IIA-CIA-Part3 IIA Exam Lab Questions

The CAE’s first step when a project manager accepts a risk that appears significant is to discuss and communicate the risk with senior management. If management agrees with the project manager, and the CAE still considers the risk unacceptable, then it must be escalated to the board.

Option A (employee education) is outside audit’s role. Option B is premature—escalation to the board happens only if management does not resolve the issue. Option D is not within internal audit’s authority.

Comprehensive and Detailed In-Depth Explanation:

A decentralized organizational structure distributes decision-making authority across multiple levels. This requires a strong organizational culture to guide decision-making in the absence of centralized control.

Option B (Clear expectations) – While true, this applies to both centralized and decentralized structures.

Option C (Electronic monitoring) – More common in centralized control environments.

Option D (Defined code of behavior) – Found in all organizations, not unique to decentralization.

Since decentralized organizations rely more on cultural alignment, Option A is correct.

The restructuring moves work from centralized functional silos into regional groups that perform the full service cycle: receiving orders, scheduling work, and responding to service problems. This type of structure can improve workflow because related activities are coordinated within the same regional unit, reducing handoffs, delays, communication gaps, and fragmented accountability. Option A is not necessarily true because decentralization may weaken controls if policies and oversight are inconsistent across regions. Option B is incorrect because economies of scale are usually stronger in centralized structures. Option D is also incorrect because the change reduces specialization by combining multiple functions within each regional group. From an internal audit perspective, the key benefit is process flow improvement, while the audit risk is inconsistent regional execution. Therefore, Option C is correct.