IIA-CIA-PART3 Practice Questions

When a company invests in common stock, it can earn income in two primary ways:

Dividend income: When the company receives dividends, it recognizes the income.

Capital gains: When the stock is sold for a higher price than its purchase price, it results in a gain.

Why Option C (Receives dividends) is Correct:

Dividends represent income from an investment in common stock when declared and paid by the

issuing company.

Under GAAP and IFRS, dividend income is recognized when received, not when declared.

Companies record dividends as investment income in their income statement.

Why Other Options Are Incorrect:

Option A (Purchases bonds):

Incorrect because purchasing bonds is an investment transaction, not income recognition.

Option B (Receives interest):

Incorrect because interest income applies to bond investments, loans, or deposits, not common

stock investments.

Option D (Sells bonds):

Incorrect because selling bonds results in capital gains or losses, not regular investment income from

common stock.

IIA Reference:

IIA Practice Guide – "Auditing Investment & Treasury Activities": Discusses the recognition of

investment income.

IFRS 9 (Financial Instruments) & GAAP Standards: Provide guidance on recording dividends as

investment income.

COSO Internal Control – Integrated Framework: Emphasizes proper financial reporting and income

recognition.

When prioritizing the audit universe, the CAE typically uses a risk-factor approach. This includes a

combination of likelihood, impact, control effectiveness, and other relevant criteria. Solely relying on

impact (Option C) or likelihood (Option B) is insufficient. Heat maps (Option D) may be tools used

within the process, but they are not the actual method of prioritization.

Thus, the correct description is the risk-factor approach (Option A).

Reference:

IIA Practice Guide – Developing a Risk-based Internal Audit Plan.

The internal rate of return (IRR) is a measure used to evaluate the profitability of an investment. The

project is considered acceptable if its IRR is greater than or equal to the required rate of return (RRR),

which is the minimum return an organization expects from an investment.

Step-by-Step

Correct Answer (C - Compare to the Required Rate of Return)

The required rate of return (RRR) represents the minimum acceptable return for the project.

If IRR ≥ RRR, the project is acceptable. If IRR < RRR, the project is rejected.

The IIA Practice Guide: Auditing Capital Investments suggests comparing IRR to the RRR to ensure

financial feasibility.

Why Other Options Are Incorrect:

Option A (Compare to the annual cost of capital):

The cost of capital (WACC - Weighted Average Cost of Capital) is an important factor, but RRR is the

direct benchmark for IRR comparison.

Option B (Compare to the annual interest rate):

Interest rates do not determine project feasibility—they only affect financing costs.

Option D (Compare to the net present value - NPV):

NPV and IRR are related, but they serve different purposes.

IRR is compared against RRR, while NPV measures absolute profitability in dollar terms.

IIA Reference for Validation:

IIA Practice Guide: Auditing Capital Investments – Discusses IRR, RRR, and investment decision-

making.

IIA GTAG 3: Business Case Development – Explains how financial metrics like IRR and RRR are used in

decision-making.

Thus, C is the correct answer because IRR should be compared to the required rate of return to

determine project acceptability.

Comprehensive and Detailed In-Depth

Partnership contributions should be recorded at their fair market value (FMV) at the time of

contribution, ensuring equitable financial representation.

Option A (Original cost of the equipment) – Not appropriate since the asset’s current fair value is

relevant, not its historical cost.

Option B (Weighted average approach) – Not applicable; capital accounts should reflect actual

contributed value.

Option C (No action necessary) – Incorrect because partners contributed assets of different values,

making an equal capital credit unfair.

Since partnership accounting requires fair market value for capital accounts, Option D is correct.

Reference: IIA Financial Accounting – Partnership Equity Contributions

Comprehensive and Detailed Step-by-Step Explanation with all IIA Reference: =

Understanding the Impact of an Understated Ending Inventory:

Ending inventory is a key component of the cost of goods sold (COGS) calculation:

COGS=BeginningInventory+Purchases−EndingInventoryCOGS = Beginning Inventory + Purchases -

Ending InventoryCOGS=BeginningInventory+Purchases−EndingInventory

If the ending inventory is understated, it means the reported inventory is lower than its actual value.

This results in an overstated COGS because a smaller amount is subtracted in the formula above.

An overstated COGS leads to an understated net income in the current year.

Effect on the Following Year’s Income Statement:

The beginning inventory for the next year is based on the ending inventory of the previous year.

Since the prior year's ending inventory was understated, the new year's beginning inventory is also

understated.

A lower beginning inventory leads to a lower COGS in the new year.

Since COGS is lower, net income in the following year will be overstated.

IIA’s Perspective on Financial Reporting Errors:

The IIA’s International Standards for the Professional Practice of Internal Auditing (IPPF) emphasize

the importance of accurate financial reporting.

IIA Standard 1220 – Due Professional Care requires internal auditors to consider the probability of

errors, fraud, or misstatements in financial reporting.

COSO’s Internal Control – Integrated Framework highlights that inventory valuation errors can

impact financial integrity and decision-making.

GAAP & IFRS Accounting Standards also require proper inventory reporting to ensure accurate

financial statements.

IIA Reference:

IPPF Standard 1220 – Due Professional Care

COSO Internal Control – Integrated Framework

GAAP & IFRS Accounting Principles on Inventory Valuation

Thus, the correct and verified answer is C. Net income would be overstated.

The root cause of the missing significant risks lies in the methodology used for risk identification. If

the process relies too rigidly on a standard set of questions, it may overlook critical risks. By revising

the risk identification methodology, the organization ensures that future projects capture relevant

risks comprehensively and consistently, adding long-term value.

Option A addresses only the current project, not the underlying issue. Option B may improve

knowledge but does not fix the flawed process. Option D merely shifts responsibility but does not

address the methodology weakness.

Reference:

IIA Standards – Standard 2120: Risk Management.

When disagreements occur regarding risk management or audit findings, the CAE should first

escalate the matter within management levels to attempt resolution. Only if the disagreement

remains unresolved after discussion with senior management should the CAE report the matter to

the board or audit committee.

Options B and C are premature: the charter does not grant internal audit supremacy over

management’s decisions, and documenting disagreement in the audit report should occur only after

reasonable attempts at resolution. Option A (escalating immediately to the board) should occur only

if discussion with management does not resolve the issue.

Reference:

IIA Standards – Standard 2600: Communicating the Acceptance of Risks.

A core feature of blockchain technology is immutability—once data is recorded, it cannot be altered

or deleted. While this supports integrity and transparency, it also creates a conflict with data privacy

regulations such as the General Data Protection Regulation (GDPR), which grants individuals the

“right to be forgotten.” The inability to erase personal data stored on blockchain creates a

compliance challenge.

Options A and B are incorrect: phishing is not inherent to blockchain, and transactions are not easily

tampered with (immutability actually prevents that). Option C is misleading because regulations

address data use but do not “overregulate” blockchain specifically.

Reference:

IIA Global Technology Audit Guide (GTAG): Understanding Blockchain and Related Risks.

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and

maintained by end-users (not IT) that are critical to financial reporting, decision-making, or

regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the

complexity, significance, and control environment of such applications.

Analysis of Each Option:

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources,

reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements

and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize

assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial

systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

IIA Reference Supporting the Answer:

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial

impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and

operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-

developed applications.

Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA

guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial

misstatements.

At the end of an accounting period, certain accounts must be closed to prepare financial statements

and reset balances for the next period. The accounts that must be closed are temporary accounts,

which include all income statement accounts (revenues, expenses, and gains/losses).

Why Option A (Income statement accounts) is Correct:

Income statement accounts (revenues, expenses, gains, and losses) are temporary accounts that

track financial performance for a specific period.

At the end of the period, these accounts are closed to the retained earnings account to reset them to

zero for the next period.

Why Other Options Are Incorrect:

Option B (Balance sheet accounts):

Incorrect because balance sheet accounts (assets, liabilities, and equity) are permanent accounts

that carry their balances forward to the next period.

Option C (Permanent accounts):

Incorrect because permanent accounts include all balance sheet accounts, which are never closed.

Option D (Real accounts):

Incorrect because real accounts refer to balance sheet accounts (assets, liabilities, and equity), which

remain open.

IIA Reference:

IIA GTAG – "Auditing Financial Close Processes": Discusses the closing of temporary accounts at the

period end.

COSO Internal Control – Integrated Framework: Recommends proper financial reporting controls,

including account closures.

IFRS & GAAP Accounting Standards: Define temporary and permanent accounts in financial

reporting.

Thus, the correct answer is A. Income statement accounts.