CIA IIA-CIA-Part3 Full Course Free

Internal auditors may advise management about outsourcing risks and typical controls without impairing independence, provided they do not assume management responsibility. However, controls provided by the service provider alone may be insufficient to protect the organization. Management must also establish internal oversight, contract monitoring, review of service organization reports, data protection requirements, access controls, issue escalation, and right-to-audit provisions. Option A is incorrect because recommending controls in an advisory capacity does not automatically compromise independence. Option B is also incorrect if internal audit remains advisory and management makes decisions. Option C would be inappropriate if internal audit takes responsibility for ensuring controls operate. Therefore, Option D is the most accurate statement.

The waterfall systems development approach follows a sequential structure in which one phase is substantially completed before the next begins. The expected flow is requirements definition, design, analysis or detailed specification, program design, coding, testing, and operation or maintenance. Among the available options, Option C presents the best sequence because it places requirements first, coding after design work, testing after coding, and operations last. Options A and D start with or place coding too early. Option B incorrectly places testing before coding. Internal audit should evaluate whether development projects have approved requirements, documented design, controlled coding, independent testing, user acceptance, and implementation approval. Therefore, Option C is the best answer from the options provided.

A lump-sum contract (also known as a fixed-price contract) is a contract type where the vendor agrees to complete a project for a predetermined price. In this scenario, the organization agreed to pay the vendor $3,000,000 to design, procure, and construct a power substation.

Lump-Sum Contract (Correct Answer: B)

A lump-sum contract (also called a fixed-price contract) is an agreement where the contractor is responsible for completing the entire project at a set price.

This type of contract transfers cost risk to the contractor since they must manage expenses within the agreed budget.

IIA Standard 2120 – Risk Management states that internal auditors should assess contract risks, including financial and performance risks in vendor contracts.

The contract price is predefined, which aligns with the scenario given in the question.

Why the Other Options Are Incorrect:

A. Cost-Reimbursable Contract (Incorrect)

A cost-reimbursable contract involves reimbursing the vendor for actual costs incurred, plus a fee or profit.

This is not applicable because the contract specifies a fixed price.

C. Time and Material Contract (Incorrect)

This contract type is based on actual time spent and materials used, typically used when scope is uncertain.

The given scenario clearly defines the project and budget, making this option unsuitable.

D. Bilateral Contract (Incorrect)

A bilateral contract refers to a mutual agreement between two parties where both have obligations.

While most contracts are bilateral in nature, this is not a specific contract type like lump-sum or cost-reimbursable contracts.

IIA Standard 2120 – Risk Management (Evaluating contract risks)

IIA Standard 2210 – Engagement Objectives (Assessing vendor contracts)

IIA Standard 2130 – Compliance (Ensuring contract compliance)

Step-by-Step Justification:IIA References for This Answer:Thus, the correct answer is B. A lump-sum contract because the contract is based on a predefined, fixed price of $3,000,000.

The auditor should not simply accept management’s comfort with the risk when data analytics show an unusual controlled-drug pattern. The appropriate next step is to investigate further by obtaining pharmacy policies, procedures, prescription reports, dispensing records, exception reports, and control documentation. Option A is premature because management’s belief does not provide sufficient evidence. Option B may be useful if data reliability is doubtful, but the question does not indicate the analysis was unreliable. Option D delays needed follow-up and may leave a serious compliance or diversion risk unaddressed. Internal audit should use data anomalies to focus risk assessment and obtain sufficient evidence before concluding whether controls are adequate. Therefore, Option C is correct.