In organizations, authority types define how power and influence are exercised. Since the technician

is prioritizing projects, their authority comes from their specialized knowledge or expertise, making

this an example of expert authority.

Why Option D (Expert Authority) is Correct:

Expert authority is based on specialized knowledge, skills, or expertise rather than formal position or

hierarchical power.

The technician is trusted to prioritize projects because of their technical knowledge and

understanding of project impact.

Expert authority is commonly seen in IT specialists, consultants, and industry professionals who

guide decision-making based on expertise.

Why Other Options Are Incorrect:

Option A (Legitimate Authority):

Incorrect because legitimate authority is derived from a formal position or title within an

organizational hierarchy (e.g., CEO, manager).

Option B (Coercive Authority):

Incorrect because coercive authority relies on threats, punishment, or force, which is not applicable

in this scenario.

Option C (Referent Authority):

Incorrect because referent authority is based on personal influence, charisma, or relationships,

rather than expertise.

IIA Reference:

IIA Practice Guide – "Auditing Organizational Governance": Discusses different types of authority in

decision-making.

COSO ERM Framework – "Risk Governance & Decision-Making": Recognizes expert authority as a key

factor in risk-based project prioritization.

IIA’s GTAG – "Auditing IT Governance": Highlights the role of expert authority in IT project

prioritization and governance.

The discussion between the internal auditor and the database administrator is most likely centered

around the security risk present in the period between account creation and password change. When

a system generates a default password such as "123456," it introduces a temporary vulnerability until

the user changes it.

Step-by-Step Analysis:

Understanding Default Password Security Risks:

Default passwords, especially predictable ones (e.g., "123456"), pose a security threat because they

are easy to guess.

If an unauthorized user gains access before the legitimate user changes the password, data

confidentiality and integrity may be compromised (IIA GTAG - Global Technology Audit Guide).

Evaluating the Window of Exposure:

The primary concern is the time between account creation and password reset.

During this time, an attacker could exploit the default password to gain unauthorized access to

sensitive systems.

Why Other Options Are Less Relevant:

Option A (Replacing numbers with characters) – While this improves security, it does not directly

address the risk of an attacker exploiting the default password before the user resets it.

Option B (Users continuing to use the initial password) – This is a security issue, but it is mitigated by

requiring a password reset upon first login. The primary concern is the time before the reset

happens.

Option D (User training on password management) – While training is crucial for long-term security,

it does not directly address the immediate vulnerability of default passwords before they are

changed.

Relevant IIA Reference:

IIA Global Technology Audit Guide (GTAG) 16: Data Management and Security

IIA Standard 2110 – Governance: Recommends addressing IT security risks, including credential

management.

IIA Practice Advisory 2130.A1-1: Internal auditors should assess whether management has identified,

assessed, and mitigated IT security risks, such as weak authentication practices.

Understanding the Contracting Process Phases

The contracting process generally follows these phases:

Initiation Phase: Identifies the need for a contract and sets initial objectives.

Bidding Phase: Potential vendors or partners submit proposals, and negotiations begin.

Development Phase: Contracts are drafted, negotiated, and finalized before execution.

Management Phase: The contract is executed, monitored, and evaluated for compliance.

Why Option C is Correct?

The development phase is where contracts are formally drafted based on agreements made during

bidding and negotiation.

This phase includes legal review, compliance verification, and risk assessment, ensuring the contract

aligns with business objectives and legal requirements.

IIA Standard 2110 – Governance requires auditors to assess how contract risks are managed,

ensuring formal contract development processes.

Why Other Options Are Incorrect?

Option A (Initiation phase):

This phase defines the business need but does not involve drafting contracts.

Option B (Bidding phase):

In this phase, businesses solicit proposals, but contracts are not fully drafted until vendor selection.

Option D (Management phase):

The management phase involves executing and monitoring the contract, not drafting it.

Final Justification:

Contracts are drafted during the development phase after vendor selection and before execution.

IIA Standard 2110 supports governance over contract risk and formal agreement processes.

IIA Reference:

IPPF Standard 2110 – Governance (Contract Risk & Compliance)

COSO ERM – Risk Management in Contracting

A systems development methodology refers to a structured approach used in software development

and systems engineering to guide the design, development, and implementation of software

applications.

Why Option A (Waterfall) is Correct:

Waterfall methodology is a linear and sequential systems development methodology where each

phase (e.g., requirements, design, implementation, testing, deployment) must be completed before

moving to the next.

It is widely established and historically one of the first software development methodologies.

Used in large-scale enterprise projects where detailed planning and structured execution are

required.

Why Other Options Are Incorrect:

Option B (PRINCE2 - Projects in Controlled Environments):

Incorrect because PRINCE2 is a project management framework, not a systems development

methodology.

Option C (ITIL - Information Technology Infrastructure Library):

Incorrect because ITIL is a set of IT service management (ITSM) best practices, not a software

development methodology.

Option D (COBIT - Control Objectives for Information and Related Technologies):

Incorrect because COBIT is a governance framework for IT management and controls, not a

development methodology.

IIA Reference:

IIA GTAG – "Auditing IT Projects and Systems Development": Highlights Waterfall as a traditional

systems development methodology.

IIA’s Global Technology Audit Guide on IT Risks: Discusses software development lifecycle risks,

including Waterfall methodology.

COBIT Framework – BAI03 (Manage Solutions Identification and Build): Reference structured

methodologies like Waterfall in IT governance.

Cloud-based applications accessible outside the VPN perimeter increase the possibility of data

leakage through unapproved or unsecured applications (shadow IT). Even with multi-factor

authentication, risks remain around the use of personal devices and uncontrolled storage or sharing.

Option B is incorrect because VPNs are generally secure if configured correctly. Option C is

misleading, as remote access controls can be effective in cloud solutions when properly designed.

Option D (employees accessing emails after hours) is not a risk related to security but rather a work-

life balance issue.

Thus, the key risk is potential leakage of organizational data via unapproved or uncontrolled

applications (Option A).

Reference:

IIA Global Technology Audit Guide (GTAG): Auditing Cloud Computing; IIA Standards – Standard 2110:

Governance.

A transformational leader focuses on inspiring and motivating employees to exceed expectations,

emphasizing vision, innovation, and long-term goals rather than just rule enforcement or

performance monitoring.

Analysis of Each Option:

(A) The leader searches for deviations from the rules and standards and intervenes when deviations

exist.

Incorrect: This describes a transactional leader, who focuses on correcting errors and enforcing rules

rather than inspiring employees.

(B) The leader intervenes only when performance standards are not met.

Incorrect: This describes a passive transactional leader, who waits for issues before taking action.

(C) The leader intervenes to communicate high expectations. (Correct Answer)

Transformational leaders set high expectations, inspire employees to achieve them, and foster a

culture of continuous improvement.

IIA Standard 2110 – Governance highlights the importance of leadership in driving organizational

performance.

Transformational leadership aligns with COSO’s principles of strong governance and strategic vision.

(D) The leader does not intervene to promote problem-solving.

Incorrect: A transformational leader actively promotes problem-solving by encouraging innovation

and continuous improvement.

IIA Reference Supporting the Answer:

IIA Standard 2110 – Governance: Recognizes leadership's role in fostering a strong ethical and

performance-driven culture.

COSO ERM – Governance and Culture: Highlights leadership’s role in shaping strategic direction.

Thus, the correct answer is (C) because a transformational leader inspires employees by setting high

expectations and motivating them to achieve organizational goals.

The Define, Measure, Analyze, Improve, and Control (DMAIC) methodology is the core framework of

Six Sigma, a data-driven process improvement approach that aims to reduce defects, enhance

efficiency, and optimize performance.

Analysis of Answer Choices:

(A) Correct – Six Sigma.

DMAIC is a structured Six Sigma methodology used for problem-solving and process improvement.

It helps organizations identify inefficiencies, eliminate errors, and standardize processes.

(B) Incorrect – Quality circle.

A quality circle is a group of employees who meet to discuss and resolve work-related issues, but it

does not follow the structured DMAIC approach.

(C) Incorrect – Value chain analysis.

Value chain analysis focuses on evaluating business activities to improve competitive advantage, not

structured process improvement like Six Sigma.

(D) Incorrect – Theory of constraints.

The Theory of Constraints (TOC) focuses on identifying and eliminating bottlenecks in processes, but

it does not use the DMAIC approach.

IIA Reference and Internal Auditing Standards:

IIA’s Global Internal Audit Standards – Process Improvement and Risk Management

Emphasizes methodologies like Six Sigma for operational efficiency.

COSO’s ERM Framework – Continuous Improvement and Quality Management

Discusses the role of Six Sigma in improving processes and reducing risks.

IIA’s Guide on Business Process Auditing

Recommends structured approaches such as Six Sigma for evaluating process efficiency.

System software controls refer to security measures and protocols that protect an organization's IT

infrastructure from unauthorized access, cyber threats, and system failures. Intrusion testing

(penetration testing) is a key system software control used to detect vulnerabilities in IT

environments.

Correct Answer (D - Performing Intrusion Testing on a Regular Basis)

Intrusion testing is a critical system software security measure that helps identify weaknesses in

software configurations and security defenses.

This falls under system software controls because it directly tests the security of operating systems,

applications, and network software.

The IIA’s GTAG 11: Developing IT Security Audits highlights penetration testing as a necessary control

for system software security.

Why Other Options Are Incorrect:

Option A (Restricting server room access to specific individuals):

This is a physical access control, not a system software control.

Option B (Housing servers away from environmental hazards):

This is an environmental control, focusing on disaster prevention rather than software security.

Option C (Ensuring that all user requirements are documented):

This relates to project documentation and system development, but it does not control software

security.

IIA Reference for Validation:

IIA GTAG 11: Developing IT Security Audits – Recommends regular penetration testing as a system

software control.

IIA Practice Guide: Auditing IT Security – Discusses system software security measures.

Thus, D is the correct answer because intrusion testing is a core system software control ensuring

security.

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and

maintained by end-users (not IT) that are critical to financial reporting, decision-making, or

regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the

complexity, significance, and control environment of such applications.

Analysis of Each Option:

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources,

reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements

and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize

assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial

systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

IIA Reference Supporting the Answer:

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial

impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and

operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-

developed applications.

Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA

guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial

misstatements.

The internal rate of return (IRR) is a measure used to evaluate the profitability of an investment. The

project is considered acceptable if its IRR is greater than or equal to the required rate of return (RRR),

which is the minimum return an organization expects from an investment.

Step-by-Step

Correct Answer (C - Compare to the Required Rate of Return)

The required rate of return (RRR) represents the minimum acceptable return for the project.

If IRR ≥ RRR, the project is acceptable. If IRR < RRR, the project is rejected.

The IIA Practice Guide: Auditing Capital Investments suggests comparing IRR to the RRR to ensure

financial feasibility.

Why Other Options Are Incorrect:

Option A (Compare to the annual cost of capital):

The cost of capital (WACC - Weighted Average Cost of Capital) is an important factor, but RRR is the

direct benchmark for IRR comparison.

Option B (Compare to the annual interest rate):

Interest rates do not determine project feasibility—they only affect financing costs.

Option D (Compare to the net present value - NPV):

NPV and IRR are related, but they serve different purposes.

IRR is compared against RRR, while NPV measures absolute profitability in dollar terms.

IIA Reference for Validation:

IIA Practice Guide: Auditing Capital Investments – Discusses IRR, RRR, and investment decision-

making.

IIA GTAG 3: Business Case Development – Explains how financial metrics like IRR and RRR are used in

decision-making.

Thus, C is the correct answer because IRR should be compared to the required rate of return to

determine project acceptability.