IIA-CIA-Part3 Exam Questions Tutorials

When deciding whether to sell a product as-is or process it further, a manufacturer should consider only relevant costs—those that will change based on the decision.

Why Option A (Incremental processing costs, incremental revenue, and variable manufacturing expenses) is Correct:

Incremental processing costs: These are additional costs required to process the material further, making them directly relevant.

Incremental revenue: The additional revenue that would be generated if the product is processed further is a key factor in decision-making.

Variable manufacturing expenses: These costs change with production levels, making them important in the decision-making process.

Why Other Options Are Incorrect:

Option B (Joint costs, incremental processing costs, and variable manufacturing expenses):

Incorrect because joint costs (costs incurred before the split-off point) are sunk costs and are not relevant in the decision.

Option C (Incremental revenue, joint costs, and incremental processing costs):

Incorrect because, again, joint costs are not relevant to the decision.

Option D (Variable manufacturing expenses, incremental revenue, and joint costs):

Incorrect because joint costs should be ignored in a sell-or-process-further decision.

IIA GTAG – "Auditing Cost Accounting Decisions": Discusses relevant costs in decision-making.

IFRS & GAAP Cost Accounting Standards: Explain cost classification and decision-making.

COSO Internal Control – Integrated Framework: Recommends proper cost allocation methods for financial decisions.

IIA References:

Understanding Data Recovery and Security Risks:

Data must be protected, recoverable, and accessible when needed while maintaining security.

The best practice is to store encrypted backups offsite while keeping encryption keys separate but accessible.

Why Option D is Correct?

Storing encrypted data offsite (a few hours away) ensures protection against disasters (e.g., fire, cyberattacks, physical damage).

Keeping encryption keys at the organization ensures that recovery is quick and controlled without risking unauthorized access.

This aligns with the IIA's IT Audit Practices and ISO 27001 (Information Security Management), which emphasize separate storage of encrypted data and encryption keys for security and recoverability.

IIA Standard 2110 – Governance requires internal auditors to assess whether IT governance ensures the availability and security of critical data.

Why Other Options Are Incorrect?

Option A (Encrypted physical copies and keys stored together at the organization):

If both data and keys are in the same location, a disaster or breach would make recovery impossible.

Option B (Encrypted copies and keys stored in separate locations far away):

While secure, if encryption keys are stored too far, recovery could be delayed, impacting business continuity.

Option C (Encrypted usage reports in a cloud database):

This does not ensure full data recovery; it only provides logs and structure changes, not the actual data.

Storing encrypted data offsite while keeping encryption keys accessible onsite follows best IT security and disaster recovery practices.

IIA Standard 2110 supports evaluating IT governance, including data security and recovery controls.

Final Justification:IIA References:

IPPF Standard 2110 – Governance

ISO 27001 – Information Security Management

NIST SP 800-34 – Contingency Planning Guide for IT Systems

COBIT Framework – Data Security & Recovery Controls

Access control is about ensuring that only authorized individuals can access specific data, based on their role and necessity. The Principle of Least Privilege (PoLP) dictates that users should only have access to the data they need for their job.

Minimizes Unauthorized Access Risks – Prevents employees from accessing sensitive data unnecessarily.

Supports Segregation of Duties (SoD) – Critical in preventing fraud and security breaches.

Enhances Compliance – Meets regulatory requirements like GDPR, PCI-DSS, and SOX, which demand strict access controls.

Strengthens System Security – Reduces potential damage from malware, insider threats, or data breaches.

A. Install and update anti-virus software – Important for cybersecurity but does not directly control user access.

B. Implement data encryption techniques – Protects stored or transmitted data but does not define access rights.

D. Upgrade firewall configuration – Controls network traffic, not user-specific access within an automated system.

IIA’s GTAG on Access Management and Controls – Recommends setting data access based on user needs to prevent fraud and misuse.

COBIT 2019 (Governance and Management of Enterprise IT) – Advocates for role-based access controls.

ISO 27001 Annex A.9 (Access Control) – Stresses the importance of restricting access based on business requirements.

Why Setting Data Availability by User Need is the Best Strategy?Why Not the Other Options?IIA References:✅ Final Answer: C. Set data availability by user need.

A hot recovery plan (hot site) is a fully operational, duplicate site that is pre-configured and ready for immediate use in case of a disaster. This approach allows an organization to recover critical operations quickly with minimal downtime.

(A) Cold recovery plan.

Incorrect: A cold site is a facility that has infrastructure but no active IT systems or data until set up after a disaster, resulting in longer recovery times.

(B) Outsourced recovery plan.

Incorrect: Outsourcing recovery refers to third-party disaster recovery services, but does not specifically describe a fully operational duplicate site.

(C) Storage area network recovery plan.

Incorrect: A storage area network (SAN) recovery plan focuses on data storage redundancy, not a fully operational duplicate facility.

(D) Hot recovery plan. (Correct Answer)

A hot site is the fastest and most effective disaster recovery solution, ensuring immediate failover with minimal downtime.

IIA GTAG 10 – Business Continuity Management highlights hot sites as the most effective for mission-critical operations.

IIA GTAG 10 – Business Continuity Management: Recommends hot sites for critical recovery scenarios.

IIA Standard 2120 – Risk Management: Emphasizes preparedness for disaster recovery planning.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) Hot recovery plan, as it ensures a fully operational backup site for immediate disaster recovery.