Internal Audit Function
Last Update Jul 26, 2026
Total Questions : 791
We are offering FREE IIA-CIA-Part3 IIA exam questions. All you do is to just go and sign up. Give your details, prepare IIA-CIA-Part3 free exam questions and then go for complete pool of Internal Audit Function test questions that will help you more.
Which of the following data analytics methods involves analyzing event trends to determine what happened?
Which of the following statements is true with regard to capital budgeting?
Which of the following statements is accurate regarding the use of Secure Sockets Layer (SSL) as a control?
An intruder posing as the organization ' s CEO sent an email and tricked payroll staff into providing employees ' private tax information. What type of attack was perpetrated?
Which of the following concepts of managerial accounting is focused on achieving a point of low or no inventory?
A small software development firm designs and produces custom applications for businesses. The application development team consists of employees from multiple departments who all report to a single project manager. Which of the following organizational structures does this situation represent?
Which statement is true regarding the development of a risk-based internal audit plan?
Which of the following IT layers would require the organization to maintain communication with a vendor in a tightly controlled and monitored manner?
An internal auditor uses a risk and control questionnaire as part of the preliminary survey for an audit of the organization ' s anti-bribery and corruption program. What is the primary purpose of using this approach?
Which of the following controls is designed to mitigate a physical IT risk?
An internal auditor is auditing their organization’s termination process. A primary objective of this engagement is to verify that exit interviews were conducted for all terminated employees over the last two years. The auditor discovered that not all employees received exit interviews.
Which of the following risks could this lead to?
When reviewing application controls using the four-level model, which of the following processes are associated with level 4 of the business process method?
Which of the following practices impacts copyright issues related to the manufacturer of a smart device?
An organization ' s technician was granted a role that enables him to prioritize projects throughout the organization. Which type of authority will the technician most likely be exercising?
Which of the following techniques is the most relevant when an internal auditor conducts a valuation of an organization ' s physical assets?
Which of the following risks would Involve individuals attacking an oil company ' s IT system as a sign of solidarity against drilling in a local area?
During a payroll audit, the internal auditor is assessing the security of the local area network of the payroll department computers. Which of the following IT controls should the auditor test?
Based on test results, an IT auditor concluded that the organization would suffer unacceptable loss of data if there was a disaster at its data center. Which of the following test results would likely lead the auditor to this conclusion?
Capacity overbuilding is most likely to occur when management is focused on which of the following?
Which of the following are the most appropriate measures for evaluating the change in an organization ' s liquidity position?
An internal auditor discusses user-defined default passwords with the database administrator. Such passwords will be reset as soon as the user logs in for the first time, but the initial value of the password is set as " 123456. " Which of the following are the auditor and the database administrator most likely discussing in this situation?
Which of the following would be the strongest control to prevent unauthorized wireless network access?
Which of the following analytical techniques would an internal auditor use to verify that none of an organization ' s employees are receiving fraudulent invoice payments?
An organization produces products X and Y. The materials used for the production of both products are limited to 500 Kilograms
(kg ) per month. All other resources are unlimited and their costs are fixed. Individual product details are as follows in order to maximize profit, how much of product Y should the organization produce each month?
$10 $13
2 kg
70 units
6 kg
120 units
Which of the following biometric access controls uses the most unique human recognition characteristic?
An organization has an agreement with a third-party vendor to have a fully operational facility, duplicate of the original site and configured to the organization ' s needs, in order to quickly recover operational capability in the event of a disaster, Which of the following best describes this approach to disaster recovery planning?
An organization’s account for office supplies on hand had a balance of $9,000 at the end of year one. During year two, the organization recorded an expense for purchasing office supplies. At the end of year two, a physical count determined that the organization has $11,500 in office supplies on hand. Based on this information, what would be recorded in the adjusting entry at the end of year two?
Which of the following application controls is the most dependent on the password owner?
Data analysis indicates that a hospital pharmacy disbursed higher levels of controlled drugs than similar pharmacies in the area. The hospital ' s internal auditor discusses the risk with the head of the hospital pharmacy, who believes that the risk is appropriately mitigated by controls and feels comfortable with the number of prescriptions written.
What should the auditor do next?
Which of the following lists best describes the classification of manufacturing costs?
Which of the following are appropriate functions for an IT steering committee?
Assess the technical adequacy of standards for systems design and programming.
Continually monitor the adequacy and accuracy of software and hardware in use.
Assess the effects of new technology on the organization ' s IT operations.
Provide broad oversight of implementation, training, and operation of new systems.
An organization sells 1,000 shares of its treasury stock at $15 per share previously acquired at $10 per share.
Which of the following statements is true?
Which of the following is the most appropriate way lo record each partner ' s initial Investment in a partnership?
During her annual performance review, a sales manager admits that she experiences significant stress due to her job but stays with the organization because of the high bonuses she earns. Which of the following best describes her primary motivation to remain in the job?
Management has established a performance measurement focused on the accuracy of disbursements. The disbursement statistics, provided daily to ail accounts payable and audit staff, include details of payments stratified by amount and frequency. Which of the following is likely to be the greatest concern regarding this performance measurement?
Which of the following is a security feature that involves the use of hardware and software to filter or prevent specific information from moving between the inside network and the outside network?
During an internal audit engagement, numerous deficiencies in the organization ' s management of customer data were discovered, entailing the risk of breaching personal data protection legislation. An improvement plan was approved by senior management. Which of the following conditions observed during the periodic follow-up process best justifies the chief audit executive ' s decision to escalate the issue to the board?
An organization that sells products to a foreign subsidiary wants to charge a price that will decrease import tariffs. Which of the following is the best course of action for the organization?
An internal auditor reviews a data population and calculates the mean, median, and range. What is the most likely purpose of performing this analytic technique?
Maintenance cost at a hospital was observed to increase as activity level increased. The following data was gathered:
January: 5,600 patient days; maintenance cost $7,900
February: 7,100 patient days; maintenance cost $8,500
March: 5,000 patient days; maintenance cost $7,400
April: 6,500 patient days; maintenance cost $8,200
May: 7,300 patient days; maintenance cost $9,100
June: 8,000 patient days; maintenance cost $9,800
If the cost of maintenance is expressed in an equation, what is the independent variable for this data?
According to IIA guidance, which of the following statements is true with regard to workstation computers that access company information stored on the network?
A large retail customer made an offer to buy 10.000 units at a special price of $7 per unit. The manufacturer usually sells each unit for §10, Variable Manufacturing costs are 55 per unit and fixed manufacturing costs are $3 per unit. For the manufacturer to accept the offer, which of the following assumptions needs to be true?
According to Porter ' s model of competitive strategy, which of the following is a generic strategy?
Differentiation.
Competitive advantage.
Focused differentiation.
Cost focus.
An organization uses radio frequency identification (RFID) technology to identify vehicles authorized to enter a gated facility. The RFID reader scans the vehicle ' s license plate number, and if the number is on a pre-authorized list, a green light flashes, indicating to the security guard that he can push a button to open the gate.
Which of the following controls should be added to ensure that a particular vehicle is authorized to enter the facility?
Which of the following describes the primary advantage of using data analytics in internal auditing?
Which of the following types of date analytics would be used by a hospital to determine which patients are likely to require remittance for additional treatment?
Which of the following statements is true regarding multi-report summaries for members of senior management and the board?
Which of the following disaster recovery plans includes recovery resources available at the site, but they may need to be configured to support the production system?
The profile of an internal auditor ' s personality traits reveals that the auditor is most motivated by self-actualization needs.
Given this, which of the following is likely to serve as the best motivator for this auditor?
Which of the following best describes the chief audit executive ' s responsibility for assessing the organization ' s residual risk?
Which of the following is an indicator of liquidity that is more dependable than working capital?
Which of the following is a distinguishing feature of managerial accounting, which is not applicable to financial accounting?
For employees, the primary value of implementing job enrichment is which of the following?
Which of the following can be viewed as a potential benefit of an enterprisewide resource planning system?
When using data analytics during a review of the procurement process, what is the first step in the analysis process?
Which of the following is true of bond financing, compared to common stock, when alJ other variables are equal?
Which of the following statements is in accordance with COBIT?
Pervasive controls are general while detailed controls are specific.
Application controls are a subset of pervasive controls.
Implementation of software is a type of pervasive control.
Disaster recovery planning is a type of detailed control.
According to IIA guidance on IT, which of the following best describes a situation where data backup plans exist to ensure that critical data can be restored at some point in the future, but recovery and restore processes have not been defined?
According to IIA guidance, which of the following is a broad collection of integrated policies, standards, and procedures used to guide the planning and execution of a project?
How should a chief audit executive learn about emerging risk areas in an organization?
Which of the following statements is true regarding IT controls within an organization?
According to Maslow ' s hierarchy of needs theory, which of the following would likely have the most impact on retaining staff, if their lower-level needs are already met?
Which of the following is a potential risk for an organization that allows employees to use their personal devices to conduct business?
What kind of strategy would be most effective for an organization to adopt in order to Implement a unique advertising campaign for selling identical product lines across all of its markets?
A retail organization is considering acquiring a composite textile company. The retailer ' s due diligence team determined the value of the textile company to be $50 million. The financial experts forecasted net present value of future cash flows to be $60 million. Experts at the textile company determined their company ' s market value to be $55 million if purchased by another entity. However, the textile company could earn more than $70 million from the retail organization due to synergies. Therefore, the textile company is motivated to make the negotiation successful. Which of the following approaches is most likely to result in a successful negotiation?
In light of increasing emission taxes in the European Union, a car manufacturer introduced a new middle-class hybrid vehicle specifically for the European market only. Which of the following competitive strategies has the manufacturer used?
As part of internal audit ' s risk assessment, a chief audit executive is determining certain factors as part of planning the areas to audit within an organization that makes silicon chips. Which of the following would be considered a subjective factor as part of the risk assessment?
When writing a business memorandum, the writer should choose a writing style that achieves all of the following except:
What must be monitored in order to manage the risk of consumer product inventory obsolescence?
Inventory balances.
Market share forecasts.
Sales returns.
Sales trends.
A global business organization is selecting managers to post to various international expatriate assignments. In the screening process, which of the following traits would be required to make a manager a successful expatriate?
Superior technical competence.
Willingness to attempt to communicate in a foreign language.
Ability to empathize with other people.
According to IIA guidance, which of the following would be a primary reason for an internal auditor to test the organization ' s IT contingency plan?
Which of the following represents an inventory costing technique that can be manipulated by management to boost net income by selling units purchased at a low cost?
When developing an effective risk-based plan to determine audit priorities, an internal audit activity should start by:
An organization filters data packets from public networks to send to an internal private network.
Which of the following devices would accomplish this?
Which of the following scenarios best illustrates a spear phishing attack?
The sole internal auditor of a municipality wants to implement proper supervision over internal audit workpapers. Which of the following would be the most appropriate?
Which of the following is true regarding an organization ' s relationship with external stakeholders?
According to Maslow’s hierarchy of needs theory, which of the following best describes a strategy where a manager offers an assignment to a subordinate specifically to support his professional growth and future advancement?
Which of the following risks would involve individuals attacking an oil company’s IT system as a sign of solidarity against drilling in a local area?
A new clerk in the managerial accounting department applied the high-low method and computed the difference between the high and low levels of maintenance costs. Which type of maintenance costs did the clerk determine?
Following an evaluation of an organization ' s IT controls, an internal auditor suggested improving the process where results are compared against the input. Which of the following IT controls would the Internal auditor recommend?
Which of the following steps should an internal auditor take during an audit of an organization ' s business continuity plans?
Evaluate the business continuity plans for adequacy and currency.
Prepare a business impact analysis regarding the loss of critical business.
Identify key personnel who will be required to implement the plans.
Identify and prioritize the resources required to support critical business processes.
Which of the following conditions could lead an organization to enter into a new business through internal development rather than through acquisition?
While auditing an organization ' s customer call center, an internal auditor notices that Key performance indicators show a positive trend, despite the fact that there have been increasing customer complaints over the same period. Which of the following audit recommendations would most likely correct the cause of this inconsistency?
An organization that produces backpacks of standard quality is considering manufacturing high-quality packs. Which of the following costs is most relevant when deciding whether to manufacture the new product?
Which of the following accounting methods is an investor organization likely to use when buying 40 percent of the stock of another organization?
Which of the following accurately describes a difference between phishing and spear phishing?
Which of the following is an advantage of a decentralized organizational structure, as opposed to a centralized structure?
A significant project is nearing its development stage end, and line management intends to apply for a final investment decision from senior management at an upcoming meeting. The internal audit function is at the fieldwork stage of an assurance engagement related to this project and discovers that tenders conducted for the project were not carried out transparently by line management. The audit report will not be ready by the upcoming senior management meeting. Which of the following actions is the most appropriate next step for the chief audit executive?
Which of the following is not a potential area of concern when an internal auditor places reliance on spreadsheets developed by users?
According to IIA guidance, which of the following is an IT project success factor?
Which of the following does not provide operational assurance that a computer system is operating properly?
A line on a spreadsheet includes an employee ' s name, date of hire, job title, and monthly salary. Which of the following correctly describes this line information?
An organization ' s financial statements indicate a note that the financial statements have been prepared on the basis of the organization continuing operations for the foreseeable future. Which of the following accounting principles has been applied based on this note?
Which of the following bring-your-own-device (BYOD) practices is likely to increase the risk of Infringement on local regulations, such as copyright or privacy laws?
The finance department of an organization recently undertook an asset verification exercise. The internal audit function scheduled a review of the IT department’s operations, which includes verifying the existence of computers distributed and their assignment. Can the internal audit function consider relying on the asset verification work performed by the finance department?
A company that uses the accrual basis of accounting can recognize revenue under which of the following conditions?
Which of the following is the most appropriate action an internal auditor would perform during an audit of his organization ' s IT change management process?
With regard to disaster recovery planning, which of the following would most likely involve stakeholders from several departments?
After identifying and reporting a control deficiency, which of the following actions should an internal auditor perform next?
An organization prepares a statement of privacy to protect customers ' personal information. Which of the following might violate the privacy principles?
Which of the following financial statements provides the best disclosure of how a company ' s money was used during a particular period?
Which of the following situations best applies to an organisation that uses a project, rather than a process, to accomplish its business activities?
Which of the following controls would enable management to receive timely feedback and help mitigate unforeseen risks?
According to the COSO enterprise risk management framework, which of the following is not a typical responsibility of the chief risk officer?
A manager decided to build his team ' s enthusiasm by giving encouraging talks about employee empowerment, hoping to change the perception that management should make all decisions in the department.
The manager is most likely trying to impact which of the following components of his team ' s attitude?
Which of the following is an example of a physical control designed to prevent security breaches?
Which of the following bring-your-own-device (BYOD) practices is likely to increase the risk of infringement on local regulations, such as copyright or privacy laws?
An organization has adopted a bring-your-own-device (BYOD) policy, and employees can access organizational data via their smart devices.
Which of the following authentication policy requirements is the most advisable?
A software that translates hypertext markup language (HTML) documents and allows a user to view a remote web page is called:
Which of the following is true regarding the use of remote wipe for smart devices?
Which of the following security controls would provide the most efficient and effective authentication for customers to access these online shopping account?
Which of the following actions should an internal auditor take to clean the data obtained for analytics purposes?
An internal auditor for a pharmaceutical company as planning a cybersecurity audit and conducting a risk assessment. Which of the following would be considered the most significant cyber threat to the organization?
Which of the following is used during all three stages of project management?
A rapidly expanding retail organization continues to be tightly controlled by its original small management team. Which of the following is a potential risk in this vertically centralized organization?
An organization outsources its IT function and help desk services. A service-level agreement has been signed and a business continuity plan (BCP) has been developed.
Which of the following should be included in the BCP?
An internal audit engagement team found that the risk register of the project under review did not include significant risks identified by the internal audit function. The project manager explained that risk register preparations are facilitated by risk managers and that each project’s risk review follows the same set of questions. Which of the following recommendations will likely add the greatest value to the project management process of the organization?
A capital investment project will have a higher net present value, everything else being equal, if it has:
An organization requires an average of 58 days to convert raw materials into finished products to sell. An additional 42 days is required to collect receivables. If the organization takes an average of 10 days to pay for raw materials, how long is its total cash conversion cycle?
An internal auditor discovered that the organization was not in full compliance with a regulatory labeling requirement for one of its products. The responsible manager indicated that the current product labeling has been in use for several years without any problems. If discovered, this regulatory breach could result in significant fines for the organization. What should be the chief audit executive ' s next course of action?
The process of scenario planning begins with which of the following steps?
An internal auditor is assessing the risks related to an organization’s mobile device policy. She notes that the organization allows third parties (vendors and visitors) to use outside smart devices to access its proprietary networks and systems. Which of the following types of smart device risks should the internal auditor be most concerned about?
Which of the following descriptions of the internal control system are indicators that risks are managed effectively?
Existing controls promote compliance with applicable laws and regulations.
The control environment is designed to address all identified risks to the organization.
Key controls for significant risks to the organization remain consistent over time.
Monitoring systems are in place to alert management to unexpected events.
Management is designing its disaster recovery plan. In the event that there is significant damage to the organization ' s IT systems this plan should enable the organization to resume operations at a recovery site after some configuration and data restoration. Which of the following is the ideal solution for management in this scenario?
Which of the following would be the best method to collect information about employees ' job satisfaction?
The board of directors wants to implement an incentive program for senior management that is specifically tied to the long-term health of the organization. Which of the following methods of compensation would be best to achieve this goal?
Based on lest results, an IT auditor concluded that the organization would suffer unacceptable loss of data if there was a disaster at its data center. Which of the following test results would likely lead the auditor to this conclusion?
What relationship exists between decentralization and the degree, importance, and range of lower-level decision making?
An organization has an established bring-your-own-device policy. Due to this policy, which of the following privacy risks would be most relevant to the organization?
Which of the following price adjustment strategies encourages prompt payment?
An organization’s income and retained earnings statement is as follows:
Sales: $3,000
Cost of goods sold: $1,600
Gross profit: $1,400
Operating expenses: $970
Operating income: $430
Interest expense: $30
Income before tax: $400
Income tax: $200
Net income: $200
Plus Jan. 1 retained earnings: $150
Less dividends: $60
Dec. 31 retained earnings: $290
Which of the following is the dividend payout ratio?
An organization ' s internal audit activity performed an engagement regarding recent contract bidding. Who should the internal audit activity meet with in order to obtain reliable and relevant information about potential questionable practices related to the contract bidding?
When management uses the absorption costing approach, fixed manufacturing overhead costs are classified as which of the following types of costs?
The head of the research and development department at a manufacturing organization believes that his team lacks expertise in some areas and decides to hire more experienced researchers to assist in the development of a new product. Which of the following variances are likely to occur as the result of this decision?
Favorable labor efficiency variance
Adverse labor rate variance
Adverse labor efficiency variance
Favorable labor rate variance
An analytical model determined that on Friday and Saturday nights the luxury brands stores should be open for extended hours and with a doubled number of employees
present; while on Mondays and Tuesdays costs can be minimized by reducing the number of employees to a minimum and opening only for evening hours Which of the
following best categorizes the analytical model applied?
During the second half of the audit year, the chief audit executive (CAE) identified significant negative variances to the approved audit budget required to complete the internal audit plan. Which of the following actions should the CAE take?
An organization that relies heavily on IT wants to contain the impact of potential business disruption to a period of approximately four to seven days. Which of the following
business recovery strategies would most efficiently meet this organization ' s needs?
An organization produces two products, X and Y. The materials used for the production of both products are limited to 500 kilograms (kg) per month. All other resources are unlimited and their costs are fixed.
Individual product details are as follows:
Product X: Selling price per unit: $10; Materials per unit at $1/kg: 2 kg; Monthly demand: 100 units.
Product Y: Selling price per unit: $13; Materials per unit at $1/kg: 6 kg; Monthly demand: 120 units.
In order to maximize profit, how much of product Y should the organization produce each month?
Which of the following network types should an organization choose if it wants to allow access only to its own personnel?
Which of the following management approaches may help eliminate employee dissatisfaction, but would not necessarily motivate workers to high achievement levels?
A small furniture-manufacturing firm with 100 employees is located in a two-story building and does not plan to expand. The furniture manufactured is not special-ordered or custom-made. The most likely structure for this organization would be:
An organization is considering integration of governance, risk., and compliance (GRC) activities into a centralized technology-based resource. In implementing this GRC
resource, which of the following is a key enterprise governance concern that should be fulfilled by the final product?
Which of the following job design techniques would most likely be used to increase employee motivation through job responsibility and recognition?
Which of the following is a characteristic of using a hierarchical control structure?
Which of the following scenarios would cause a chief audit executive (CAE) to immediately discontinue using any statements that would indicate conformance with the Global Internal Audit Standards in an audit report?
Which of the following controls helps protect externally stored sensitive or confidential data from cyberthreats?
At a manufacturing plant, how would using Internet of Things during the production process benefit the organization?
Which of the following situations best illustrates a " false positive " in the performance of a spam filter?
Which of the following best describes the primary objective of cybersecurity?
The internal audit function conducted an engagement on maintenance operations of a construction organization and identified several issues of medium importance. The head of maintenance proposed an improvement plan with deadlines and personnel responsible. The internal audit function issued the final report to senior management. Senior management was dissatisfied with the report as they believed that improvement plan deadlines should be considerably shorter. Which of the following should the internal audit function change in the reporting process?
Which of the following physical security controls would most likely be used as a corrective control?
Which of the following statements is true regarding outsourced business processes?
At one organization, the specific terms of a contract require both the promisor and promisee to sign the contract in the presence of an independent witness. What is the primary role to the witness to these signatures?
The chief audit executive (CAE) has been asked to evaluate the chief technology officer ' s proposal to outsource several key functions in the organization ' s IT department. Which of the following would be the most appropriate action for the CAE to determine whether the proposal aligns with the organization ' s strategy?
Which of the following data privacy concerns can be attributed specifically to blockchain technologies?
A major IT project is scheduled to be implemented over a three-month period during the year. The chief audit executive (CAE) scheduled significant audit resources to provide consultation. Due to technical challenges from a supplier, the project is postponed until the following year. What should the CAE do in this case?
Which of the following IT-related activities is most commonly performed by the second line of defense?
For employees, the primary value of implementing job enrichment is which of the following?
Which of the following statements regarding the necessary resources to achieve the internal audit plan is true?
When initiating international ventures, an organization should consider cultural dimensions in order to prevent misunderstandings. Which of the following does not represent a recognized cultural dimension in a work environment?
An organization produces finished lumber for the construction industry.
Which of the following inventory valuation methods will lead to the highest profit, assuming all other variables remain the same in a period of rising material costs?
For a multinational organization, which of the following is a disadvantage of an ethnocentric staffing policy?
It significantly raises compensation and staffing costs.
It produces resentment among the organization ' s employees in host countries.
It limits career mobility for parent-country nationals.
It can lead to cultural myopia.
Which of the following statements best describes the concept of Internet of Things?
Which of the following statements is true regarding cost-volume-profit analysis?
Which of the following would be most effective in preventing phishing attacks from impacting business systems?
In reviewing an organization ' s IT infrastructure risks, which of the following controls is to be tested as pan of reviewing workstations?
Which of the following common quantitative techniques used in capital budgeting is best associated with the use of a table that describes the present value of an annuity?
A chief audit executive wants to implement an enterprisewide resource planning software. Which of the following internal audit assessments could provide overall assurance on the likelihood of the software implementation ' s success?
An internal auditor identified a database administrator with an incompatible dual role. Which of the following duties should not be performed by the identified administrator?
When examining; an organization ' s strategic plan, an internal auditor should expect to find which of the following components?
According to IIA guidance, which of the following would be the best first stop to manage risk when a third party is overseeing the organization ' s network and data?
A clothing company sells shirts for $8 per shirt. In order to break even, the company must sell 25.000 shirts. Actual sales total S300.000. What is margin of safety sales for the company?
An Internal auditor is using data analytics to focus on high-risk areas during an engagement. The auditor has obtained data and is working to eliminate redundancies in the data. Which of the following statements is true regarding this scenario?
With regard to project management, which of the following statements about project crashing Is true?
An organization is planning to outsource its payroll function to an external service provider. The internal auditors advised management of the risks related to outsourcing and the typical controls that should be provided by the external service provider.
Which of the following statements is true regarding the internal auditors’ advice?
An organization buys equity securities for trading purposes and sells them within a short time period. Which of the following is the correct way to value and report those securities at a financial statement date?
Which of the following responsibilities would ordinarily fall under the help desk function of an organization?
According to internal organizational rules, procurement specialists are responsible for carrying out procurement procedures in accordance with legal acts, but have little knowledge of the equipment and services being procured. Business unit engineers are responsible for preparing the technical descriptions of the desired equipment.
Which of the following controls should be implemented to mitigate potential fraud risks that may occur in the described arrangement?
Which of the following is an example of a smart device security control intended to prevent unauthorized users from gaining access to a device’s data or applications?
Which of the following measures would best protect an organization from automated attacks whereby the attacker attempts to identify weak or leaked passwords in order to log into employees ' accounts?
Which of the following best describes a transformational leader, as opposed to a transactional leader?
Which of the following responsibilities would ordinary fall under the help desk function of an organization?
Internal audit observed an increase in defects of newly installed spare parts. An investigation revealed that vendors delivered spare parts of worse quality than required by contract. Which of the following recommendations would most helpfully mitigate this risk?
Which of the following describes the most appropriate set of tests for auditing a workstation ' s logical access controls?
Which of the following statements pertaining to a market skimming pricing strategy is not true?
Which of the following would be the best indicator that the organization is saving money?
A large retail customer made an offer to buy 10,000 units at a special price of $7 per unit. The manufacturer usually sells each unit for $10. Variable manufacturing costs are $5 per unit and fixed manufacturing costs are $3 per unit. For the manufacturer to accept the offer, which of the following assumptions needs to be true?
Which of the following standards would be most useful in evaluating the performance of a customer-service group?
Which of the following statements is true regarding user-developed applications (UDAs)?
Which of the following are typical audit considerations for a review of authentication?
Authentication policies and evaluation of controls transactions.
Management of passwords, independent reconciliation, and audit trail.
Control self-assessment tools used by management.
Independent verification of data integrity and accuracy.
An organization plans to upgrade its IT network to address a recent ransomware incident that hampered operations for weeks. The ransomware was the result of lapses in access to the network that exposed sensitive information.
Which of the following is a risk that could significantly be impacted by the organization’s planned change to its IT network?
The comparable uncontrolled price (CUP) method may be used when setting transfer prices in an organization.
What is a common limitation of the CUP method?
An organization with global headquarters in the United States has subsidiaries in eight other nations. If the organization operates with an ethnocentric attitude, which of the following statements is true?
Which of the following statements is true regarding activity-based costing (ABC)?
The IT department maintains logs of user identification and authentication for all requests for access to the network. What is the primary purpose of these logs?
After auditing the treasury function, the internal audit team issued a final report, which included an action plan agreed with management. When the audit team returned three months later to follow up on the action plan, management indicated that the plan had not been implemented because the old treasury system was being replaced with a new system. Which of the following is the most appropriate audit response?
An organization had a gross profit margin of 40 percent in year one and in year two. The net profit margin was 18 percent in year one and 13 percent in year two. Which of the following could be the reason for the decline in the net profit margin for year two?
Which of the following are likely indicators of ineffective change management?
IT management is unable to predict how a change will impact interdependent systems or business processes.
There have been significant increases in trouble calls or in support hours logged by programmers.
There is a lack of turnover in the systems support and business analyst development groups.
Emergency changes that bypass the normal control process frequently are deemed necessary.
An organization decided to outsource its human resources function. As part of its process migration, the organization is implementing controls over sensitive employee data.
What would be the most appropriate directive control in this area?
An internal auditor found that several employees of a vendor were authorized to remotely access the internal assets management system.
Which of the following should the auditor determine next?
An organization ' s IT systems can only be accessed using the organization ' s virtual private network. However, organizational emails, videoconferencing, and file-sharing tools are cloud-based and can be accessed using multi-factor authentication via any device. Which of the following risks should the organization acknowledge?
An organization has an immediate need for servers, but no time to complete capital acquisitions. Which of the following cloud services would assist with this situation?
During which phase of the contracting process ere contracts drafted for a proposed business activity?
An internal auditor was asked to review an equal equity partnership. In one sampled transaction, Partner A transferred equipment into the partnership with a self-declared value of $10,000, and Partner B contributed equipment with a self-declared value of $15,000. The capital accounts of each partner were subsequently credited with $12,500. Which of the following statements is true regarding this transaction?
A motivational technique generally used to overcome monotony and job-related boredom is:
For which of the following scenarios would the most recent backup of the human resources database be the best source of information to use?
Which of the following purchasing scenarios would gain the greatest benefit from implementing electronic cate interchange?
An organization and its trading partner rely on a computer-to-computer exchange of digital business documents. Which of the following best describes this scenario?
Which of the following is classified as a product cost using the variable costing method?
Direct labor costs.
Insurance on a factory.
Manufacturing supplies.
Packaging and shipping costs.
Which of the following authentication device credentials is the most difficult to revoke when an employee ' s access rights need to be removed?
Which of the following security controls would be appropriate to protect the exchange of information?
While conducting an audit of the accounts payable department, an internal auditor found that 3% of payments made during the period under review did not agree with the submitted invoices. Which of the following key performance indicators (KPIs) for the department would best assist the auditor in determining the significance of the test results?
Which of the following situations best applies to an organization that uses a project, rather than a process, to accomplish its business activities?
Which of the following best explains why an organization would enter into a capital lease contract?
Management is pondering the following question:
" How does our organization compete? "
This question pertains to which of the following levels of strategy?
A small chain of grocery stores made a reporting error and understated its ending inventory. What effect would this have on the income statement for the following year?
TESTED 26 Jul 2026
