IIA Updated IIA-CIA-Part1 Exam Questions and Answers by travis

Internal audit can add significant value early in the system development lifecycle by advising management on appropriate control objectives. Early involvement allows control requirements relating to authorization, segregation of duties, data integrity, security, availability, audit trails, and regulatory compliance to be considered before system design is finalized. Internal audit should not define system architecture or components because those are management and technical development responsibilities. Detailed code review and preimplementation testing generally occur later in the SDLC and do not provide the same opportunity to influence control design proactively. By suggesting control objectives rather than designing or implementing specific controls, internal audit can provide advisory input while preserving management’s responsibility for the system. Therefore, option C represents the most appropriate early SDLC role.

If an internal auditor believes that the internal audit activity’s independence is impaired, the first action to take should be to discuss the impairment with the audit manager. This step is crucial as the audit manager can provide guidance, support, and potentially escalate the issue appropriately within the governance framework. It ensures that the concerns are addressed promptly and effectively within the internal audit function before reaching out to higher levels of management or the audit committee, maintaining a proper chain of communication and resolution.

The Institute of Internal Auditors (IIA) - International Standards for the Professional Practice of Internal Auditing

===============

The periodic presentation designed to strengthen fraud-resilience awareness is preventive because it seeks to influence behavior, increase awareness of fraud schemes, and discourage misconduct before it occurs. Preventive controls are intended to reduce the likelihood that an undesirable event will happen. A whistleblower hotline primarily supports detection and reporting after suspicious conduct is observed. A year-end reconciliation is also detective because it identifies discrepancies after transactions have been processed. Likewise, reviewing management-approved exceptions is a monitoring or detective activity because it evaluates whether prior decisions complied with delegated authority. The IIA’s fraud guidance emphasizes awareness, education, culture, and governance as important elements of fraud deterrence. Among the choices, the awareness presentation is the only control primarily designed to prevent fraudulent behavior before it occurs.

The installation of surveillance cameras over a door that provides entry to an area with hazardous materials, and a high risk of explosion, represents a preventive control. This control aims to deter unauthorized access and potential mishandling or sabotage, which could lead to dangerous incidents.

The IIA ' s guidance on different types of controls including preventive, detective, and corrective controls.