CIA — Practice Questions, Part 3 flashcards
6 of 60 questions free to study here · 4 topics · the whole deck is built into Willys
Multiple-choice practice questions, one best answer each, on business acumen, organizational behaviour, third parties, information security, IT controls and financial and managerial accounting from the 2019 CIA Part 3 syllabus; the 2025 syllabus tests most of these topics in Part 2.
Practice deck · part of IIA Certified Internal Auditor (CIA), Parts 1–3 · written against: IIA CIA exam syllabus effective 2025, aligned with the Global Internal Audit Standards (2024). Updated 2026-10-10.
Study the free sample
6 questions from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 6 sample questions as a list
-
During a strategy workshop, management lists two items: a competitor's planned launch of a cheaper rival product, and the company's own ageing order-processing platform. How should these be classified in a SWOT analysis?
A) Both are weaknesses, because each needs a management response
B) Both are threats, because each could reduce market share
C) The launch is a weakness and the ageing platform is a threat
D) The launch is a threat and the ageing platform is a weaknessD) The launch is a threat and the ageing platform is a weaknessBusiness Acumen › Organizational Objectives
Strengths and weaknesses are internal to the organization, while opportunities and threats come from the external environment. A competitor's action is external; the company's own platform is internal, however much damage it could do. -
Sales staff at a distributor earn a quarterly bonus based only on revenue booked. The internal auditor has found discounts granted without approval and sales to customers with poor credit. Which recommendation best addresses the root cause?
A) Pay the bonus annually instead of quarterly, still based only on revenue booked
B) Raise the revenue target so that bonuses become harder to earn
C) Publish a monthly ranking of each salesperson's booked revenue
D) Add gross margin, collections and customer retention to the bonus measuresD) Add gross margin, collections and customer retention to the bonus measuresBusiness Acumen › Organizational Objectives
A one-dimensional measure rewards revenue at any cost, so balancing it with profitability, cash collection and customer measures removes the incentive to discount or sell to bad credit risks. A higher target or a ranking on the same measure only increases the pressure behind the problem. -
A distributed denial-of-service attack takes a company's customer ordering portal offline for six hours. No data is read or changed. Which security objective was compromised?
A) Confidentiality
B) Integrity
C) Non-repudiation
D) AvailabilityD) AvailabilityInformation Security › Security Principles
Availability means systems and data are accessible when needed, which is what a denial-of-service attack disrupts. Confidentiality and integrity were not affected because nothing was disclosed or altered. -
During a site visit, an internal auditor sees employees holding the data centre door open for colleagues who have not badged in. Which control most directly addresses this weakness?
A) Longer and more complex passwords for data centre staff
B) An access vestibule that admits one badge-holder at a time
C) A quarterly review of the badge-access list for the data centre
D) Encryption of the servers housed in the data centreB) An access vestibule that admits one badge-holder at a timeInformation Security › Security Principles
Tailgating defeats individual badge control and logging, and a vestibule or turnstile physically prevents it, supported by awareness training and CCTV review. A badge-list review confirms who should have access but does nothing to stop people following them in. -
An internal auditor plans to rely on an automated credit-limit check in the sales system. Why must IT general controls be evaluated first?
A) IT general controls show whether the business owner designed the check
B) Automated controls must also be retested manually every quarter
C) Weak change or access controls mean the check could have been altered
D) Application controls cannot be tested without the source codeC) Weak change or access controls mean the check could have been alteredInformation Technology › IT General Controls
An automated control works consistently only while change management and access controls keep it unchanged and protected. If those general controls are weak, the check may have been altered or bypassed during the period, so a single test of it proves little. -
At year end, a company records 200,000 of routine equipment repairs as additions to equipment instead of expensing them. What is the effect on the current year's financial statements?
A) Assets are overstated and profit is overstated
B) Profit is overstated and assets are unaffected
C) Assets are overstated and profit is understated
D) Assets are understated and profit is overstatedA) Assets are overstated and profit is overstatedFinancial Management › Financial Accounting
Capitalizing a cost that should be expensed keeps it on the balance sheet and moves it out of the current income statement, spreading it over future periods through depreciation. Both assets and current profit are therefore overstated.
Unlock the whole deck
You are studying a free 6-question sample. All 60 questions of CIA — Practice Questions, Part 3, the other 8 IIA Certified Internal Auditor (CIA), Parts 1–3 decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More IIA Certified Internal Auditor (CIA), Parts 1–3 decks
← All IIA Certified Internal Auditor (CIA), Parts 1–3 decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- IIA 2019 CIA exam syllabus, Part 3 Business Knowledge for Internal Auditing, Domains I Business Acumen, II Information Security, III Information Technology and IV Financial Management (theiia.org, checked 2026-10-13); in the 2025 syllabus, IIA CIA Exam Expanded Test Specifications (V2.09.2024), these topics fall mainly under Part 2, Internal Audit Engagement, Sections A.3 (objectives and performance measures, cybersecurity and information security risks, IT general controls, business continuity, finance and accounting concepts, business processes and third parties), A.5 (change, organizational structure, culture), B.4 (data analytics) and B.5 (ratio and trend analysis), with fraud schemes and segregation of duties also in Part 1, Section D; contract types, motivation theories, cost-volume-profit and costing systems, and transfer pricing have no named 2025 item. IIA Global Internal Audit Standards (issued 9 January 2024, effective 9 January 2025) — topic outline only; no text copied
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (August 2025), Sec. 3.1.1.2, password verifiers (pages.nist.gov), checked 2026-10-13 — no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
Not financial, tax or legal advice. These cards prepare you for an exam; rules and figures change, so check current standards before relying on any of it.
CIA® and Certified Internal Auditor® are registered trademarks of The Institute of Internal Auditors, Inc. (The IIA), which is not affiliated with and does not endorse this product.
Use of these pages is covered by our Terms of Use.