IIA-CIA-Part3 Leak Questions

Effective IT Change Management Principles:

Change management ensures that modifications to IT systems are controlled, tested, and implemented in a way that reduces risks.

A structured and consistent process is required to prevent disruptions, maintain system integrity, and comply with governance requirements.

IIA Standard 2110 - Governance:

IT governance must include structured change management processes.

Change management should be repeatable and standardized to ensure effectiveness.

IIA GTAG (Global Technology Audit Guide) on Change Management:

Change management must be conducted in a controlled environment to minimize unintended consequences and security risks.

A. The sole responsibility for change management is assigned to an experienced and competent IT team. (Incorrect)

While IT plays a key role, change management should involve multiple stakeholders, including business units, security, compliance, and risk management teams.

IIA Standard 2120 - Risk Management states that risk oversight should not be assigned to a single function.

C. Internal audit participates in the implementation of change management throughout the organization. (Incorrect)

Internal audit evaluates change management but does not implement it.

IIA Standard 1000 - Purpose, Authority, and Responsibility emphasizes that internal audit provides independent assurance rather than operational involvement.

D. All changes to systems must be approved by the highest level of authority within an organization. (Incorrect)

Approvals should be based on a risk-based hierarchy rather than requiring executive-level approval for all changes.

IIA GTAG - Change Management recommends a tiered approval system based on change complexity and risk impact.

Explanation of Incorrect Answers:Conclusion:The most critical factor in effective IT change management is having a consistent, controlled process (Option B).

IIA References:

IIA Standard 2110 - Governance

IIA Standard 2120 - Risk Management

IIA Standard 1000 - Purpose, Authority, and Responsibility

IIA GTAG - Change Management

Unauthorized external changes to data are best prevented through layered preventive controls. A firewall restricts unauthorized network access from external sources. Antivirus software helps prevent malicious code from modifying or corrupting data. Data encryption protects data confidentiality and can reduce unauthorized use or alteration when combined with proper key controls. Backup procedures are important recovery controls, but they do not prevent unauthorized changes from occurring. Change logs are detective controls because they record activity after changes occur. Internal auditors evaluating data protection should distinguish preventive, detective, and corrective controls. The best preventive combination listed is antivirus software, firewall, and encryption. Therefore, Option A is correct.

Effective business writing should communicate clearly, professionally, and efficiently without distracting the reader. A memorandum should focus attention on the message, evidence, recommendation, or decision required—not on the writer’s style. Therefore, drawing positive attention to the writing style is not a proper objective. The style should be appropriate, direct, respectful, and suited to the delivery method and audience. Treating receivers with respect supports professional communication and reduces resistance. Matching presentation and delivery helps ensure the message is received correctly. Developing ideas without overstatement supports accuracy, objectivity, and credibility. These principles are especially important in internal audit communications, where clarity and neutrality affect management acceptance and governance decisions. Therefore, Option A is the exception and the correct answer.