IIA Updated IIA-CIA-Part3 Exam Questions and Answers by clayton

An IT disaster recovery plan (DRP) ensures business continuity by defining backup and recovery sites. These sites differ based on their level of readiness.

Let’s analyze the answer choices:

Option A: Frozen site

Incorrect. " Frozen site " is not a recognized term in IT disaster recovery planning. The three common categories are cold, warm, and hot sites.

Option B: Cold site

Correct.

A cold site is a designated recovery location that provides only basic facilities such as power, space, internet, and telecommunications.

It does not include servers, infrastructure, or pre-installed systems, meaning that it requires significant setup time before becoming operational.

IIA Reference: Business continuity and IT risk management frameworks classify cold sites as a cost-effective but slower disaster recovery option. (IIA GTAG: Business Continuity Management)

Option C: Warm site

Incorrect. A warm site includes some pre-installed hardware and software, allowing faster recovery compared to a cold site.

Option D: Hot site

Incorrect. A hot site is fully operational with real-time data replication, enabling an immediate switchover in case of disaster.

Analytical procedures involve evaluating financial and operational data by examining plausible relationships between numbers, trends, and industry benchmarks. These procedures assume that data relationships exist and will continue unless there is evidence to the contrary.

(A) Data relationships are assumed to exist and to continue where no known conflicting conditions exist. ✅

Correct. Analytical procedures rely on historical trends and logical relationships between data (e.g., revenue vs. expenses, payroll vs. employee count). If no unusual variations or red flags are observed, auditors assume continuity.

IIA GTAG " Auditing Business Intelligence " supports the assumption that data relationships persist unless evidence suggests otherwise.

(B) Analytical procedures are intended primarily to ensure the accuracy of the information being examined.

Incorrect. The primary goal of analytical procedures is not absolute accuracy but rather identifying trends, anomalies, and risks that require further investigation.

(C) Data relationships cannot include comparisons between operational and statistical data.

Incorrect. Operational and statistical data are commonly used in analytical procedures (e.g., comparing production output with raw material consumption, or customer transactions with website visits).

IIA GTAG " Data Analytics: Elevating Internal Audit Performance " highlights the importance of using both financial and operational data in analytical testing.

(D) Analytical procedures can be used to identify unexpected differences, but cannot be used to identify the absence of differences.

Incorrect. Analytical procedures can identify both unexpected variances and expected consistency. Auditors analyze trends, seasonal fluctuations, and relationships, detecting both errors and missing anomalies.

IIA GTAG – " Auditing Business Intelligence "

IIA GTAG – " Data Analytics: Elevating Internal Audit Performance "

IIA Standard 2320 – Analysis and Evaluation

Analysis of Answer Choices:IIA References:Thus, the correct answer is A, as analytical procedures assume data relationships exist and continue unless conflicting conditions arise.

A virtual private network allows users outside the office to securely send and receive data as though they were connected to the organization’s private internal network. VPNs commonly use encryption, tunneling, and authentication to protect remote access over public networks. A local area network is limited to a specific location such as an office or building. A wide area network links multiple locations over a broader geographic area, but it does not specifically describe secure remote access for employees. A global area network is broader and not the best fit for the described control. Internal auditors reviewing remote work should evaluate VPN configuration, encryption, authentication, logging, endpoint security, and access rights. Therefore, Option C is correct.

Effective business writing should communicate clearly, professionally, and efficiently without distracting the reader. A memorandum should focus attention on the message, evidence, recommendation, or decision required—not on the writer’s style. Therefore, drawing positive attention to the writing style is not a proper objective. The style should be appropriate, direct, respectful, and suited to the delivery method and audience. Treating receivers with respect supports professional communication and reduces resistance. Matching presentation and delivery helps ensure the message is received correctly. Developing ideas without overstatement supports accuracy, objectivity, and credibility. These principles are especially important in internal audit communications, where clarity and neutrality affect management acceptance and governance decisions. Therefore, Option A is the exception and the correct answer.