Free IIA-CIA-Part3 Practice Test Questions and Answers (2026)

In organizations, authority types define how power and influence are exercised. Since the technician

is prioritizing projects, their authority comes from their specialized knowledge or expertise, making

this an example of expert authority.

Why Option D (Expert Authority) is Correct:

Expert authority is based on specialized knowledge, skills, or expertise rather than formal position or

hierarchical power.

The technician is trusted to prioritize projects because of their technical knowledge and

understanding of project impact.

Expert authority is commonly seen in IT specialists, consultants, and industry professionals who

guide decision-making based on expertise.

Why Other Options Are Incorrect:

Option A (Legitimate Authority):

Incorrect because legitimate authority is derived from a formal position or title within an

organizational hierarchy (e.g., CEO, manager).

Option B (Coercive Authority):

Incorrect because coercive authority relies on threats, punishment, or force, which is not applicable

in this scenario.

Option C (Referent Authority):

Incorrect because referent authority is based on personal influence, charisma, or relationships,

rather than expertise.

IIA Reference:

IIA Practice Guide – "Auditing Organizational Governance": Discusses different types of authority in

decision-making.

COSO ERM Framework – "Risk Governance & Decision-Making": Recognizes expert authority as a key

factor in risk-based project prioritization.

IIA’s GTAG – "Auditing IT Governance": Highlights the role of expert authority in IT project

prioritization and governance.

The discussion between the internal auditor and the database administrator is most likely centered

around the security risk present in the period between account creation and password change. When

a system generates a default password such as "123456," it introduces a temporary vulnerability until

the user changes it.

Step-by-Step Analysis:

Understanding Default Password Security Risks:

Default passwords, especially predictable ones (e.g., "123456"), pose a security threat because they

are easy to guess.

If an unauthorized user gains access before the legitimate user changes the password, data

confidentiality and integrity may be compromised (IIA GTAG - Global Technology Audit Guide).

Evaluating the Window of Exposure:

The primary concern is the time between account creation and password reset.

During this time, an attacker could exploit the default password to gain unauthorized access to

sensitive systems.

Why Other Options Are Less Relevant:

Option A (Replacing numbers with characters) – While this improves security, it does not directly

address the risk of an attacker exploiting the default password before the user resets it.

Option B (Users continuing to use the initial password) – This is a security issue, but it is mitigated by

requiring a password reset upon first login. The primary concern is the time before the reset

happens.

Option D (User training on password management) – While training is crucial for long-term security,

it does not directly address the immediate vulnerability of default passwords before they are

changed.

Relevant IIA Reference:

IIA Global Technology Audit Guide (GTAG) 16: Data Management and Security

IIA Standard 2110 – Governance: Recommends addressing IT security risks, including credential

management.

IIA Practice Advisory 2130.A1-1: Internal auditors should assess whether management has identified,

assessed, and mitigated IT security risks, such as weak authentication practices.

Understanding the Contracting Process Phases

The contracting process generally follows these phases:

Initiation Phase: Identifies the need for a contract and sets initial objectives.

Bidding Phase: Potential vendors or partners submit proposals, and negotiations begin.

Development Phase: Contracts are drafted, negotiated, and finalized before execution.

Management Phase: The contract is executed, monitored, and evaluated for compliance.

Why Option C is Correct?

The development phase is where contracts are formally drafted based on agreements made during

bidding and negotiation.

This phase includes legal review, compliance verification, and risk assessment, ensuring the contract

aligns with business objectives and legal requirements.

IIA Standard 2110 – Governance requires auditors to assess how contract risks are managed,

ensuring formal contract development processes.

Why Other Options Are Incorrect?

Option A (Initiation phase):

This phase defines the business need but does not involve drafting contracts.

Option B (Bidding phase):

In this phase, businesses solicit proposals, but contracts are not fully drafted until vendor selection.

Option D (Management phase):

The management phase involves executing and monitoring the contract, not drafting it.

Final Justification:

Contracts are drafted during the development phase after vendor selection and before execution.

IIA Standard 2110 supports governance over contract risk and formal agreement processes.

IIA Reference:

IPPF Standard 2110 – Governance (Contract Risk & Compliance)

COSO ERM – Risk Management in Contracting

A systems development methodology refers to a structured approach used in software development

and systems engineering to guide the design, development, and implementation of software

applications.

Why Option A (Waterfall) is Correct:

Waterfall methodology is a linear and sequential systems development methodology where each

phase (e.g., requirements, design, implementation, testing, deployment) must be completed before

moving to the next.

It is widely established and historically one of the first software development methodologies.

Used in large-scale enterprise projects where detailed planning and structured execution are

required.

Why Other Options Are Incorrect:

Option B (PRINCE2 - Projects in Controlled Environments):

Incorrect because PRINCE2 is a project management framework, not a systems development

methodology.

Option C (ITIL - Information Technology Infrastructure Library):

Incorrect because ITIL is a set of IT service management (ITSM) best practices, not a software

development methodology.

Option D (COBIT - Control Objectives for Information and Related Technologies):

Incorrect because COBIT is a governance framework for IT management and controls, not a

development methodology.

IIA Reference:

IIA GTAG – "Auditing IT Projects and Systems Development": Highlights Waterfall as a traditional

systems development methodology.

IIA’s Global Technology Audit Guide on IT Risks: Discusses software development lifecycle risks,

including Waterfall methodology.

COBIT Framework – BAI03 (Manage Solutions Identification and Build): Reference structured

methodologies like Waterfall in IT governance.

Cloud-based applications accessible outside the VPN perimeter increase the possibility of data

leakage through unapproved or unsecured applications (shadow IT). Even with multi-factor

authentication, risks remain around the use of personal devices and uncontrolled storage or sharing.

Option B is incorrect because VPNs are generally secure if configured correctly. Option C is

misleading, as remote access controls can be effective in cloud solutions when properly designed.

Option D (employees accessing emails after hours) is not a risk related to security but rather a work-

life balance issue.

Thus, the key risk is potential leakage of organizational data via unapproved or uncontrolled

applications (Option A).

Reference:

IIA Global Technology Audit Guide (GTAG): Auditing Cloud Computing; IIA Standards – Standard 2110:

Governance.

A transformational leader focuses on inspiring and motivating employees to exceed expectations,

emphasizing vision, innovation, and long-term goals rather than just rule enforcement or

performance monitoring.

Analysis of Each Option:

(A) The leader searches for deviations from the rules and standards and intervenes when deviations

exist.

Incorrect: This describes a transactional leader, who focuses on correcting errors and enforcing rules

rather than inspiring employees.

(B) The leader intervenes only when performance standards are not met.

Incorrect: This describes a passive transactional leader, who waits for issues before taking action.

(C) The leader intervenes to communicate high expectations. (Correct Answer)

Transformational leaders set high expectations, inspire employees to achieve them, and foster a

culture of continuous improvement.

IIA Standard 2110 – Governance highlights the importance of leadership in driving organizational

performance.

Transformational leadership aligns with COSO’s principles of strong governance and strategic vision.

(D) The leader does not intervene to promote problem-solving.

Incorrect: A transformational leader actively promotes problem-solving by encouraging innovation

and continuous improvement.

IIA Reference Supporting the Answer:

IIA Standard 2110 – Governance: Recognizes leadership's role in fostering a strong ethical and

performance-driven culture.

COSO ERM – Governance and Culture: Highlights leadership’s role in shaping strategic direction.

Thus, the correct answer is (C) because a transformational leader inspires employees by setting high

expectations and motivating them to achieve organizational goals.

The Define, Measure, Analyze, Improve, and Control (DMAIC) methodology is the core framework of

Six Sigma, a data-driven process improvement approach that aims to reduce defects, enhance

efficiency, and optimize performance.

Analysis of Answer Choices:

(A) Correct – Six Sigma.

DMAIC is a structured Six Sigma methodology used for problem-solving and process improvement.

It helps organizations identify inefficiencies, eliminate errors, and standardize processes.

(B) Incorrect – Quality circle.

A quality circle is a group of employees who meet to discuss and resolve work-related issues, but it

does not follow the structured DMAIC approach.

(C) Incorrect – Value chain analysis.

Value chain analysis focuses on evaluating business activities to improve competitive advantage, not

structured process improvement like Six Sigma.

(D) Incorrect – Theory of constraints.

The Theory of Constraints (TOC) focuses on identifying and eliminating bottlenecks in processes, but

it does not use the DMAIC approach.

IIA Reference and Internal Auditing Standards:

IIA’s Global Internal Audit Standards – Process Improvement and Risk Management

Emphasizes methodologies like Six Sigma for operational efficiency.

COSO’s ERM Framework – Continuous Improvement and Quality Management

Discusses the role of Six Sigma in improving processes and reducing risks.

IIA’s Guide on Business Process Auditing

Recommends structured approaches such as Six Sigma for evaluating process efficiency.

System software controls refer to security measures and protocols that protect an organization's IT

infrastructure from unauthorized access, cyber threats, and system failures. Intrusion testing

(penetration testing) is a key system software control used to detect vulnerabilities in IT

environments.

Correct Answer (D - Performing Intrusion Testing on a Regular Basis)

Intrusion testing is a critical system software security measure that helps identify weaknesses in

software configurations and security defenses.

This falls under system software controls because it directly tests the security of operating systems,

applications, and network software.

The IIA’s GTAG 11: Developing IT Security Audits highlights penetration testing as a necessary control

for system software security.

Why Other Options Are Incorrect:

Option A (Restricting server room access to specific individuals):

This is a physical access control, not a system software control.

Option B (Housing servers away from environmental hazards):

This is an environmental control, focusing on disaster prevention rather than software security.

Option C (Ensuring that all user requirements are documented):

This relates to project documentation and system development, but it does not control software

security.

IIA Reference for Validation:

IIA GTAG 11: Developing IT Security Audits – Recommends regular penetration testing as a system

software control.

IIA Practice Guide: Auditing IT Security – Discusses system software security measures.

Thus, D is the correct answer because intrusion testing is a core system software control ensuring

security.

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and

maintained by end-users (not IT) that are critical to financial reporting, decision-making, or

regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the

complexity, significance, and control environment of such applications.

Analysis of Each Option:

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources,

reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements

and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize

assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial

systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

IIA Reference Supporting the Answer:

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial

impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and

operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-

developed applications.

Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA

guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial

misstatements.

The internal rate of return (IRR) is a measure used to evaluate the profitability of an investment. The

project is considered acceptable if its IRR is greater than or equal to the required rate of return (RRR),

which is the minimum return an organization expects from an investment.

Step-by-Step

Correct Answer (C - Compare to the Required Rate of Return)

The required rate of return (RRR) represents the minimum acceptable return for the project.

If IRR ≥ RRR, the project is acceptable. If IRR < RRR, the project is rejected.

The IIA Practice Guide: Auditing Capital Investments suggests comparing IRR to the RRR to ensure

financial feasibility.

Why Other Options Are Incorrect:

Option A (Compare to the annual cost of capital):

The cost of capital (WACC - Weighted Average Cost of Capital) is an important factor, but RRR is the

direct benchmark for IRR comparison.

Option B (Compare to the annual interest rate):

Interest rates do not determine project feasibility—they only affect financing costs.

Option D (Compare to the net present value - NPV):

NPV and IRR are related, but they serve different purposes.

IRR is compared against RRR, while NPV measures absolute profitability in dollar terms.

IIA Reference for Validation:

IIA Practice Guide: Auditing Capital Investments – Discusses IRR, RRR, and investment decision-

making.

IIA GTAG 3: Business Case Development – Explains how financial metrics like IRR and RRR are used in

decision-making.

Thus, C is the correct answer because IRR should be compared to the required rate of return to

determine project acceptability.

Understanding Mobile Device Risks in an Organization:

When an organization allows third parties (vendors and visitors) to use outside smart devices to

access its proprietary networks and systems, it introduces significant compliance risks.

These risks include violations of regulatory requirements, industry standards, and internal security

policies.

Compliance Risks in Smart Device Usage:

Unauthorized Access: External users may bypass security controls, leading to data breaches or

regulatory non-compliance (e.g., GDPR, HIPAA, or PCI-DSS violations).

Lack of Encryption and Data Protection: If smart devices access sensitive information without proper

security protocols, the organization may fail to comply with industry regulations.

Failure to Enforce Mobile Device Management (MDM): Without proper policy enforcement,

organizations risk failing audits and facing penalties.

Why Other Options Are Incorrect:

B . Privacy:

Privacy concerns relate to handling personal data, but in this scenario, the focus is on third-party

access risks, which fall under compliance.

C . Strategic:

Strategic risks relate to long-term business objectives, whereas compliance risks are more immediate

and regulatory in nature.

D . Physical security:

Physical security deals with preventing unauthorized access to buildings or devices, not cybersecurity

risks from external smart devices.

IIA’s Perspective on Compliance and IT Security:

IIA Standard 2110 – Governance emphasizes the need to evaluate IT security risks, including third-

party access risks.

IIA GTAG (Global Technology Audit Guide) on IT Risks highlights compliance risks in Bring Your Own

Device (BYOD) and third-party access policies.

ISO 27001 Information Security Standard mandates controls to manage external device access risks.

IIA Reference:

IIA Standard 2110 – Governance and IT Security

IIA GTAG – IT Risks and BYOD Policies

ISO 27001 Information Security Standard

NIST Cybersecurity Framework for Mobile Device Security

Thus, the correct and verified answer is A. Compliance.

Fixed manufacturing costs refer to costs that do not vary with the level of production activity within a

relevant range. These costs include expenses such as depreciation, rent, property taxes, and salaries

of permanent employees in the production facility. Their primary purpose is to ensure the availability

and operational readiness of production facilities, regardless of fluctuations in production levels.

Breakdown of Answer Choices:

(A) Correct – To ensure availability of production facilities

Fixed manufacturing costs are incurred to maintain and operate production facilities, ensuring that

they remain functional and available for production when needed. These costs exist even if no units

are produced, emphasizing their role in sustaining the production infrastructure.

(B) Incorrect – To decrease direct expenses related to production

Fixed manufacturing costs are unrelated to direct expenses, such as raw materials and labor, which

vary with production volume. Instead, they remain constant regardless of output levels.

(C) Incorrect – To incur stable costs despite operating capacity

While fixed costs remain stable within a relevant range, their primary purpose is not just cost stability

but ensuring production facilities' availability and functionality.

(D) Incorrect – To increase the total unit cost under absorption costing

Under absorption costing, fixed manufacturing costs are allocated to units produced, affecting per-

unit cost calculations. However, this is an accounting treatment rather than the core purpose of fixed

manufacturing costs.

IIA Reference and Internal Auditing Standards:

IIA’s Global Internal Audit Standards – Managing Resources Effectively

Fixed manufacturing costs ensure operational resources are available and managed efficiently.

IIA’s Guide on Cost Management and Internal Control

Highlights the role of cost structures, including fixed costs, in ensuring business continuity.

IIA’s Practice Advisory on Cost Accounting Controls

Discusses the importance of maintaining production facilities to ensure operational readiness.

Would you like further clarification on any point?

Centralized authority refers to decision-making being concentrated at the top levels of an

organization, ensuring uniform policies and procedures across departments.

Let's analyze each option:

A . Fraud committed through collusion is more likely when authority is centralized.

Incorrect. Centralized authority reduces the chances of fraud by enforcing strict oversight and

controls. Decentralized structures may create more opportunities for fraud due to inconsistent

policies.

B . Centralized managerial authority typically enhances certainty and consistency within an

organization. ✅ (Correct Answer)

Correct. Centralized authority ensures consistent decision-making, standardized processes, and clear

policies, reducing uncertainty.

For example, in a multinational company, a centralized governance structure ensures compliance

with financial reporting standards across all subsidiaries.

C . When authority is centralized, the alignment of activities to achieve business goals typically is

decreased.

Incorrect. Centralized authority actually helps in aligning business activities toward strategic goals by

ensuring uniform direction and coordination.

D . Using separation of duties to mitigate collusion is reduced only when authority is centralized.

Incorrect. Separation of duties (SoD) is a key internal control mechanism that exists regardless of

centralization. Organizations implement SoD through policies, not just governance structures.

IIA Reference:

IIA Standard 2110 – Governance – Emphasizes the importance of clear governance structures in

organizations.

COSO Internal Control – Integrated Framework – Discusses centralization and its impact on risk

management and control effectiveness.

IIA Global Technology Audit Guide (GTAG) – Enterprise Risk Management (ERM) – Highlights the role

of centralized authority in aligning corporate strategies.

ISO 37000:2021 – Governance of Organizations – Outlines how centralized governance improves

organizational consistency and decision-making.

To maximize profit with a limited material supply of 500 kg per month, the company should prioritize

producing the product that generates the highest contribution margin per kg of material used.

Step 1: Calculate Contribution Margin Per Unit for Each Product

Since fixed costs are not relevant in this decision, we focus on the contribution margin per unit of raw

material:

Product X

Selling price per unit = $10

Material cost per unit = 2 kg × $1/kg = $2

Contribution margin per unit = $10 - $2 = $8

Contribution margin per kg = $8 ÷ 2 kg = $4 per kg

Product Y

Selling price per unit = $13

Material cost per unit = 6 kg × $1/kg = $6

Contribution margin per unit = $13 - $6 = $7

Contribution margin per kg = $7 ÷ 6 kg = $1.17 per kg

Step 2: Prioritize Product with Higher Contribution Margin Per Kg

Product X ($4 per kg) is more profitable per kg than Product Y ($1.17 per kg).

To maximize profit, produce as many units of Product X as possible first, then allocate the remaining

material to Product Y.

Step 3: Allocate Limited Material (500 kg)

First, maximize production of Product X

Each unit of Product X requires 2 kg.

Maximum units of Product X = 500 kg ÷ 2 kg per unit = 250 units.

However, demand is only 70 units, so produce 70 units of Product X.

Material used for 70 units of X = 70 × 2 kg = 140 kg.

Material remaining = 500 kg - 140 kg = 360 kg.

Use remaining material for Product Y

Each unit of Product Y requires 6 kg.

Maximum units of Product Y = 360 kg ÷ 6 kg per unit = 60 units.

Final Decision:

Produce 70 units of Product X (to meet demand).

Produce 60 units of Product Y (using the remaining material).

IIA Reference for Validation:

IIA GTAG 13: Business Performance Management – Discusses maximizing profit by prioritizing high

contribution margin products.

IIA Practice Guide: Cost Analysis for Decision-Making – Covers constraints and resource allocation for

maximizing profitability.

Thus, B (60 units) is the correct answer because it optimally allocates the 500 kg of material to

maximize profit.

Job enrichment is a motivational strategy where employees are given more control, responsibility,

and meaningful tasks in their roles. It aims to increase job satisfaction, personal growth, and

motivation by making work more engaging and fulfilling.

Let’s analyze each option:

Option A: Validation of the achievement of their goals and objectives

Incorrect.

While job enrichment may contribute to achieving personal and professional goals, its primary

purpose is not just validation but improving employee engagement and motivation.

Option B: Increased knowledge through the performance of additional tasks

Incorrect.

Job enlargement (not job enrichment) involves assigning additional tasks without necessarily

increasing responsibility or autonomy.

Job enrichment focuses on providing meaningful and challenging work, not just adding tasks.

Option C: Support for personal growth and a meaningful work experience

Correct.

Job enrichment enhances job satisfaction by giving employees greater autonomy, responsibility, and

purpose in their roles.

It encourages personal and professional development, leading to a more meaningful work

experience.

IIA Reference: Internal auditors assessing human resource and organizational performance

management focus on employee motivation strategies, including job enrichment. (IIA Practice Guide:

Talent Management and Human Capital Risks)

Option D: An increased opportunity to manage better the work done by their subordinates

Incorrect.

Job enrichment does not necessarily focus on managing subordinates but rather on enhancing

individual job roles by making them more fulfilling.

Thus, the verified answer is C. Support for personal growth and a meaningful work experience.

Effective change management ensures that IT changes (such as software updates, system

modifications, or infrastructure upgrades) are well-controlled, minimizing disruptions. Poor change

management leads to instability, inefficiencies, and operational risks.

Why 2, 3, and 4 Are Indicators of Poor Change Management?

Unplanned Downtime (2) – Indicates that changes are being implemented without proper testing or

failover planning, disrupting business operations.

Excessive Troubleshooting (3) – Suggests that changes are causing recurring issues, leading to

increased workload for IT support teams.

Unavailability of Critical Services (4) – Highlights that change-related failures are affecting essential

business functions, indicating improper risk assessment.

Why Not Option 1 (Inadequate Control Design)?

While inadequate control design is a general IT risk, it is not a direct indicator of poor change

management. Instead, it relates more to weaknesses in IT governance and security frameworks.

IIA Reference:

IIA’s GTAG (Global Technology Audit Guide) on Change Management – Identifies unplanned

downtime, excessive troubleshooting, and service unavailability as key red flags of poor change

management.

COBIT 2019 (Governance and Management of IT) – Emphasizes structured change management to

minimize disruptions.

ITIL Change Management Framework – Highlights these issues as symptoms of ineffective change

control.

✅ Final Answe r: D. 2, 3, and 4 only.

A decentralized organizational structure allows decision-making authority to be distributed across

various levels and locations, making it more flexible and adaptable to rapid changes and

uncertainties.

Step-by-Step Justification:

Why Decentralization Helps in Uncertainty?

Decentralization empowers different units or teams to make faster decisions.

It enables quick adaptation to market shifts, technological advancements, and external disruptions.

According to IIA’s Organizational Governance Guidelines, decentralized structures increase agility

and responsiveness, particularly in dynamic industries like technology and finance.

Characteristics of Decentralized Structures:

Autonomy at multiple levels – decisions are not centralized at the top.

Faster decision-making – local teams react quickly to changes.

Greater innovation and flexibility – promotes problem-solving without bureaucratic delays.

Why Not Other Options?

B . Centralized:

A centralized structure concentrates decision-making at the top, slowing down responsiveness to

changes.

C . Departmentalized:

While departmentalization organizes work efficiently, it may restrict cross-functional collaboration,

making adaptation slower.

D . Tall Structure:

Tall structures have multiple management layers, leading to bureaucracy and slower decision-

making.

IIA Reference:

IIA Practice Guide: Organizational Governance

IIA Standard 2110 – Governance and Risk Management

COBIT 2019 – Enterprise Risk and Governance Framework

Thus, the correct and verified answer is A. Decentralized.

To efficiently protect business data from corruption and errors, the best approach is proactive

detection through validation controls. Batch total calculations help verify data integrity before

approval, ensuring errors are caught early.

Analysis of Each Option:

(A) Controls to ensure data is unable to be accessed without authorization.

Incorrect: Access controls prevent unauthorized access, but they do not detect or prevent data

corruption/errors.

(B) Controls to calculate batch totals to identify an error before approval. (Correct Answer)

Batch control totals ensure that data entries match expected values before processing, helping detect

errors before approval.

IIA GTAG 3 – Continuous Auditing recommends automated validation and reconciliation checks for

data integrity.

(C) Controls to encrypt the data so that corruption is likely ineffective.

Incorrect: Encryption protects data confidentiality, but it does not prevent or detect errors or

corruption.

(D) Controls to quickly identify malicious intrusion attempts.

Incorrect: Intrusion detection systems focus on cybersecurity, not data corruption or errors.

IIA Reference Supporting the Answer:

IIA Standard 2120 – Risk Management: Recommends controls for error prevention and early

detection.

IIA GTAG 3 – Continuous Auditing: Suggests automated validation processes like batch totals to

detect errors before approval.

Thus, the correct answer is (B) because batch total calculations effectively detect errors before

approval, ensuring data integrity.

Preventive security controls proactively stop unauthorized access before it occurs. The most effective

method is strict access management, where new or additional access rights require formal validation

before being granted.

Why Approval-Based Access Control is the Best Preventive Measure?

Prevents Unauthorized Entry – Ensures that only approved personnel have access to the power plant.

Implements Segregation of Duties (SoD) – Supervisors validate access requests, reducing insider

threats.

Aligns with Least Privilege Principle – Employees get only the minimum access necessary for their

role.

Prevents Security Risks Before They Happen – Unlike detective or corrective controls, this method

stops unauthorized access before it occurs.

Why Not the Other Options?

A . Offboarding procedure (monthly review) – This is a detective control, identifying issues after

access is granted, not preventing them.

B . Smart lock anomaly scanning – Also detective, as it identifies suspicious behavior after access has

been used.

D . Automatic notifications for after-hours entry – A corrective control, responding to potential

violations instead of preventing them.

IIA Reference:

IIA’s GTAG on Identity and Access Management – Recommends pre-approval processes for sensitive

locations.

ISO 27001 Annex A.9 (Access Control) – Requires role-based access management for critical

infrastructures.

NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) – Defines supervisor

approval as a key preventive measure.

Before an external assessment of the internal audit activity, the CAE should agree with the board on

the qualifications and independence of the external assessor or assessment team. This ensures

credibility and compliance with the IIA’s Quality Assurance and Improvement Program (QAIP)

requirements.

Options A and B (specific audit areas or testing levels) are not matters for board approval in external

assessments. Option D (specialized skills) is relevant but not as essential as overall qualifications and

competence.

Reference:

IIA Standards – Standard 1312: External Assessments; Practice Advisory 1312-1.