IIA Updated IIA-CIA-Part3 Exam Questions and Answers by kody

Before internal audit information is released outside normal internal channels, legal representation should be consulted. Internal audit reports and workpapers may contain sensitive findings, confidential business information, legal exposure, personal data, fraud indicators, privileged communications, or regulatory implications. Releasing such information to other assurance providers without proper review can create legal and confidentiality risk. Option A is too broad because interactions with nongovernmental organizations vary by context and jurisdiction. Option B is false because disclosure laws differ significantly across countries. Option C may be relevant in specialized donor-funded environments, but it is not the strongest general rule. Internal audit must control dissemination of results and protect confidentiality. Therefore, Option D is correct.

The CAE should first discuss the risk and its implications with the responsible management. This provides management the opportunity to reassess, take corrective action, or explain their position. If the issue remains unresolved and the risk is still deemed excessive, then escalation to senior management or the board may follow.

Option A (designing response) is management’s role. Option C (scheduling an audit) may be relevant later, but immediate discussion is the first step. Option D is premature without first engaging management.

Biometric access controls use unique physical or behavioral characteristics for identification and security. Among the listed options, retinal print comparison is the most unique and secure, as it relies on the intricate patterns of blood vessels in the retina, which are nearly impossible to replicate or alter.

(A) Facial comparison using photo identification.

Incorrect: Facial recognition is widely used but less unique than retinal scanning because it can be affected by lighting, aging, or facial hair.

IIA GTAG 9 – Identity and Access Management mentions facial recognition as a medium-security method.

(B) Signature comparison.

Incorrect: Signatures can be forged or changed over time, making this a low-security biometric method.

(C) Voice comparison.

Incorrect: Voice patterns are unique but can be affected by illness, background noise, or recording quality, reducing reliability.

(D) Retinal print comparison. (Correct Answer)

Retinal patterns are highly unique, more than fingerprints, and do not change over time.

Difficult to forge, making it the most secure biometric authentication method.

IIA GTAG 9 – Identity and Access Management ranks retinal scanning among the highest security biometric controls.

IIA GTAG 9 – Identity and Access Management: Discusses biometric authentication and ranks retinal scanning as one of the most secure options.

IIA Standard 2120 – Risk Management: Emphasizes strong authentication controls for access security.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) Retinal print comparison because it is the most unique, secure, and reliable biometric characteristic for authentication.

Risk analysis in internal audit planning is not based only on one factor, such as maximum possible loss or likelihood of occurrence. A proper comparative risk analysis considers multiple qualitative and quantitative risk factors, including judgment required by management, complexity of transactions, prior control issues, regulatory exposure, materiality, change, and susceptibility to fraud or error. Areas requiring significant management judgment usually carry higher inherent risk because estimates, assumptions, and subjective decisions may affect reporting, operations, and compliance. Option B is too narrow because the largest possible loss does not always represent the highest overall risk. Option C is also incomplete because likelihood alone ignores impact. Option D is incorrect because meaningful risk comparison can include qualitative assessment, not only numeric scoring. Therefore, Option A is the correct answer.