IIA Updated IIA-CIA-Part3 Exam Questions and Answers by emilio

Periodic testing of backup media is a recognized backup best practice because backups have value only if data can actually be restored when needed. Media may be corrupted, incomplete, unreadable, encrypted incorrectly, or incompatible with recovery systems. Performing full backups on weekdays is not universally a best practice; backup frequency and type should be based on recovery objectives and system criticality. Storing backups only onsite is weak because a local disaster may destroy both production systems and backups. Verifying retrieval within seven years is too arbitrary; retention should be based on legal, regulatory, operational, and recovery requirements. Internal auditors should review backup schedules, offsite storage, encryption, media integrity, restore testing, and retention. Therefore, Option B is correct.

The auditor used an analytics tool to examine vendor payment transactions over 24 months and identify the top five vendors receiving the highest payments. This process involves examining, summarizing, and interpreting data, which falls under data analysis.

(A) Process analysis. ❌

Incorrect. Process analysis focuses on evaluating the workflow, efficiency, and control effectiveness of a business process, rather than analyzing data trends.

Example: Reviewing how invoices are processed to identify bottlenecks.

(B) Process mining. ❌

Incorrect. Process mining uses event logs and transactional data to analyze workflow patterns and deviations from standard procedures.

Example: Identifying inefficiencies in an invoice approval workflow.

(C) Data analysis. ✅

Correct. The auditor reviewed historical transaction data and extracted meaningful insights (i.e., the top five vendors by payment volume).

IIA GTAG – " Data Analytics: Elevating Internal Audit Performance " describes data analysis as using structured financial and operational data to identify trends, risks, or anomalies.

(D) Data mining. ❌

Incorrect. Data mining involves advanced statistical or machine learning techniques to discover hidden patterns in data, whereas data analysis focuses on summarizing and interpreting known data.

Example: Identifying fraudulent transactions using predictive modeling.

IIA GTAG – " Data Analytics: Elevating Internal Audit Performance "

IIA Standard 2320 – Analysis and Evaluation

COSO Framework – Data-Driven Internal Auditing

Analysis of Answer Choices:IIA References:Thus, the correct answer is C (Data analysis), as the auditor examined past transactions to summarize and interpret payment trends.

The CAE must communicate the results of the QAIP to the board and senior management. This includes results from ongoing monitoring, periodic self-assessments, and external assessments.

Option A (board oversight) is part of governance but not a QAIP requirement. Option B is incorrect because conformance is assessed for the activity overall, not per engagement. Option C is incorrect because self-assessments are ongoing, while external assessments are required at least once every five years.

Thus, the essential QAIP requirement for conformance is reporting results to the board (Option D).