IIA Updated IIA-CIA-Part3 Exam Questions and Answers by merryn

Understanding Data Recovery and Security Risks:

Data must be protected, recoverable, and accessible when needed while maintaining security.

The best practice is to store encrypted backups offsite while keeping encryption keys separate but accessible.

Why Option D is Correct?

Storing encrypted data offsite (a few hours away) ensures protection against disasters (e.g., fire, cyberattacks, physical damage).

Keeping encryption keys at the organization ensures that recovery is quick and controlled without risking unauthorized access.

This aligns with the IIA ' s IT Audit Practices and ISO 27001 (Information Security Management), which emphasize separate storage of encrypted data and encryption keys for security and recoverability.

IIA Standard 2110 – Governance requires internal auditors to assess whether IT governance ensures the availability and security of critical data.

Why Other Options Are Incorrect?

Option A (Encrypted physical copies and keys stored together at the organization):

If both data and keys are in the same location, a disaster or breach would make recovery impossible.

Option B (Encrypted copies and keys stored in separate locations far away):

While secure, if encryption keys are stored too far, recovery could be delayed, impacting business continuity.

Option C (Encrypted usage reports in a cloud database):

This does not ensure full data recovery; it only provides logs and structure changes, not the actual data.

Storing encrypted data offsite while keeping encryption keys accessible onsite follows best IT security and disaster recovery practices.

IIA Standard 2110 supports evaluating IT governance, including data security and recovery controls.

Final Justification:IIA References:

IPPF Standard 2110 – Governance

ISO 27001 – Information Security Management

NIST SP 800-34 – Contingency Planning Guide for IT Systems

COBIT Framework – Data Security & Recovery Controls

The retention and maintenance of internal audit engagement records, including the period of time they must be kept, is governed by the internal audit activity’s policies and procedures. These policies provide guidance on record retention consistent with organizational requirements, legal and regulatory obligations, and professional standards.

The charter (Option A) defines purpose, authority, and responsibility but does not detail document retention. The annual plan (Option B) outlines engagements but not recordkeeping. The quality assurance and improvement program (Option D) addresses continuous improvement and compliance with standards, not retention guidelines.

Therefore, the correct source for document retention requirements is internal audit policies (Option C).

To optimize efficiency, the CAE should coordinate with other assurance providers such as compliance, quality assurance, and external auditors. This reduces duplication, minimizes disruption, and ensures resources are used effectively.

Option A may lead to unnecessary duplication rather than coordination. Option C contradicts IIA guidance, which emphasizes coordination (Standard 2050). Option D excludes areas entirely, which is inappropriate because internal audit must still assess whether reliance is valid.

Engaging communities of practice is most likely to gain support for process change because it involves the people who understand the work, influence peers, and can help translate change into practical operating behavior. Clear objectives and senior management support are important, but they may not create adoption if affected employees are not involved. Establishing competencies supports capability, but it does not by itself generate commitment. Communities of practice can surface concerns, share lessons, validate proposed changes, and build ownership across functions. Internal audit should recognize that successful process change depends on stakeholder engagement, communication, training, accountability, and monitoring. The action most directly linked to gaining broad support is engaging communities of practice. Therefore, Option B is correct.