CIA Part 3 — Information Security, IT and Financial Management flashcards
10 of 78 cards free to study here · 3 topics · the whole deck is built into Willys
Information security, IT general and application controls, SDLC and change control, cloud and IT governance frameworks, and financial and managerial accounting from the 2019 CIA Part 3 syllabus; the 2025 syllabus tests the security, IT control and financial accounting topics mainly in Part 2.
Learn deck · part of IIA Certified Internal Auditor (CIA), Parts 1–3 · written against: IIA CIA exam syllabus effective 2025, aligned with the Global Internal Audit Standards (2024). Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
An internal auditor tests whether the payroll master file can be changed only through authorized transactions. Which element of the CIA triad does that control protect?Integrity — data is accurate and changed only by authorized means. Confidentiality concerns disclosure; availability concerns access when needed.Information Security › Security Principles
-
What does defense in depth mean when an auditor evaluates information security?Layered controls — physical, network, system, application and data controls — so that the failure of one layer does not by itself expose the asset.Information Security › Security Principles
-
How does least privilege differ from need to know?Least privilege limits system rights and functions to the minimum a role requires; need to know limits access to specific information to people whose task requires it.Information Security › Security Principles
-
During a walkthrough, an auditor sees staff hold the data centre door open for colleagues who have not badged in. Which weakness is this, and which controls address it?Tailgating (piggybacking), which defeats individual access control and logging. Remedies include an access vestibule or turnstile, security awareness and CCTV review.Information Security › Security Principles
-
How do IT general controls differ from application controls?ITGCs apply across the IT environment — access, change management, operations and development — while application controls work inside one application's input, processing and output.Information Technology › IT General Controls
-
Why must an auditor evaluate ITGCs before relying on an automated application control?An automated control works consistently only if ITGCs keep it unchanged and protected; weak change or access controls mean it could have been altered or bypassed during the period.Information Technology › IT General Controls
-
An automated three-way match was tested last year, change controls are effective and the program has not changed since. How might the auditor reduce this year's testing?Use benchmarking: confirm through change logs or version comparison that the program is unchanged, rather than retesting the control in full.Information Technology › IT General Controls
-
A sales manager records revenue when the customer signs an order, although goods ship next quarter. Which principle is breached?Revenue is recognized when (or as) a performance obligation is satisfied — when control of the goods passes to the customer — not when the order is signed.Financial Management › Financial Accounting
-
Why is a bill-and-hold arrangement a revenue red flag?The seller bills but keeps the goods, so revenue may be recorded before control has transferred. It is acceptable only when strict conditions show the customer controls the goods.Financial Management › Financial Accounting
-
At a physical inventory count, count teams are handed sheets showing the quantities from the perpetual records. Why is this a weakness?Counters can simply agree to the book figure instead of counting. Blind count sheets, which omit recorded quantities, force an independent count that can then be compared with the records.Financial Management › Financial Accounting
Unlock the whole deck
You are studying a free 10-card sample. All 78 cards of CIA Part 3 — Information Security, IT and Financial Management, the other 8 IIA Certified Internal Auditor (CIA), Parts 1–3 decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More IIA Certified Internal Auditor (CIA), Parts 1–3 decks
← All IIA Certified Internal Auditor (CIA), Parts 1–3 decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- IIA 2019 CIA exam syllabus, Part 3 Business Knowledge for Internal Auditing, Domains II Information Security, III Information Technology (III.1-III.2) and IV Financial Management (theiia.org, checked 2026-10-13); in the 2025 syllabus, IIA CIA Exam Expanded Test Specifications (V2.09.2024), these topics fall mainly under Part 2, Internal Audit Engagement, Sections A.3 (cybersecurity and information security risks, IT general controls and IT control frameworks, data privacy, finance and accounting concepts, ERP systems and inventory) and B.5 (ratio and trend analysis), with IT security audits and system development work also in Part 1, Sections A.5-A.6; cost behaviour, costing systems, budgeting and transfer pricing have no named 2025 item. IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) — topic outline only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
Not financial, tax or legal advice. These cards prepare you for an exam; rules and figures change, so check current standards before relying on any of it.
CIA® and Certified Internal Auditor® are registered trademarks of The Institute of Internal Auditors, Inc. (The IIA), which is not affiliated with and does not endorse this product.
Use of these pages is covered by our Terms of Use.