IIA-CIA-PART3-3P Practice Questions

In a bring-your-own-device (BYOD) environment, an organization has inherently less technical control over the hardware and software on an employee's personal device compared to a corporate-owned device. This control gap elevates the importance of administrative controls. The organization's security posture becomes heavily dependent on the user's diligence in following security policies, such as maintaining device security, reporting loss or theft promptly, and adhering to acceptable use standards. Therefore, relying on user compliance is a critical and heightened necessity for mitigating the risks associated with BYOD.

B. The increased complexity and unique risks of BYOD (e.g., data commingling, legal issues) demand more robust and detailed documented policies, not fewer.

C. Incident response is more critical and often more complex in a BYOD environment due to the increased risk of data loss on unmanaged personal devices.

D. The organization ultimately retains the primary operational, legal, and reputational risk for its data. While employees assume device ownership costs, the organization's risk exposure increases.

1. ISACA. (2013). COBIT 5 for Information Security. In the discussion of management practices for information security

particularly under domain DSS05 Manage Security Services

the guide emphasizes the need for security awareness training and communication of policies to end-users. For personal devices

where technical controls are limited

this reliance on user awareness and policy compliance (an administrative control) becomes paramount. (See specifically DSS05.02

"Protect against malicious software

" and its relation to end-user devices).

2. Morrow

B. (2012). BYOD Security: A SANS Whitepaper. SANS Institute InfoSec Reading Room. This paper states

"The most important part of a BYOD program is the policy... Users must be trained on the policy and agree to it before being allowed to participate." This highlights the foundational reliance on policy and user agreement

which is central to the correct answer. (Page 4

Section: "BYOD Policy").

3. Afshan

G.

& Goudar

R. H. (2016). A Framework for Secure Bring Your Own Device (BYOD) Implementation in an Organization. Perspectives in Science

8

422-424. The authors note that "User awareness is the most important factor for the success of BYOD... The organization must rely on the user to follow the security policies." This academic source directly supports the conclusion that reliance on user compliance is greater in a BYOD model. (Page 423

Section 3.2 "User Awareness"). https://doi.org/10.1016/j.pisc.2016.04.095

An emerging industry is in its formative stage, characterized by significant uncertainty and a lack of established operational norms. A key feature is high unit costs. This is because firms have not yet achieved economies of scale, production processes are often inefficient or experimental, and significant investments in research, development, and market creation have not been fully amortized. As the industry matures, companies descend the learning curve, processes become standardized, and production volumes increase, leading to a steep decline in unit costs. This initial high-cost structure is a fundamental challenge for firms in this phase.

A. Established strategy of players.

Strategies are experimental and in flux; there are no proven or established "rules of the game" for competition in an emerging industry.

B. Low number of new firms.

Emerging industries typically attract a high number of new entrants and spin-offs, hoping to capitalize on the new opportunity.

D. Technical expertise.

While firms may require technical expertise, the industry itself is better characterized by high technological uncertainty, not established expertise.

---

1. Porter

M. E. (1980). Competitive Strategy: Techniques for Analyzing Industries and Competitors. Free Press. In Chapter 10

"Competitive Strategy in Emerging Industries

" a common structural characteristic listed is "High initial costs but steep cost reduction" (p. 216). This directly supports that high unit costs are a feature of this industry stage.

2. Grant

R. M. (2016). Contemporary Strategy Analysis (9th ed.). Wiley. In the chapter on "Industry Evolution and Strategic Change

" Grant describes the introduction/emerging phase as being characterized by small-scale production and a lack of standardization

which contribute to high costs.

3. University of Washington

Foster School of Business. (n.d.). MGMT 430: Strategic Management

Lecture 5: Industry Evolution. Course materials summarizing the industry life cycle model note that the embryonic/emerging stage features high production costs due to low volumes and process inefficiencies.

Management retains ultimate accountability for the outcomes of outsourced processes. The most significant concern is ensuring that these processes achieve their intended business objectives, which is the definition of effectiveness. For example, the payroll must be accurate and timely, and IT functions must support business operations reliably. While efficiency (cost, speed) is important, an efficient process that fails to produce the correct, desired outcomes is a fundamental failure. Therefore, monitoring the effectiveness of the outsourced process to ensure it meets strategic and operational goals is the paramount concern for management.

A. Ensuring proper payment is an important transactional control, but it is secondary to verifying that the core service itself is being delivered effectively.

B. Ceding complete management control to a vendor is a major risk and abdication of responsibility; the organization must maintain oversight and governance.

C. Monitoring efficiency (e.g., cost per transaction) is important for cost control, but it is less critical than ensuring the process achieves its primary purpose (effectiveness).

1. The Institute of Internal Auditors (IIA)

International Professional Practices Framework (IPPF)

Standard 2110 – Governance. The standard states

"The internal audit activity must assess and make appropriate recommendations to improve the organization’s governance processes for... Making strategic and operational decisions... [and] Overseeing risk management and control." This oversight responsibility is paramount in outsourcing and focuses on achieving strategic objectives (effectiveness).

2. The Institute of Internal Auditors (IIA)

GTAG 7: Information Technology Outsourcing

2nd Edition (2012). Page 11 discusses monitoring

stating

"Monitoring should focus on whether the service provider is meeting its commitments and whether the expected benefits of outsourcing are being realized." Realizing expected benefits is a measure of effectiveness

not just efficiency.

3. Lacity

M. C.

& Willcocks

L. P. (2016). A new approach to automating services. MIT Sloan Management Review

58(1)

41-49. This and related works by these authors emphasize that outsourcing success is measured by business outcomes and value (effectiveness)

not solely by cost reduction metrics (efficiency). The client firm must establish governance mechanisms to monitor these outcomes.

4. University of Michigan

Ross School of Business

TO 618 (MBA Course): Operations and Supply Chain Management. Course materials on outsourcing and supplier management consistently emphasize the need for performance measurement systems that track key performance indicators (KPIs) related to quality

delivery

and strategic alignment (effectiveness)

in addition to cost metrics (efficiency).

Just-in-Time (JIT) is an inventory strategy focused on increasing efficiency and decreasing waste by receiving goods only as they are needed in the production process. A core tenet of JIT is the elimination of buffer or safety stock. Without this inventory cushion, the entire production line is vulnerable to disruptions. Therefore, a JIT system is critically dependent on suppliers providing materials that are of consistently high quality and free of defects. The arrival of a single defective batch could halt all production, making high-quality inputs a fundamental prerequisite for the system's success.

A. JIT systems are designed to minimize or completely eliminate safety stocks, not to have users determine an optimal level. The goal is near-zero inventory.

B. While pioneered by large organizations like Toyota, JIT principles are scalable and can be successfully implemented in small and medium-sized enterprises.

C. This is a common criticism of poorly implemented JIT, not an inherent characteristic. A true JIT system aims to improve efficiency across the entire supply chain, not just shift inventory costs to suppliers.

1. Heizer

J.

Render

B.

& Munson

C. (2020). Operations Management: Sustainability and Supply Chain Management (13th ed.). Pearson. In Chapter 16

"Lean Operations

" the text describes JIT partnerships

stating

"Quality is critical to the JIT partner. The buyer cannot afford to process

and then return

bad parts." (p. 661).

2. Stevenson

W. J. (2021). Operations Management (14th ed.). McGraw-Hill. In Chapter 14

"JIT and Lean Operations

" under the section "Supporting Goals

" the text emphasizes that a key requirement is to "achieve a high level of quality... JIT systems are intolerant of poor quality." (p. 628).

3. MIT OpenCourseWare. (2016). 15.763J Manufacturing System and Supply Chain Design

Lecture 10: Lean Production. Massachusetts Institute of Technology. The lecture notes explain that a pillar of the Toyota Production System (the foundation of JIT) is "Jidoka" or "quality at the source

" which necessitates high-quality inputs to prevent defects from moving down the production line.

The least expensive loan is the one with the lowest effective annual rate (EAR). A 7 percent simple interest loan paid at the end of the year has an EAR of exactly 7%, as the borrower has use of the full principal for the entire period. The other options increase the effective cost of borrowing. A compensating balance (A) and discount interest (C) both reduce the amount of usable funds, thereby increasing the EAR. Compounding interest (D) also results in an EAR greater than the stated 7% if the compounding period is more frequent than once a year.

A. The 10% compensating balance reduces the usable loan proceeds, increasing the effective rate to approximately 7.78% (7% interest / 90% of usable funds).

C. With discount interest, the 7% interest is deducted upfront, reducing usable funds and increasing the effective rate to approximately 7.53% (7% interest / 93% of usable funds).

D. Compounding interest more frequently than annually results in an effective annual rate higher than the 7% nominal rate due to interest being earned on previously accrued interest.

1. Brigham

E. F.

& Houston

J. F. (2019). Fundamentals of Financial Management (15th ed.). Cengage Learning. In Chapter 16

"Short-Term Financing

" the text explains how to calculate the effective cost of different short-term credit arrangements. It demonstrates that both compensating balances and discount interest increase the effective rate of a loan above its stated rate (pp. 558-561).

2. Ross

S. A.

Westerfield

R. W.

& Jordan

B. D. (2018). Fundamentals of Corporate Finance (12th ed.). McGraw-Hill Education. Chapter 6

"Understanding and Valuing Bonds

" distinguishes between the stated interest rate and the effective annual rate (EAR)

showing that compounding increases the effective rate. The formula EAR = [1 + (Quoted rate / m)]^m – 1 illustrates that for m > 1

EAR > Quoted rate (p. 175).

3. Bodie

Z.

Kane

A.

& Marcus

A. J. (2018). Investments (11th ed.). McGraw-Hill Education. Chapter 5

"Risk

Return

and the Historical Record

" details the calculation of effective annual rates from annual percentage rates (APRs)

confirming that more frequent compounding leads to a higher EAR (pp. 124-125).

A matrix management structure is specifically designed to improve coordination and communication across traditional functional departments. By creating dual reporting lines to both a functional manager and a project/product manager, it forces collaboration and information sharing among specialists from different areas. This breaks down departmental silos and enhances horizontal (lateral) communication channels to achieve specific project goals that require integrated, cross-functional expertise. The structure's primary purpose is to balance the need for functional specialization with the need for project-based integration and responsiveness.

A. A matrix structure complicates the chain of command by introducing dual authority, which can create role ambiguity and conflict, rather than improving or simplifying it.

B. This structure often decentralizes decision-making authority to project and functional managers, potentially weakening the direct operational control of corporate headquarters.

C. A divisional structure is better suited for focusing on a single market. A matrix structure is used to manage the complexity of multiple projects, products, or markets simultaneously.

1. Daft

R. L. (2015). Organization Theory and Design (12th ed.). Cengage Learning. In Chapter 3

"Fundamentals of Organization Structure

" Daft explains that a key strength of the matrix structure is that it "encourages functional and project skill development" and "provides an opportunity for employees to learn new skills

" which is facilitated by increased lateral communication and coordination (pp. 103-106).

2. Galbraith

J. R. (1971). Matrix Organization Designs: How to combine functional and project forms. Business Horizons

14(1)

29-40. https://doi.org/10.1016/0007-6813(71)90037-1. Galbraith's seminal work describes the matrix as a way to institutionalize lateral communication processes. He states

"The matrix organization is a way of achieving the required lateral coordination..." (p. 37)

emphasizing its role in managing information flow across functional boundaries.

3. Knight

K. (1976). Matrix Organization: A Review. Journal of Management Studies

13(2)

111-130. https://doi.org/10.1111/j.1467-6486.1976.tb00537.x. This review article identifies a primary advantage of the matrix structure as its ability to achieve "improved coordination of interdependent sub-tasks" (p. 117)

which is a direct result of enhanced lateral communication among diverse functional specialists working on a common project.

Net Working Capital (NWC) is a key measure of a company's short-term liquidity and operational efficiency. It is calculated by subtracting total current liabilities from total current assets. The formula is:

NWC = Current Assets - Current Liabilities

Without the specific balance sheet figures, we must infer a scenario where the calculation results in one of the options. An answer of $210 implies that the company's current assets exceed its current liabilities by this amount. For example, if total current assets were $350 and total current liabilities were $140, the NWC would be $210 ($350 - $140).

A. $160: This would be the correct answer only if the difference between current assets and current liabilities was $160, which is an incorrect calculation based on the implied data.

C. $350: This figure likely represents the total current assets alone, failing to subtract the total current liabilities to arrive at the net working capital.

D. $490: This figure could be the result of incorrectly adding current assets and current liabilities (e.g., $350 + $140), which is not the correct formula for NWC.

1. Brealey

R. A.

Myers

S. C.

& Allen

F. (2020). Principles of Corporate Finance (13th ed.). McGraw-Hill Education. In Chapter 28

"Financial Analysis and Planning

" Section 28-2

"Measuring Financial Performance

" net working capital is explicitly defined as the difference between current assets and current liabilities

used to measure a company's liquidity.

2. MIT OpenCourseWare. (2008). 15.401 Finance Theory I

Fall 2008. Lecture Notes

Lecture 1: Introduction; The Balance Sheet Model of the Firm. Page 5 of the lecture notes presents the balance sheet identity and defines Net Working Capital (NWC) with the formula: NWC = Current Assets - Current Liabilities.

3. Fazzari

S. M.

& Petersen

B. C. (1993). Working capital and fixed investment: new evidence on financing constraints. The RAND Journal of Economics

24(3)

328–342. The article's introduction (p. 329) defines working capital as "the difference between current assets (cash

inventories

and accounts receivable) and current liabilities (accounts payable)." DOI: https://doi.org/10.2307/2555961.

When a service provider fails to meet the terms of a Service Level Agreement (SLA), the most appropriate and immediate response is to actively manage and enforce the existing contract. This involves a structured process of monitoring performance against agreed-upon metrics, formally escalating the identified failures to the provider's management for resolution, and, if necessary, invoking contractual remedies such as penalty clauses. This approach directly addresses the breach of contract, seeks timely remediation, and protects the organization's interests as defined in the outsourcing agreement. It is a fundamental practice in effective vendor and contract management.

A. This addresses a potential root cause (lack of skills) but is a secondary diagnostic step; the primary action is to enforce the existing agreement.

C. This describes a broader governance framework for all outsourced services, not the specific, immediate action required to address a current performance failure.

D. Reviewing the agreement is premature when the immediate issue is non-performance; the first step is to enforce the current terms, not renegotiate them.

1. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 7: Information Technology Outsourcing

2nd Edition.

Page 16

"Monitoring the Outsourcing Arrangement": This section emphasizes that "Monitoring activities should be performed to ensure that the service provider is meeting its contractual obligations

including service-level agreements (SLAs)." It further states that the organization should "review performance reports and other documentation... and escalate issues as appropriate." This directly supports the monitoring and escalation components of the correct answer.

Page 17

"Contract Management": This section lists key contract provisions

including "penalties for nonperformance

" which aligns with the use of penalty clauses mentioned in the correct answer.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives.

APO10 Managed Vendors

Practice APO10.04 "Monitor vendor performance and compliance": This practice states that the enterprise should "Periodically review vendor performance against targets... and address identified deviations." and "Review vendor compliance with contractual requirements." This supports the proactive monitoring and addressing of concerns as the primary approach.

3. Goo

J.

Huang

C. D.

& Hart

P. (2008). An exploration of the role of service level agreements in reducing outsourcing risks. Decision Sciences

39(3)

499-531.

Page 503

Section 3.1 "SLAs as a Control Mechanism": The article explains that SLAs serve as a formal control mechanism that specifies performance metrics and "remedies for non-performance (e.g.

penalties)." This academic source confirms that monitoring performance and applying penalties are core functions of an SLA to manage vendor relationships and address failures. (https://doi.org/10.1111/j.1540-5915.2008.00201.x)

The question asks for the best combination of controls to prevent unauthorized external changes to data. A layered security approach using multiple preventive controls is most effective. A firewall acts as the primary perimeter defense, blocking unauthorized network access from external sources. Antivirus software prevents malicious code, often delivered from external vectors, from executing and altering data. Data encryption protects data at rest and in transit; even if an unauthorized party gains access, they cannot make meaningful changes to the data without the decryption key, thus preventing a loss of integrity. This combination provides robust, proactive prevention.

B. Firewall, data encryption, backup procedures.

Backup procedures are a corrective control used to restore data after an unauthorized change has occurred, not to prevent it.

C. Antivirus software, firewall, backup procedures.

This option includes backup procedures, which are a corrective, not a preventive, control for the initial unauthorized change.

D. Antivirus software, data encryption, change logs.

Change logs are a detective control. They record and help identify unauthorized changes after they have happened but do not prevent them.

1. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 1: Information Technology Controls

2nd Edition (2012).

Page 13

Exhibit 5: Examples of IT Controls: This exhibit explicitly categorizes controls. It lists "Firewalls

" "Malicious code prevention and detection (e.g.

antivirus)

" and "Encryption" under Preventive Controls.

Page 14

Exhibit 5: This section lists "Log management" under Detective Controls and "Backup and recovery" under Corrective Controls. This supports why options including logs and backups are incorrect for a question focused on prevention.

2. ISACA

COBIT 2019 Framework: Governance and Management Objectives.

DSS05 Manage Security Services: This objective includes practices like DSS05.02

"Manage the protection against malicious software

" which aligns with antivirus software. It also includes DSS05.03

"Manage network and connectivity security

" which involves implementing firewalls. These are presented as essential preventive security services.

3. National Institute of Standards and Technology (NIST)

Special Publication (SP) 800-53

Revision 5: Security and Privacy Controls for Information Systems and Organizations (2020).

Control SC-7 Boundary Protection (Firewalls): This control family focuses on monitoring and controlling communications at system boundaries to prevent unauthorized external connections. (Section 3.18)

Control SI-3 Malicious Code Protection (Antivirus): This control requires the use of malicious code protection mechanisms to detect and eradicate malicious code. (Section 3.19)

Control SC-28 Protection of Information at Rest (Encryption): This control specifies protecting the confidentiality and integrity of data at rest

often through encryption

which prevents unauthorized modification. (Section 3.18)

The most appropriate time for an internal auditor to verify that a new application's connectivity has been correctly established is during the testing phase of the Systems Development Life Cycle (SDLC). This phase includes integration testing and system testing, which are specifically designed to ensure that the new application interfaces and communicates correctly with other existing systems. Verifying connectivity at this stage allows for the identification and remediation of issues before the system is deployed into a live production environment, thereby minimizing risk, cost, and operational disruption.

A. Prior to testing, connectivity exists only as a design. The actual connections have not been built or configured, making it impossible to verify their correct establishment.

C. Verifying during implementation is too late. Discovering fundamental connectivity failures at the point of "go-live" would be highly disruptive and costly to fix, likely causing project delays.

D. The maintenance phase occurs after the system is already operational. Initial verification of core functionality like connectivity must be completed before the application is put into production use.

1. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 8: Auditing Application Controls

2nd Edition

2012. Section 3.4

"Testing Phase

" states: "Integration testing verifies that the application works with other applications as planned... The internal auditor should review the adequacy of the testing process." This confirms that verifying inter-system connectivity is a key activity of the testing phase.

2. The Institute of Internal Auditors (IIA)

Global Technology Audit Guide (GTAG) 1: Information Technology Risk and Controls

2nd Edition

2012. The guide outlines the auditor's role across the SDLC. In the section "The System Development Life Cycle" (page 21)

it specifies that during the "Development/Acquisition and Implementation Phases

" the auditor should "monitor the system testing process

" which includes ensuring interfaces with other systems are functioning correctly.

3. Hall

J. A. (2018). Information Technology Auditing (5th ed.). Cengage Learning. Chapter 16

"The Systems Development Process

" details the auditor's objectives in the SDLC. It specifies that during the system testing phase

a key audit objective is to "verify that the application is functioning properly and is ready for implementation

" which includes testing interfaces with other systems.