CIA Part 3 — Business Acumen and Risk flashcards

10 of 75 cards free to study here · 1 topic · the whole deck is built into Willys

Topics from the 2019 CIA Part 3 syllabus, mostly Business Acumen, that the 2025 syllabus tests mainly in Part 2: objectives and performance measures, motivation and culture, structures, procurement, sales, HR and supply chain risks, contract types, analytics, change, outsourcing and continuity.

Get the app All IIA Certified Internal Auditor (CIA), Parts 1–3 decks

Learn deck · part of IIA Certified Internal Auditor (CIA), Parts 1–3 · written against: IIA CIA exam syllabus effective 2025, aligned with the Global Internal Audit Standards (2024). Updated 2026-10-10.

Study the free sample

10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.

The 10 sample cards as a list

A mission statement explains why an organization exists today. What does a vision statement describe instead?

The vision describes the future state the organization wants to reach. Strategy and measurable objectives then turn mission and vision into targets that can be monitored.
Business Acumen › Organizational Objectives
An internal auditor reviews a business unit's objectives and finds 'improve customer service' with no target or deadline. Which attributes of a well-formed objective are missing?

It is not SMART — it lacks a measure, a target and a time frame (Specific, Measurable, Achievable, Relevant, Time-bound).

Why: without a measurable objective, management cannot monitor performance and the auditor has no criterion to assess it against.
Business Acumen › Organizational Objectives
Besides the financial perspective, which three perspectives does a balanced scorecard add?

Customer, internal business process, and learning and growth.

Why: lagging financial results are paired with the non-financial drivers that lead them.
Business Acumen › Organizational Objectives
A sales team's bonus depends only on quarterly revenue booked. Which risk should the internal auditor raise?

Incentive-driven behaviour — pressure to pull revenue forward, grant unapproved discounts, ignore customer credit risk or misstate sales. A one-dimensional performance measure creates both performance and fraud risk.
Business Acumen › Organizational Objectives
How does a key risk indicator differ from a key performance indicator?

A KPI measures progress toward an objective, usually after the fact; a KRI is an early-warning metric that signals rising exposure to a risk before it crystallizes.

Example: rising overtime and staff turnover in a finance team as a KRI for processing errors.
Business Acumen › Organizational Objectives
In a SWOT analysis, which factors are internal and which are external?

Strengths and weaknesses are internal to the organization; opportunities and threats come from the external environment.
Business Acumen › Organizational Objectives
Which five forces does Porter's model use to judge how competitive an industry is?

Rivalry among existing competitors, threat of new entrants, threat of substitutes, bargaining power of buyers and bargaining power of suppliers.
Business Acumen › Organizational Objectives
An auditor scanning the external environment uses PESTLE. Which categories of factors does it cover?

Political, economic, social, technological, legal and environmental factors — a checklist for external risks to strategy.
Business Acumen › Organizational Objectives
Under Herzberg's two-factor theory, why might a general pay rise fail to increase motivation?

Pay is a hygiene factor: inadequate pay causes dissatisfaction, but adequate pay does not motivate by itself. Motivators are achievement, recognition, responsibility, advancement and the work itself.
Business Acumen › Organizational Behaviour
What is the order of needs in Maslow's hierarchy, from lowest to highest?

Physiological, safety, belonging (social), esteem, self-actualization. Lower needs must be largely met before higher ones drive behaviour.
Business Acumen › Organizational Behaviour

Unlock the whole deck

You are studying a free 10-card sample. All 75 cards of CIA Part 3 — Business Acumen and Risk, the other 8 IIA Certified Internal Auditor (CIA), Parts 1–3 decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.

Get the app

In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.

More IIA Certified Internal Auditor (CIA), Parts 1–3 decks

Foundations, Ethics and Governance Governance, Risk, Control and Quality Practice Questions, Part 1 Engagement Planning and Performance Communicating Results and Monitoring Practice Questions, Part 2 Information Security, IT and Financial Management Practice Questions, Part 3

← All IIA Certified Internal Auditor (CIA), Parts 1–3 decks, with the study guide and topic outline.

About these cards

Review status: Second-reader reviewed, with corrections applied.

Checked against:

IIA 2019 CIA exam syllabus, Part 3 Business Knowledge for Internal Auditing, Domain I Business Acumen (I.1-I.3) and III.3 Disaster Recovery (theiia.org, checked 2026-10-13); in the 2025 syllabus, IIA CIA Exam Expanded Test Specifications (V2.09.2024), these topics fall mainly under Part 2, Internal Audit Engagement, Sections A.3 (objectives and performance measures, business continuity, business processes and third parties), A.5 (change, organizational structure, culture) and B.3-B.5 (technology, data analytics, analytical review), with culture also in Part 1, Section C.2; contract types and motivation theories have no named 2025 item. IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) — topic outline only; no text copied
Federal Acquisition Regulation 16.102(c), acquisition.gov (FAC 2026-01, effective 13 March 2026), checked 2026-10-13 — no text copied

These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.

Not financial, tax or legal advice. These cards prepare you for an exam; rules and figures change, so check current standards before relying on any of it.

CIA® and Certified Internal Auditor® are registered trademarks of The Institute of Internal Auditors, Inc. (The IIA), which is not affiliated with and does not endorse this product.

Use of these pages is covered by our Terms of Use.