg’s Two-Factor Theory of Motivation, which of the following factors are mentioned most often by satisfied employees?
According to IIA guidance, which of the following statements is true with regard to workstation computers that access company information stored on the network?
Which of the following is a primary driver behind the creation and prioritization of new strategic initiatives established by an organization?
A new manager received computations of the internal rate of return regarding his project proposal. What should the manager compare the computation results to in order to determine whether the project is potentially acceptable?
During a payroll audit, the internal auditor is assessing the security of the local area network of the payroll department computers. Which of the following IT controls should the auditor test?
According to IIA guidance on IT, which of the following would be considered a primary control for a spreadsheet to help ensure accurate financial reporting?
During which phase of the contracting process are contracts drafted for a proposed business activity?
Which of the following authentication controls combines what a user knows with the unique characteristics of the user, respectively?
Which type of bond sells at a discount from face value, then increases in value annually until it reaches maturity and provides the owner with the total payoff?
According to IIA guidance on IT, which of the following best describes a situation where data backup plans exist to ensure that critical data can be restored at some point in the future, but recovery and restore processes have not been defined?
At one organization, the specific terms of a contract require both the promisor end promise to sign the contract in the presence of an independent witness.
What is the primary role to the witness to these signatures?
Based on lest results, an IT auditor concluded that the organization would suffer unacceptable loss of data if there was a disaster at its data center. Which of the following test results would likely lead the auditor to this conclusion?
An internal auditor found the following information while reviewing the monthly financial siatements for a wholesaler of safety
The cost of goods sold was reported at $8,500. Which of the following inventory methods was used to derive this value?
Which of the following types of date analytics would be used by a hospital to determine which patients are likely to require remittance for additional treatment?
An organization requires an average of 5S days to convert raw materials into finished products to sell. An average of 42 additional days is required to collect receivables. If the organization takes an average of 10 days to pay for the raw materials, how long is its total cash conversion cycle?
An organization that soils products to a foreign subsidiary wants to charge a price that wilt decrease import tariffs. Which of the following is the best course of action for the organization?
Which of the following techniques would best detect on inventory fraud scheme?
Which of the following is a result of Implementing on e-commerce system, which relies heavily on electronic data interchange and electronic funds transfer, for purchasing and biting?
Which of the following situations best applies to an organisation that uses a project, rather than a process, to accomplish its business activities?
An internal auditor is assessing the risks related to an organization's mobile device policy. She notes that the organization allows third parties (vendors and visitors) to use outside smart devices to access its proprietary networks and systems. Which of the following types of smart device risks should the internal
Auditor be most concerned about?
Which of the following should be included in a data privacy poky?
1. Stipulations for deleting certain data after a specified period of time.
2. Guidance on acceptable methods for collecting personal data.
3. A requirement to retain personal data indefinitely to ensure a complete audit trail,
4. A description of what constitutes appropriate use of personal data.
Which of the following describes the most appropriate set of tests for auditing a workstation's logical access controls?
Which of the following is a primary driver behind the creation and prloritteation of new strategic Initiatives established by an organization?
A one-time password would most likely be generated in which of the following situations?
What kind of strategy would be most effective for an organization to adopt in order to Implement a unique advertising campaign for selling identical product lines across all of its markets?
Which of the following responsibilities would ordinary fall under the help desk function of an organization?
Which of the following job design techniques would most likely be used to increase employee motivation through job responsibility and recognition?
Which of the following is on example of a smart device security control intended to prevent unauthorized users from gaining access to a device's data or applications?
While auditing an organization's customer call center, an internal auditor notices that Key performance indicators show a positive trend, despite the fact that there have been increasing customer complaints over the same period. Which of the following audit recommendations would most likely correct the cause of this inconsistency?
As it relates to the data analytics process, which of the following best describes the purpose of an internal auditor who cleaned and normalized cate?
Which of the following security controls focuses most on prevention of unauthorized access to the power plant?
Which of the following is a necessary action for an internal audit function if senior management chooses not to take action to remediate the finding and accepts the risk?
A manufacturer ss deciding whether to sell or process materials further. Which of the following costs would be relevant to this decision?
Which of the following IT disaster recovery plans includes a remote site dessgnated for recovery with available space for basic services, such as internet and
telecommunications, but does not have servers or infrastructure equipment?
In light of increasing emission taxes in the European Union, a car manufacturer introduced a new middle-class hybrid vehicle specifically for the European market only. Which of the following competitive strategies has the manufacturer used?
Management has decided to change the organizational structure from one that was previously decentralized to one that is now highly centralized. As such: which of the
following would be a characteristic of the now highly centralized organization?
After purchasing shoes from an online retailer, a customer continued to receive additional unsolicited offers from the retailer and other retailers who offer similar products.
Which of the following is the most likely control weakness demonstrated by the seller?
Employees at an events organization use a particular technique to solve problems and improve processes. The technique consists of five steps: define, measure, analyze,
improve, and control. Which of the following best describes this approach?
Management decides to accept the risk on a significant audit observation related to the organization's exposure to fraud risk. The chief audit executive considers the finding to have a high residual risk. Which of the following steps should be performed last?
According to IIA guidance, whose input must be considered when developing the annual internal audit plan?
Which of the following should software auditors do when reporting internal audit findings related to enterprisewide resource planning?
Which of the following would an organization execute to effectively mitigate and manage risks created by a crisis or event?
An internal auditor is reviewing key phases of a software development project. Which of the following would; the auditor most likely use to measure the project team's performance related to how project tasks are completed?
When evaluating the help desk services provided by a third-party service provider which of the following is likely to be the internal auditor's greatest concern?
Which of the following would be most likely found in an internal audit procedures manual?
How can the chief audit executive best provide the internal audit function with the resources needed to fulfill the annual audit plan?
Several organizations have developed a strategy to open co-owned shopping malls. What would be the primary purpose of this strategy?
Which of the following is a characteristic of using a hierarchical control structure?
According to 11A guidance on IT, which of the following spreadsheets is most likely to be considered a high-risk user-developed application?
Which of the following attributes of data are cybersecurity controls primarily designed to protect?
During an internal audit engagement, numerous deficiencies in the organization's management of customer data were discovered, entailing the risk of breaching personal data protection legislation. An improvement plan was approved by senior management. Which of the following conditions observed during the periodic follow-up process best justifies the chief audit executive's decision to escalate the issue to the board?
Which of the following actions should an internal auditor take to clean the data obtained for analytics purposes?
A significant project is nearing its development stage end, and line management intends to apply for a final investment decision from senior management at an upcoming meeting. The internal audit function is at the fieldwork stage of an assurance engagement related to this project and discovers that tenders conducted for the project were not carried out transparently by line management. The audit report will not be ready by the upcoming senior management meeting. Which of the following actions is the most appropriate next step for the chief audit executive?
Through meetings with management, an organization's chief audit executive (CAE) learns of a risk that exceeds the established risk tolerance. What would be an appropriate next action for the CAE to take?
The finance department of an organization recently undertook an asset verification exercise. The internal audit function scheduled a review of the IT department’s operations, which includes verifying the existence of computers distributed and their assignment. Can the internal audit function consider relying on the asset verification work performed by the finance department?
According to 11A guidance on it; which of the following statements is true regarding websites used in e-commerce transactions?
During an audit of the payroll system, the internal auditor identifies and documents the following condition:
"Once a user is logged into the system, the user has access to all functionality within the system."
What is the most likely root cause for tins issue?
An internal auditor uses a risk and control questionnaire as part of the preliminary survey for an audit of the organization's anti-bribery and corruption program. What is the primary purpose of using this approach?
A newly hired chief audit executive (CAE) reviews and will revise the existing internal audit strategy. What should the CAE initially refer to when revising the internal audit strategy?
Which of the following is a benefit from the concept of Internet of Things?
Which of the following communication characteristics is achieved when the internal audit function avoids redundancies and excludes information that is unnecessary, insignificant, or unrelated to the engagement?
When auditing the account receivables for the first time, an internal auditor noted that the finance team had not—over many accounting periods—reviewed the accounts receivables for debts that could no longer be collected. How should the auditor proceed?
TESTED 22 Sep 2025
