IIA Updated IIA-CIA-Part3 Exam Questions and Answers by merryn

According to the Standards, internal audit activities can be provided through in-house resources, outsourcing, or a co-sourcing model. Therefore, it is possible for all resources to come from outside the organization, but ultimate responsibility and accountability remain with the CAE, management, and the board.

Option A is incorrect because oversight cannot be outsourced. Option B is incorrect—coordination with other assurance providers typically increases efficiency. Option D misstates requirements; co-sourcing is an option, not a mandatory practice.

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and maintained by end-users (not IT) that are critical to financial reporting, decision-making, or regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the complexity, significance, and control environment of such applications.

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources, reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-developed applications.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial misstatements.

Comprehensive and Detailed In-Depth Explanation:

Primary controls in spreadsheet management focus on ensuring data accuracy, integrity, and security.

Option A (Locking formulas and static data) prevents unauthorized changes, ensuring data integrity. This is a direct control over spreadsheet accuracy, making it the correct answer.

Option B (Backup storage) is an IT operational control, not a primary financial reporting control.

Option C (Documentation of spreadsheet use) is important for governance but does not directly prevent errors.

Option D (Version control software) helps manage changes but does not directly ensure financial reporting accuracy.

Thus, locking and protecting spreadsheet formulas is the most critical primary control for accurate financial reporting.

Vertical integration occurs when a company expands its operations into a different stage of its supply chain. In this case, the restaurant is moving from relying on third-party delivery services to handling its own delivery operations, which is an example of backward vertical integration (taking control of a process previously handled by an external provider).

(A) Incorrect – Diversification.

Diversification refers to entering a completely different industry or market (e.g., a restaurant launching a grocery store).

In this case, the restaurant is expanding within the same industry by adding delivery services.

(B) Correct – Vertical integration.

Vertical integration happens when a company takes control of another step in its supply chain.

Since the restaurant is now handling its own deliveries instead of outsourcing, this is an example of backward vertical integration.

(C) Incorrect – Risk avoidance.

Risk avoidance means eliminating an activity entirely to prevent exposure to risk (e.g., deciding not to offer delivery at all).

The restaurant is not avoiding risk but taking on additional responsibilities.

(D) Incorrect – Differentiation.

Differentiation is a strategy focused on making a product/service unique to stand out from competitors.

The restaurant is not introducing a unique feature but integrating delivery operations.

IIA’s Global Internal Audit Standards – Business Strategy and Risk Management

Defines vertical integration and its impact on operational control.

COSO’s ERM Framework – Strategic Risk Considerations

Discusses how vertical integration influences business risks and cost control.

Porter’s Competitive Strategies – Vertical Integration Analysis

Explains backward and forward integration in supply chain management.

Analysis of Answer Choices:IIA References and Internal Auditing Standards: