IIA-CIA-Part3 Leak Questions

Human resources (HR) best supports the internal audit function by facilitating candidate sourcing through recruiting platforms, networks, and agencies. This broadens the pool of qualified applicants. The CAE and audit function should retain responsibility for assessing audit-specific skills and selecting the best candidate.

Option A may be part of HR’s role but competency evaluation is more specialized for audit. Option C is administrative, not strategic. Option D improperly delegates candidate selection to HR instead of the CAE.

Comprehensive and Detailed In-Depth Explanation:

Two key management principles apply to both hierarchical and open organizational structures:

Delegation of authority, but not responsibility (Principle 1) – Managers can delegate tasks but remain accountable for outcomes.

Authority must accompany responsibility (Principle 3) – Employees must have the authority to act in accordance with their responsibilities to be effective.

Option 2 (Span of control should not exceed seven subordinates) is not a universal rule, as span of control varies by industry and organization.

Option 4 (Employees should be empowered at all levels) is more applicable to open structures but not a core principle of hierarchical organizations.

Thus, the correct answer is A (1 and 3 only).

Organizations that rely on third-party vendors for IT services must ensure secure and controlled communication, especially in areas where external connections are involved. External connections typically include:

Cloud services (e.g., SaaS, PaaS, IaaS)

Third-party APIs

Remote access (VPNs, firewalls, network gateways)

IoT devices and external sensors

These connections introduce cybersecurity risks, requiring continuous monitoring, vendor communication, and security controls.

(A) Applications.

Incorrect. While application security is important, it is typically managed internally. Vendor involvement is needed for software patches and updates, but communication is not as tightly monitored.

(B) Technical infrastructure.

Incorrect. This layer includes internal IT components like servers, databases, and networks, which are mostly managed in-house. Vendor involvement is required for hardware/software updates but not to the same extent as external connections.

(C) External connections. ✅

Correct. External connections require tightly controlled communication with vendors to prevent security breaches, unauthorized access, and data leaks.

IIA GTAG "Auditing IT Governance" highlights third-party risk management as a key area for IT audits.

IIA Standard 2110 requires organizations to establish governance structures for vendor and IT security management.

(D) IT management.

Incorrect. IT management focuses on internal oversight of IT policies and compliance, but does not necessarily require tightly controlled vendor communication.

IIA GTAG – "Auditing IT Governance"

IIA GTAG – "Managing Third-Party Risks"

IIA Standard 2110 – Governance

Analysis of Answer Choices:IIA References:

Manufacturing costs are classified into three main categories: direct materials, direct labor, and manufacturing overhead. These categories help organizations determine product costs, pricing strategies, and financial reporting.

Why Option B (Overhead costs, direct labor, direct materials) is Correct:

Direct materials: Raw materials used directly in production (e.g., wood for furniture).

Direct labor: Labor costs directly tied to production (e.g., factory workers assembling a product).

Manufacturing overhead: Indirect costs related to production (e.g., depreciation, factory utilities, maintenance).

These categories align with GAAP, IFRS, and cost accounting standards.

Why Other Options Are Incorrect:

Option A (Direct materials, indirect materials, raw materials):

"Indirect materials" and "raw materials" are part of manufacturing overhead and direct materials, respectively, but do not form a primary cost classification.

Option C (Direct materials, direct labor, depreciation on factory buildings):

Depreciation on factory buildings is an overhead cost, not a separate category.

Option D (Raw materials, factory employees' wages, production selling expenses):

Selling expenses are not part of manufacturing costs; they are part of operating expenses.

IIA Practice Guide – Auditing Cost Management: Defines manufacturing cost classifications.

IFRS & GAAP Cost Accounting Standards: Outline manufacturing cost components.

COSO Framework – Cost Control Guidelines: Emphasizes accurate cost allocation in financial reporting.

IIA References: