IIA IIA-CIA-PART3 Online Practice Questions and Exam Preparation

IIA IIA-CIA-PART3 Online Questions & Answers

• Question 1141:

  Firm X is considering entry into an industry. To analyze competition within the industry, Firm X evaluated its strategic groups. According to Michael E. Porter,

  A. The members of a strategic group pursue different competitive strategies.
  B. Intergroup competition is increased by market interdependence.
  C. Low barriers to mobility among strategic groups promote profitability.
  D. High substitutability of products reduces competition among groups.
  B. Intergroup competition is increased by market interdependence.

  ---

  Explanation

  Intergroup competition is increased by market interdependence, which is the extent to which groups pursue the same customers. The greater the interdependence, the stronger the competition among groups.

• Question 1142:

  Which of the following statements is true regarding the "management-by-objectives" method?

  A. Management by objectives is most helpful in organizations that have rapid changes.
  B. Management by objectives is most helpful in mechanistic organizations with rigidly defined tasks.
  C. Management by objectives helps organizations to keep employees motivated.
  D. Management by objectives helps organizations to distinguish clearly strategic goals from operational goals.
  C. Management by objectives helps organizations to keep employees motivated.

  ---

  Explanation

  https://www.investopedia.com/terms/m/management-by-objectives.asp

• Question 1143:

  Steps in a negotiation include clarifying interests, identifying options, designing alternative deal packages, selecting a deal, and perfecting the deal. The type of negotiation described is:

  A. Two-party.
  B. Three-party.
  C. Added-value.
  D. Ineffective.
  C. Added-value.

  ---

  Explanation

  In added value negotiating, the two sides make multiple deals to "add value" to the process. Clarifying interests, identifying options, designing alternative deal packages, selecting a deal, and perfecting a deal are all steps in added-value negotiating.

• Question 1144:

  An internal auditor reviews consolidated nancial statements for a group of organizations. Which of the following risks should the auditor consider?

  A. The statements may conceal poor performance of a subsidiary within the group.
  B. The statements will not reflect business areas under common control.
  C. The statements will not indicate total wealth controlled by the parent company.
  D. The statements may be misleading due to inclusion of transactions between members of the group.
  A. The statements may conceal poor performance of a subsidiary within the group.

  ---

  Explanation

• Question 1145:

  While conducting field work, a strong conflict arises between two of your subordinates regarding possible scope expansion. You draw their attention to their shared views, downplaying the issues of contention. This technique for resolving conflict is called:

  A. Super ordinate goals.
  B. Smoothing.
  C. Problem solving.
  D. Compromise.
  B. Smoothing.

  ---

  Explanation

  Smoothing is a conflict resolution technique in which differences are deemphasized and common interests of the parties are emphasized. It has the disadvantage of not solving the underlying problems that created the conflict.

• Question 1146:

  Which of the following disaster recovery plans includes recovery resources available at the site, but they may need to be configured to support the production system?

  A. Warm site recovery plan
  B. Hot site recovery plan
  C. Cool site recovery plan
  D. Cold site recovery plan
  A. Warm site recovery plan

  ---

  Explanation

• Question 1147:

  With regard to disaster recovery planning, which of the following would most likely involve stakeholders from several departments?

  A. Determining the frequency with which backups will be performed.
  B. Prioritizing the order in which business systems would be restored.
  C. Assigning who in the IT department would be involved in the recovery procedures.
  D. Assessing the resources needed to meet the data recovery objectives.
  B. Prioritizing the order in which business systems would be restored.

  ---

  Explanation

• Question 1148:

  An organization prepares a statement of privacy to protect customers' personal information. Which of the following might violate the privacy principles?

  A. Customers can access and update personal information when needed.
  B. The organization retains customers' personal information indefinitely.
  C. Customers reserve the right to reject sharing personal information with third parties.
  D. The organization performs regular maintenance on customers' personal information.
  B. The organization retains customers' personal information indefinitely.

  ---

  Explanation

  Organizations must comply with privacy principles that emphasize data retention limitations. Keeping personal data indefinitely violates privacy laws and regulations such as the General Data Protection Regulation (GDPR) and California

  Consumer Privacy Act (CCPA) .

  Privacy Regulations Require Data Minimization:

  GDPR Article 5(1)(e) states that personal data should only be kept for as long as necessary for the intended purpose.

  IIA GTAG 4: Management of IT Auditing also advises against excessive data retention.

  Security and Risk Concerns:

  Storing data indefinitely increases the risk of data breaches.

  IIA Standard 2110 - Governance emphasizes the need for proper information security governance to protect personal data.

  Legal and Compliance Issues:

  Organizations are required to define retention policies to prevent unauthorized or unnecessary storage of personal data.

  Option A: Customers can access and update personal information when needed. (Incorrect)

  Reason: Allowing customers to access and update their information aligns with privacy principles such as data accuracy and transparency .

  Option C: Customers reserve the right to reject sharing personal information with third parties. (Incorrect)

  Reason: This supports data control rights , which is consistent with privacy standards like opt- in and opt-out policies .

  Option D: The organization performs regular maintenance on customers' personal information. (Incorrect)

  Reason: Regular maintenance (e.g., updates, corrections, deletions) enhances data accuracy and security , aligning with privacy best practices.

  IIA Global Technology Audit Guide (GTAG) 4: Management of IT Auditing - Discusses data privacy principles.

  IIA Standard 2110 - Governance - Ensures data security and regulatory compliance.

  IIA GTAG 8: Auditing Application Controls - Covers data retention policies and privacy compliance.

  Privacy Regulations: GDPR (Article 5), CCPA (Section 1798.105) - Require organizations to delete data once it is no longer needed.

  Why is Indefinite Retention a Violation? Analysis of Incorrect Answers:IIA References:Thus, the correct answer is B. The organization retains customers' personal information indefinitely.

• Question 1149:

  Which of the following statements is true regarding the roles and responsibilities associated with a corporate social responsibility (CSR) program?

  A. The board has overall responsibility for the internal control processes associated with the CSR program.
  B. Management has overall responsibility for the effectiveness of governance, risk management, and internal control processes associated with the CSR program.
  C. The internal audit activity is responsible for ensuring that CSR principles are integrated into the organization's policies and procedures.
  D. Every employee has a responsibility for ensuring the success of the organization's CSR objectives.
  D. Every employee has a responsibility for ensuring the success of the organization's CSR objectives.

  ---

  Explanation

• Question 1150:

  Senior management has decided to implement the Three Lines of Defense model for risk management. Which of the following best describes senior management's duties with regard to this model?

  A. Ensure compliance with the model.
  B. Identify management functions.
  C. Identify emerging issues.
  D. Set goals for implementation.
  A. Ensure compliance with the model.

  ---

  Explanation