IIA Updated IIA-CIA-Part3 Exam Questions and Answers by alessia

A retained earnings policy determines how much of a company’s net income is retained (kept in the business) versus distributed to shareholders as dividends.

(A) Cash.

Incorrect: While retained earnings affect the company’s financial position, they do not directly impact cash flow, as retained earnings can be reinvested in non-cash assets.

(B) Dividends. (Correct Answer)

A retained earnings policy directly influences dividend payouts.

More retained earnings = lower dividends; less retained earnings = higher dividends.

IIA Standard 2110 (Governance) requires oversight of dividend policies as part of corporate governance.

COSO ERM – Risk Response suggests that dividend policies should align with strategic financial goals.

(C) Gross margin.

Incorrect: Gross margin is determined by revenue and cost of goods sold (COGS), not retained earnings.

(D) Net income.

Incorrect: Net income is calculated before retained earnings are determined, so the policy does not influence net income directly.

IIA Standard 2110 – Governance: Covers policies impacting financial distributions.

COSO ERM – Risk Response: Suggests that retained earnings policies influence financial stability and investor decisions.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because a retained earnings policy primarily affects the amount of dividends paid to shareholders.

A decentralized structure distributes decision-making authority across different business units, divisions, or geographical locations. While decentralization provides flexibility and autonomy, the primary risk is inconsistency in decision-making, as different units may develop their own policies, processes, and priorities that are not aligned with the organization's strategic goals.

(A) Inability to adapt.

Incorrect. Decentralization typically enhances adaptability, as individual units can quickly respond to local market conditions, customer needs, and emerging risks without waiting for corporate approval.

(B) Greater costs of control function.

Partially correct but not the primary risk. While decentralization may increase oversight costs (e.g., more auditors and compliance personnel), the primary issue is lack of uniform decision-making rather than costs alone.

(C) Inconsistency in decision making. ✅

Correct. When decision-making authority is spread across various units, inconsistencies arise in areas such as risk management, compliance, operational procedures, and resource allocation. This can lead to conflicts, inefficiencies, and misalignment with corporate strategy.

IIA Standard 2120 – Risk Management emphasizes the need for consistent risk oversight in all business units.

IIA GTAG "Auditing the Control Environment" warns that inconsistent policies weaken internal controls and governance.

(D) Lack of resilience.

Incorrect. A decentralized structure often improves resilience because decision-making is spread out, reducing dependency on a central authority. This allows units to function independently if one area experiences disruption.

IIA Standard 2120 – Risk Management

IIA GTAG – "Auditing the Control Environment"

COSO Framework – Internal Control Principles

Analysis of Answer Choices:IIA References:Thus, the correct answer is C, as decentralization introduces decision-making inconsistencies, affecting governance and strategic alignment.

Database backup methodologies ensure data protection and recovery in case of failures, system crashes, or cyber incidents. The most efficient method balances performance, storage, and recovery speed.

Incremental Backup on a Daily Basis (Correct Answer: D)

Incremental backups store only the changes made since the last backup.

This method saves storage space and reduces backup time, making it highly efficient for large production databases.

IIA Standard 2120 – Risk Management emphasizes that auditors must assess the efficiency and reliability of IT controls, including backup strategies.

This approach minimizes downtime and ensures the most recent data is available for recovery.

Why the Other Options Are Incorrect:

A. Disk Mirroring (Incorrect)

Disk mirroring (RAID 1) creates an exact real-time copy of data, but it is not a backup method—it only provides redundancy.

If corruption occurs in the database, the mirrored disk will also have corrupted data.

B. Weekly Differential Backup (Incorrect)

Differential backups store changes since the last full backup, but performing them only weekly means data loss could be significant if a failure occurs mid-week.

They consume more storage over time compared to incremental backups.

C. Independent Disk Array (Incorrect)

Redundant Arrays of Independent Disks (RAID) are primarily used for storage performance and fault tolerance, not as an efficient backup methodology.

RAID does not replace the need for incremental or full backups.

IIA Standard 2120 – Risk Management (Assessing IT controls, including backup and data recovery strategies)

IIA Standard 2110 – Governance (Ensuring IT risk management aligns with organizational objectives)

IIA Standard 2130 – Compliance (Verifying adherence to IT security and backup policies)

Step-by-Step Justification:IIA References for This Answer:Thus, the best answer is D. An incremental backup of the database on a daily basis, as it optimizes efficiency, reduces storage usage, and ensures up-to-date backups with minimal disruption.