IIA IIA-CIA-Part3 Exam With Confidence Using Practice Dumps

A risk-based internal audit plan must begin with the organization’s objectives because risks are meaningful only in relation to objectives. Internal audit needs to understand what the organization is trying to achieve before identifying events that could prevent achievement, delay achievement, or create unacceptable exposure. After objectives are understood, the audit activity can identify risks, assess their likelihood and impact, consider management’s risk responses, evaluate existing assurance coverage, and prioritize engagements. Option A is important but should follow the review of objectives. Option B is premature because controls cannot be evaluated effectively until the related objectives and risks are understood. Option C is also premature because risks cannot be prioritized before they are identified and linked to objectives. Therefore, the correct starting point for risk-based audit planning is Option D.

An ethnocentric attitude in global business means that the parent company (headquarters) makes all key decisions and expects its foreign subsidiaries to follow directives without much autonomy. This approach often results in centralized control, standardized policies, and minimal local input.

(A) Standards used for evaluation and control are determined at local subsidiaries, not set by headquarters.

Incorrect. In an ethnocentric organization, standards and controls are determined by headquarters, not by local subsidiaries.

IIA Standard 2120 – Risk Management emphasizes that corporate governance should ensure consistent policies across all locations, which aligns with ethnocentric approaches.

(B) Orders, commands, and advice are sent to the subsidiaries from headquarters. ✅

Correct. In ethnocentric organizations, decision-making authority is centralized at headquarters, and subsidiaries are expected to follow orders and policies without deviation.

IIA GTAG " Auditing Global Operations " discusses risks related to centralized control structures, where headquarters enforces policies globally.

(C) People of local nationality are developed for the best positions within their own country.

Incorrect. This describes a polycentric approach, where local talent is developed for leadership roles. Ethnocentric organizations prefer to assign expatriates from headquarters to key positions in subsidiaries.

(D) There is a significant amount of collaboration between headquarters and subsidiaries.

Incorrect. Collaboration is more common in geocentric or regiocentric models, where decision-making is shared. Ethnocentric organizations have limited collaboration, as headquarters dictates policies.

IIA GTAG – " Auditing Global Operations "

IIA Standard 2120 – Risk Management

COSO Framework – Internal Control and Corporate Governance

Analysis of Answer Choices:IIA References:Thus, the correct answer is B, as ethnocentric organizations enforce top-down control, sending orders, commands, and advice to subsidiaries.

Both hierarchical and open organizational structures require responsibility to be supported by adequate authority. Assigning responsibility without authority creates accountability failure and control weakness. Both structures also recognize that a superior may delegate tasks or authority but cannot delegate ultimate responsibility for results. Statement 1 is more characteristic of open or decentralized structures, not all hierarchical structures. Statement 2 is an outdated and rigid span-of-control rule; appropriate span depends on complexity, employee competence, technology, geography, and control needs. Internal audit should evaluate whether organizational design supports clear accountability, authority, escalation, segregation of duties, and effective oversight. The principles common to both structures are statements 3 and 4. Therefore, Option D is correct.