IIA Updated IIA-CIA-Part3 Exam Questions and Answers by aarav

Internal audit has a mandatory assurance responsibility to assess whether IT governance supports the organization’s strategies and objectives. IT governance remains the responsibility of the board and senior management, but internal audit must evaluate and provide assurance over its effectiveness. Therefore, Statement 1 is incorrect. Statement 2 is correct because it reflects internal audit’s required role. Statement 3 is too weak because the responsibility is not merely optional. Statement 4 is also correct because internal audit may perform advisory services related to IT governance, provided independence and objectivity are protected and management retains decision-making responsibility. Internal audit should evaluate IT strategy alignment, value delivery, risk management, resource management, and performance measurement. Therefore, the accurate combination is 2 and 4, making Option C correct.

Since senior management is about to make a final investment decision, they must be made aware of the transparency issue with tenders before approving the project. The CAE should raise the issue with senior management immediately, even if the full report is not yet complete, to ensure that governance decisions are based on accurate risk information.

Option A (risk officer) may be informed later but does not replace informing decision-makers. Option C ignores urgent risk exposure. Option D is incorrect because halting the audit would suppress critical information.

Debt investments refer to financial instruments where an investor lends money to an entity (corporation, government, or institution) in exchange for periodic interest payments and the repayment of the principal amount at maturity. These include:

Government bonds (such as U.S. Treasury bonds, municipal bonds, and sovereign bonds)

Corporate bonds

Certificates of deposit (CDs)

Commercial paper

A. Investments in the capital stock of a corporation → Incorrect. Capital stock represents ownership (equity investments), not debt investments.

C. Contents of an investment portfolio → Incorrect. A portfolio may contain both equity and debt investments, making this too broad to classify specifically as debt.

D. Acquisition of common stock of a corporation → Incorrect. Common stock is an equity investment, not a debt investment.

The IIA’s Global Internal Audit Standards on Investment Management and Risk Assessment highlight debt instruments as fixed-income securities.

International Financial Reporting Standards (IFRS 9 – Financial Instruments) classify bonds and loans as debt investments, distinct from equity instruments.

The Generally Accepted Accounting Principles (GAAP) – FASB ASC 320 specifies how to account for debt securities.

Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is B. Acquisition of government bonds.