CIA IIA-CIA-Part3 Exam Questions and Answers PDF

Database administrators (DBAs) have privileged access, meaning they can make unauthorized or hidden changes to data, database structures, and security settings without detection. This presents a high risk of fraud, data manipulation, and security breaches.

A. The risk that database administrators will disagree with temporarily preventing user access to the database for auditing purposes. (Incorrect)

While resistance from DBAs during an audit can be a challenge, it is not a significant risk compared to the ability to manipulate data unnoticed.

B. The risk that database administrators do not receive new patches from vendors that support database software in a timely fashion. (Incorrect)

Patch management is a security concern but does not directly relate to the unique risk of DBAs abusing privileged access.

C. The risk that database administrators set up personalized accounts for themselves, making the audit time-consuming. (Incorrect)

While personal accounts can complicate audits, the greater risk is that DBAs can make changes without detection.

IIA GTAG 4 – Management of IT Auditing emphasizes the need for controls over privileged access to prevent unauthorized database modifications.

IIA Standard 2110 – Governance requires internal auditors to assess risks related to IT governance and privileged access management.

IIA GTAG 8 – Auditing Application Controls highlights that auditors must review DBA activity logs and ensure segregation of duties.

Explanation of Answer Choices:IIA References:Thus, the correct answer is D. The risk that database administrators could make hidden changes using privileged access.

Incremental costs are the most relevant costs when deciding whether to manufacture a new product because they represent the additional costs that will be incurred if the decision is accepted. Management should compare incremental revenues with incremental costs to determine whether producing high-quality backpacks adds value. Fixed costs may be irrelevant if they will not change as a result of the decision. Variable costs are important, but only the additional variable costs caused by the new product matter. Conversion costs include labor and overhead, but they are not necessarily the full relevant cost set. Internal auditors reviewing decision analysis should ensure management excludes sunk costs and includes only future costs that differ between alternatives. Therefore, Option D is correct.

Bonds are debt instruments through which an organization borrows money from investors. In a typical bond arrangement, the issuer pays periodic interest to bondholders and repays the principal, or face value, at maturity. Bondholders generally do not receive voting rights or corporate control; they are creditors, not owners. Debenture bonds are unsecured bonds backed by the issuer’s general creditworthiness, so Option D is incorrect. Organizations with strong credit ratings often issue debentures because investors are willing to lend without specific collateral, making Option B incorrect. Internal auditors reviewing financing should understand bond terms, interest obligations, maturity, covenants, collateral, and financial statement classification. Therefore, Option C is correct.