Free Access IIA IIA-CIA-Part3 New Release

Manufacturing costs are classified into three main categories: direct materials, direct labor, and manufacturing overhead. These categories help organizations determine product costs, pricing strategies, and financial reporting.

Why Option B (Overhead costs, direct labor, direct materials) is Correct:

Direct materials: Raw materials used directly in production (e.g., wood for furniture).

Direct labor: Labor costs directly tied to production (e.g., factory workers assembling a product).

Manufacturing overhead: Indirect costs related to production (e.g., depreciation, factory utilities, maintenance).

These categories align with GAAP, IFRS, and cost accounting standards.

Why Other Options Are Incorrect:

Option A (Direct materials, indirect materials, raw materials):

"Indirect materials" and "raw materials" are part of manufacturing overhead and direct materials, respectively, but do not form a primary cost classification.

Option C (Direct materials, direct labor, depreciation on factory buildings):

Depreciation on factory buildings is an overhead cost, not a separate category.

Option D (Raw materials, factory employees' wages, production selling expenses):

Selling expenses are not part of manufacturing costs; they are part of operating expenses.

IIA Practice Guide – Auditing Cost Management: Defines manufacturing cost classifications.

IFRS & GAAP Cost Accounting Standards: Outline manufacturing cost components.

COSO Framework – Cost Control Guidelines: Emphasizes accurate cost allocation in financial reporting.

IIA References:

Definition of Rooting:

Rooting (on Android) or Jailbreaking (on iOS) is the process of bypassing manufacturer and administrative security controls on a smart device.

This allows users to gain full control (root access) over the operating system, which can override security restrictions and allow installation of unauthorized applications.

How Rooting Increases Data Security Risks:

Bypassing Security Measures: Rooting removes built-in security protections, making the device more vulnerable to malware, unauthorized access, and data breaches.

Exposure to Malicious Apps: Rooted devices can install third-party applications that are not vetted by official app stores, increasing the risk of data theft, spyware, and ransomware attacks.

Circumventing Enterprise Security Policies: Many organizations use Mobile Device Management (MDM) to enforce security policies, but rooted devices can bypass these controls, exposing corporate data to cyber threats.

Increased Risk of Privilege Escalation Attacks: Attackers can exploit root access to take full control of the device, leading to unauthorized access to sensitive information.

IIA’s Perspective on Cybersecurity Risks:

IIA Standard 2110 – Governance emphasizes the importance of protecting sensitive data and ensuring compliance with IT security policies.

IIA’s GTAG (Global Technology Audit Guide) on Information Security warns against the dangers of rooted or jailbroken devices, as they compromise cybersecurity defenses.

NIST Cybersecurity Framework and ISO 27001 Information Security Standards identify unauthorized modifications to devices as a critical security risk.

Eliminating Incorrect Options:

B. Eavesdropping: This refers to intercepting communications (e.g., listening in on phone calls or network traffic) but does not involve circumventing administrative restrictions.

C. Man-in-the-Middle (MITM) Attack: This is an attack where an attacker intercepts and alters communication between two parties but does not involve rooting a device.

D. Session Hijacking: This attack involves stealing session tokens to impersonate a user but is unrelated to bypassing security controls on devices.

IIA References:

IIA Standard 2110 – Governance and IT Security

IIA GTAG – Information Security Risks

NIST Cybersecurity Framework

ISO 27001 Information Security Standards

Understanding Project Cost Overruns and Controls

Cost overruns occur when actual project costs exceed the budgeted or planned costs. Effective controls are required to prevent, detect, and correct deviations from the cost baseline.

The most effective way to control cost overruns is through continuous monitoring and comparison of project costs against the approved cost baseline.

Why Option D is Correct?

A formal process to monitor the project status and compare it to the cost baseline ensures that deviations are identified early and corrective actions are taken.

This aligns with the IIA's International Standards for the Professional Practice of Internal Auditing (IPPF), specifically:

Standard 2120 – Risk Management: Internal auditors must evaluate how organizations manage risks, including financial risks related to project cost overruns.

Standard 2500 – Monitoring Progress: Ensures that corrective actions are implemented when issues arise.

IIA Practice Advisory 2130-1: Stresses the importance of monitoring activities to mitigate financial risks.

The Project Management Body of Knowledge (PMBOK) also supports cost monitoring as a key control to prevent overruns.

Why Other Options Are Incorrect?

Option A: Reviewing and approving scope change requests is important, but it does not directly monitor or control cost overruns. Scope creep is a risk, but cost monitoring is a more direct control.

Option B: Having a control committee review overruns after they occur is a reactive measure. Proactive monitoring (option D) is more effective.

Option C: A quality assurance process for scope changes is valuable but does not directly prevent cost overruns. It focuses on project quality rather than financial control.

Effective internal controls for cost management emphasize real-time monitoring and comparison against the cost baseline to prevent and mitigate cost overruns.

IIA Standards 2120, 2500, and 2130-1 support proactive risk management and monitoring as essential best practices for internal auditors.

Final Justification:IIA References:

IPPF Standard 2120 – Risk Management

IPPF Standard 2500 – Monitoring Progress

IIA Practice Advisory 2130-1 – Internal Control and Risk Management

PMBOK – Cost Monitoring and Control

c

A Value-Added Network (VAN) is a third-party network service that securely connects an organization with its trading partners, facilitating secure electronic data interchange (EDI) and business communications.

(A) Value-added network (VAN). (Correct Answer)

A VAN is a private, managed network service that provides secure data transmission between business partners.

It is commonly used for B2B transactions, supply chain management, and EDI.

IIA GTAG 7 – IT Outsourcing recognizes VANs as critical third-party networks for secure business data exchange.

(B) Local area network (LAN).

Incorrect: A LAN connects computers within a limited area (e.g., an office or building), but it is not designed for external trading partner connections.

(C) Metropolitan area network (MAN).

Incorrect: A MAN covers a city or region, but it is not designed for B2B communication.

(D) Wide area network (WAN).

Incorrect: A WAN connects multiple geographic locations, but it is a general networking term, not specific to trading partner communications.

IIA GTAG 7 – IT Outsourcing: Discusses the use of third-party networks like VANs for secure data exchange.

IIA Standard 2110 – Governance: Recommends secure third-party integration for business continuity and security.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (A) Value-Added Network (VAN) because it is specifically designed for secure communication between an organization and its trading partners.