IIA-CIA-Part3 IIA Business Knowledge for Internal Auditing Free Practice Exam Questions (2025 Updated)

Understanding BYOD Risks:

A Bring-Your-Own-Device (BYOD) policy allows employees to use personal devices (e.g., laptops, smartphones, tablets) for work.

This increases security risks such as unauthorized access, malware infections, data leakage, and non-compliance with IT security policies.

Why Option C (Detection and Authentication Controls) Is Correct?

Detection and authentication controls ensure that:

Only authorized devices can connect to the organization's network.

User authentication mechanisms (such as multi-factor authentication) verify identities before granting access.

Devices with security vulnerabilities are flagged and restricted.

This aligns with IIA Standard 2110 – Governance, which emphasizes IT security controls for risk mitigation.

ISO 27001 and NIST Cybersecurity Framework also recommend device authentication and monitoring for secure network access.

Why Other Options Are Incorrect?

Option A (Limit personal use of employee devices):

Limiting personal use does not fully address network security risks; malware can still infect devices.

Option B (Control access through approvals and reviews):

While access control is important, it does not mitigate the broader risks of compromised devices connecting to the network.

Option D (Software scans and patch reminders):

Patching is important, but it does not prevent unauthorized access or ensure authentication for devices.

Implementing device detection and authentication controls is the most effective way to mitigate security risks in a BYOD environment.

IIA Standard 2110 and ISO 27001 emphasize strong network security measures.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (IT Risk Management & BYOD Security)

ISO 27001 – Information Security Management

NIST Cybersecurity Framework – Access Control & Authentication

The Business Impact Analysis (BIA) plan is a key component of business continuity planning that identifies critical business processes and determines their Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).

Correct Answer (C - Business Impact Analysis Plan)

The BIA is a systematic process that identifies essential functions, assesses potential disruptions, and determines the recovery time requirements to ensure business continuity.

The Recovery Time Objective (RTO) defines the maximum acceptable downtime for critical business functions.

The Recovery Point Objective (RPO) identifies how much data loss is tolerable.

According to the IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management, a BIA is essential for assessing the financial, operational, and reputational impact of disruptions.

Why Other Options Are Incorrect:

Option A (Business Continuity Management Charter):

A charter defines the governance, responsibilities, and overall framework of business continuity but does not focus on RTOs or critical business processes.

Option B (Business Continuity Risk Assessment Plan):

A risk assessment identifies threats and vulnerabilities but does not define recovery time objectives.

While risk assessments inform the BIA, they do not replace it.

Option D (Business Case for Business Continuity Planning):

A business case justifies investment in continuity planning but does not map business processes to RTOs.

GTAG 10: Business Continuity Management – Defines BIA as the process for identifying critical business functions and their RTOs.

IIA Practice Guide: Auditing Business Continuity – Emphasizes the role of BIA in business resilience.

Step-by-Step Explanation:IIA References for Validation:Thus, the Business Impact Analysis (BIA) Plan (C) is the correct answer because it pairs critical business processes with recovery time objectives.

Understanding Management by Objectives (MBO):

MBO is a performance management approach where employees set clear, measurable goals aligned with organizational objectives.

Success depends on employee participation in goal-setting to increase motivation, commitment, and performance.

Why MBO Works Best with Employee Involvement:

Engagement and Accountability: Employees are more motivated and accountable when they help define their goals.

Alignment with Organizational Strategy: Ensures that goals at all levels support the company’s broader objectives.

Improved Communication: Encourages collaboration between management and employees, leading to better alignment of expectations.

Why Other Options Are Incorrect:

A. It is particularly helpful to management when the organization is facing rapid change:

MBO is not well-suited for rapidly changing environments, as predefined goals may become irrelevant quickly.

B. It is more successful when adopted by mechanistic organizations:

Mechanistic organizations (rigid structures, strict hierarchies) often struggle with MBO because it requires flexibility and employee participation.

D. It is particularly successful in environments that are prone to having poor employer-employee relations:

While MBO can improve communication, it is not a solution for poor employer-employee relations, as trust and collaboration are essential for its success.

IIA’s Perspective on Performance Management and Organizational Success:

IIA Standard 2120 – Risk Management emphasizes the need for effective goal-setting and employee involvement in performance assessment.

Balanced Scorecard Framework supports MBO principles by aligning employee performance with strategic objectives.

COSO ERM Framework highlights the importance of employee engagement in goal-setting to enhance decision-making and risk management.

IIA References:

IIA Standard 2120 – Risk Management & Employee Performance Assessment

COSO ERM – Performance & Risk Alignment

Balanced Scorecard Approach – Employee Participation in Goal Setting

Thus, the correct and verified answer is C. It is more successful when goal setting is performed not only by management, but by all team members, including lower-level staff.

A decentralized organizational structure distributes decision-making authority across different business units or geographic regions. One major advantage is the ability to tap into a larger talent pool, as decision-making is not restricted to headquarters, and leadership opportunities exist at multiple levels.

(A) Greater cost-effectiveness.

Incorrect. A decentralized structure often increases costs due to duplicate resources, additional oversight, and inefficiencies from fragmented decision-making.

(B) Increased economies of scale.

Incorrect. Centralized organizations benefit more from economies of scale because they can standardize processes and consolidate purchasing power. Decentralization reduces these benefits by spreading decision-making across multiple locations.

(C) Larger talent pool. ✅

Correct. Decentralization allows organizations to recruit, develop, and retain talent in different locations, rather than relying solely on headquarters for leadership roles.

This aligns with IIA Standard 2110 – Governance, which emphasizes the importance of leadership distribution and talent management in organizations.

(D) Strong internal controls.

Incorrect. Centralized structures typically have stronger internal controls, as decision-making and risk management are closely monitored. Decentralization increases the risk of inconsistent controls across different units.

IIA Standard 2110 – Governance

COSO Framework – Organizational Structure and Risk Management

IIA GTAG – "Auditing Business Strategy Alignment"

Analysis of Answer Choices:IIA References:Thus, the correct answer is C, as decentralization expands the talent pool by enabling local decision-making and leadership development.

Definition of Predictive Analytics:

Predictive analytics uses historical data, machine learning, and statistical algorithms to forecast future outcomes.

In the healthcare sector, it is used to predict patient readmission rates and identify those at high risk of needing additional treatment.

How Predictive Analytics Applies to Hospitals:

Hospitals analyze patient histories, symptoms, treatments, and recovery rates to determine the likelihood of readmission.

Predictive models help healthcare providers take proactive measures, such as tailored post-discharge care plans, to reduce readmission risks.

This leads to better patient outcomes and cost savings.

Why Other Options Are Incorrect:

B. Prescriptive analytics:

Prescriptive analytics goes beyond prediction and provides recommendations for action. In this case, the hospital is only determining which patients are likely to require additional treatment, not recommending treatments.

C. Descriptive analytics:

Descriptive analytics focuses on summarizing past data without making predictions. It would be used to report on past patient admissions but not to predict future readmissions.

D. Diagnostic analytics:

Diagnostic analytics analyzes the causes of past events but does not forecast future patient readmissions.

IIA’s Perspective on Data Analytics in Decision-Making:

IIA GTAG (Global Technology Audit Guide) on Data Analytics emphasizes the role of predictive analytics in risk assessment and operational efficiency.

COSO ERM Framework supports predictive modeling as part of strategic risk management.

IIA References:

IIA GTAG – Data Analytics in Risk Management

COSO Enterprise Risk Management (ERM) Framework

NIST Big Data Framework for Predictive Analytics

Analytical procedures involve evaluating financial and operational data by examining plausible relationships between numbers, trends, and industry benchmarks. These procedures assume that data relationships exist and will continue unless there is evidence to the contrary.

(A) Data relationships are assumed to exist and to continue where no known conflicting conditions exist. ✅

Correct. Analytical procedures rely on historical trends and logical relationships between data (e.g., revenue vs. expenses, payroll vs. employee count). If no unusual variations or red flags are observed, auditors assume continuity.

IIA GTAG "Auditing Business Intelligence" supports the assumption that data relationships persist unless evidence suggests otherwise.

(B) Analytical procedures are intended primarily to ensure the accuracy of the information being examined.

Incorrect. The primary goal of analytical procedures is not absolute accuracy but rather identifying trends, anomalies, and risks that require further investigation.

(C) Data relationships cannot include comparisons between operational and statistical data.

Incorrect. Operational and statistical data are commonly used in analytical procedures (e.g., comparing production output with raw material consumption, or customer transactions with website visits).

IIA GTAG "Data Analytics: Elevating Internal Audit Performance" highlights the importance of using both financial and operational data in analytical testing.

(D) Analytical procedures can be used to identify unexpected differences, but cannot be used to identify the absence of differences.

Incorrect. Analytical procedures can identify both unexpected variances and expected consistency. Auditors analyze trends, seasonal fluctuations, and relationships, detecting both errors and missing anomalies.

IIA GTAG – "Auditing Business Intelligence"

IIA GTAG – "Data Analytics: Elevating Internal Audit Performance"

IIA Standard 2320 – Analysis and Evaluation

Analysis of Answer Choices:IIA References:Thus, the correct answer is A, as analytical procedures assume data relationships exist and continue unless conflicting conditions arise.

Understanding Inventory Fraud Detection:

Inventory fraud typically involves overstatement or understatement of inventory, fictitious inventory transactions, or misappropriation of stock.

A key way to detect fraud is analyzing inventory adjustments (e.g., write-offs, missing stock, excess inventory) to identify unusual patterns or discrepancies.

Why Stratifying Inventory Adjustments by Warehouse is the Best Approach:

Identifies high-risk locations: Certain warehouses may show significantly higher inventory losses or adjustments, indicating possible fraud.

Detects manipulation: Fraudsters may manipulate inventory records to cover theft or misstatements.

Supports data-driven audit procedures: Stratification allows internal auditors to prioritize high-risk areas for deeper investigation.

Why Other Options Are Incorrect:

A. Analyze invoice payments just under individual authorization limits – Incorrect, as this technique detects fraudulent disbursements, not inventory fraud.

C. Analyze inventory invoice amounts and compare with approved contract amounts – Incorrect, as this method detects pricing or procurement fraud, not inventory manipulation.

D. Analyze differences discovered during duplicate payment testing – Incorrect, as this technique is used to detect billing fraud, not inventory fraud.

IIA’s Perspective on Fraud Detection and Internal Controls:

IIA Standard 2120 – Risk Management requires internal auditors to assess fraud risk, including inventory manipulation.

IIA GTAG (Global Technology Audit Guide) on Fraud Detection recommends data analytics for inventory monitoring.

COSO Internal Control Framework highlights inventory control as a key component of financial accuracy and fraud prevention.

IIA References:

IIA Standard 2120 – Risk Management & Fraud Detection

IIA GTAG – Data Analytics for Fraud Detection in Inventory

COSO Internal Control Framework – Inventory and Asset Management Controls

Thus, the correct and verified answer is B. Analyze stratification of inventory adjustments by warehouse location.

A one-time password (OTP) is a unique, temporary password that is valid for a single login session or transaction. It is commonly used in multi-factor authentication (MFA) systems to enhance security.

Correct Answer (D - When an Employee Uses a Key Fob to Produce a Token)

Key fobs generate a time-sensitive one-time password (OTP), which is used in conjunction with a traditional password to enhance security.

These devices are part of two-factor authentication (2FA) or multi-factor authentication (MFA) methods.

The IIA GTAG 9: Identity and Access Management discusses OTP tokens as a strong security control to prevent unauthorized access.

Why Other Options Are Incorrect:

Option A (When an employee accesses an online digital certificate):

Digital certificates authenticate users or devices, but they do not generate one-time passwords.

Option B (When an employee's biometrics have been accepted):

Biometric authentication (e.g., fingerprint, facial recognition) grants access based on biological traits, not an OTP.

Option C (When an employee creates a unique digital signature):

Digital signatures authenticate documents and transactions, but they are not time-sensitive one-time passwords.

IIA GTAG 9: Identity and Access Management – Covers OTP tokens as a security measure.

IIA Practice Guide: Auditing IT Security Controls – Recommends OTPs as part of secure authentication.

Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because key fobs generate one-time passwords for secure authentication.

Definition of Project Crashing:

Project crashing is a schedule compression technique used in project management to reduce the project completion time without changing its scope.

It involves adding extra resources (labor, equipment, budget) to critical path activities to complete them faster.

Key Aspects of Project Crashing:

Reduces project duration by increasing resources.

Leads to higher costs due to additional labor or expedited material procurement.

Used when project deadlines must be met and standard scheduling techniques are insufficient.

Why Other Options Are Incorrect:

A. It leads to an increase in risk and often results in rework:

While crashing can increase costs and risk, it does not necessarily result in rework unless poorly executed.

B. It is an optimization technique where activities are performed in parallel rather than sequentially:

This describes fast-tracking, not crashing. Fast-tracking involves overlapping tasks, while crashing adds resources to speed up tasks.

C. It involves a revaluation of project requirements and/or scope:

Crashing does not change project scope; it only shortens the schedule by allocating additional resources.

IIA’s Perspective on Project Risk and Management:

IIA Standard 2110 – Governance emphasizes the importance of project risk assessment, including schedule compression risks.

COSO ERM Framework identifies project cost overruns and resource misallocations as key risks in project execution.

PMBOK (Project Management Body of Knowledge) defines crashing as a schedule compression technique used when deadlines must be met at additional cost.

IIA References:

IIA Standard 2110 – Governance & Risk Oversight in Project Management

COSO Enterprise Risk Management (ERM) – Project Risk Considerations

PMBOK Guide – Schedule Compression Techniques (Crashing & Fast-Tracking)

Thus, the correct and verified answer is D. It is a compression technique in which resources are added so the project is completed faster.

A disaster recovery plan (DRP) ensures that critical systems and data can be restored after an incident. If backup plans exist but no recovery and restore processes are defined, then the organization lacks a functional recovery plan altogether.

(A) Hot recovery plan.

Incorrect. A hot recovery plan includes real-time data replication and immediate failover systems, allowing for almost instant recovery in case of an outage. Since the scenario mentions that no restore process is defined, this cannot be a hot recovery plan.

(B) Warm recovery plan.

Incorrect. A warm recovery plan involves regular backups and a standby system that can be activated within hours or days. However, without defined restore procedures, the organization does not even have a warm recovery plan.

(C) Cold recovery plan.

Incorrect. A cold recovery plan means that backups exist but recovery takes significant time because systems and infrastructure need to be rebuilt. However, a cold plan still includes a recovery process, which the scenario lacks.

(D) Absence of recovery plan. ✅

Correct. If data backup plans exist but no restore processes are defined, then there is no functional recovery plan. Without a structured approach to data recovery, backups alone are useless in an actual disaster scenario.

IIA GTAG "Business Continuity and Disaster Recovery" highlights the need for detailed recovery processes as part of an overall disaster recovery plan.

IIA GTAG – "Business Continuity and Disaster Recovery"

IIA Standard 2120 – Risk Management

COBIT Framework – IT Disaster Recovery Controls

Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as data backups without recovery procedures indicate the absence of a recovery plan.

Under the variable costing method, product costs include only costs that vary with production, such as direct materials, direct labor, and variable manufacturing overhead.

(1) Direct labor costs. ✅

Correct. Direct labor is a variable cost directly tied to production levels, making it a product cost under variable costing.

(2) Insurance on a factory. ❌

Incorrect. Factory insurance is a fixed manufacturing overhead cost, which is not treated as a product cost under variable costing. It is considered a period cost instead.

(3) Manufacturing supplies. ✅

Correct. Manufacturing supplies (e.g., lubricants, small tools) are variable costs that increase with production, making them product costs under variable costing.

(4) Packaging and shipping costs. ❌

Incorrect. Packaging and shipping are selling & distribution costs, which are classified as period costs, not product costs.

IIA GTAG – "Auditing Cost Accounting Systems"

IIA Standard 2130 – Control Activities (Cost Management)

GAAP and IFRS Guidelines on Variable Costing

Analysis of Answer Choices:IIA References:Thus, the correct answer is B (1 and 3 only) because direct labor and manufacturing supplies are considered product costs under the variable costing method.

A physical control is a security measure designed to protect assets, facilities, and personnel from physical threats such as fire, theft, or unauthorized access. Fire detection and suppression equipment (e.g., fire alarms, sprinklers, extinguishers) directly protects physical assets, making it a clear example of a physical control.

(A) Providing fire detection and suppression equipment. ✅

Correct. This is a direct physical security control that helps mitigate fire risks by detecting and suppressing fires.

IIA GTAG "Physical Security and IT Asset Protection" identifies fire detection as an essential physical security measure.

(B) Establishing a physical security policy and promoting it throughout the organization. ❌

Incorrect. A policy is an administrative control, not a physical control. While important, it does not provide direct physical protection.

(C) Performing business continuity and disaster recovery planning. ❌

Incorrect. This is a procedural control, not a physical one. Planning for disasters does not physically secure assets but instead prepares an organization for recovery.

(D) Keeping an offsite backup of the organization's critical data. ❌

Incorrect. This is an IT security control, ensuring data availability rather than physically protecting assets.

IIA GTAG – "Physical Security and IT Asset Protection"

IIA Standard 2110 – Governance (Risk Management Controls)

COBIT Framework – Physical and Environmental Security Controls

Analysis of Answer Choices:IIA References:Thus, the correct answer is A, as fire detection and suppression equipment provides direct physical protection against fire-related risks.

The matching principle is a fundamental accounting concept that ensures that expenses are recorded in the same period as the revenues they help generate.

Why Option C (Expense recognition is tied to revenue recognition) is Correct:

The matching principle states that expenses should be recognized in the same period as the revenue they help generate to ensure accurate financial reporting.

This principle is applied in accrual accounting under GAAP and IFRS, ensuring that expenses and revenues are properly aligned.

Why Other Options Are Incorrect:

Option A (Revenues should be recognized when earned):

This describes the revenue recognition principle, not the matching principle.

Option B (Revenue recognition is matched with cash):

Incorrect because the matching principle applies to accrual accounting, not cash accounting. Revenue can be recognized before cash is received.

Option D (Expenses are recognized at each accounting period):

Incorrect because expenses are not necessarily recognized in every period; they are matched to revenue.

IIA Practice Guide – "Auditing Financial Reporting Controls": Discusses the importance of the matching principle.

GAAP & IFRS Accounting Standards: Define and require the application of the matching principle.

COSO Internal Control Framework: Emphasizes revenue-expense alignment for accurate financial reporting.

IIA References:

Access control is about ensuring that only authorized individuals can access specific data, based on their role and necessity. The Principle of Least Privilege (PoLP) dictates that users should only have access to the data they need for their job.

Minimizes Unauthorized Access Risks – Prevents employees from accessing sensitive data unnecessarily.

Supports Segregation of Duties (SoD) – Critical in preventing fraud and security breaches.

Enhances Compliance – Meets regulatory requirements like GDPR, PCI-DSS, and SOX, which demand strict access controls.

Strengthens System Security – Reduces potential damage from malware, insider threats, or data breaches.

A. Install and update anti-virus software – Important for cybersecurity but does not directly control user access.

B. Implement data encryption techniques – Protects stored or transmitted data but does not define access rights.

D. Upgrade firewall configuration – Controls network traffic, not user-specific access within an automated system.

IIA’s GTAG on Access Management and Controls – Recommends setting data access based on user needs to prevent fraud and misuse.

COBIT 2019 (Governance and Management of Enterprise IT) – Advocates for role-based access controls.

ISO 27001 Annex A.9 (Access Control) – Stresses the importance of restricting access based on business requirements.

Why Setting Data Availability by User Need is the Best Strategy?Why Not the Other Options?IIA References:✅ Final Answer: C. Set data availability by user need.

A Value-Added Network (VAN) is a third-party network service that securely connects an organization with its trading partners, facilitating secure electronic data interchange (EDI) and business communications.

(A) Value-added network (VAN). (Correct Answer)

A VAN is a private, managed network service that provides secure data transmission between business partners.

It is commonly used for B2B transactions, supply chain management, and EDI.

IIA GTAG 7 – IT Outsourcing recognizes VANs as critical third-party networks for secure business data exchange.

(B) Local area network (LAN).

Incorrect: A LAN connects computers within a limited area (e.g., an office or building), but it is not designed for external trading partner connections.

(C) Metropolitan area network (MAN).

Incorrect: A MAN covers a city or region, but it is not designed for B2B communication.

(D) Wide area network (WAN).

Incorrect: A WAN connects multiple geographic locations, but it is a general networking term, not specific to trading partner communications.

IIA GTAG 7 – IT Outsourcing: Discusses the use of third-party networks like VANs for secure data exchange.

IIA Standard 2110 – Governance: Recommends secure third-party integration for business continuity and security.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (A) Value-Added Network (VAN) because it is specifically designed for secure communication between an organization and its trading partners.

A high-risk user-developed application (UDA) refers to spreadsheets or other tools created and maintained by end-users (not IT) that are critical to financial reporting, decision-making, or regulatory compliance. The IIA guidance on IT risk management emphasizes evaluating the complexity, significance, and control environment of such applications.

(A) Revenue Calculation Spreadsheet

Uses price and volume reports from production, meaning it relies on structured, external sources, reducing the risk of significant undetected errors.

Less complexity and external verification reduce its risk level.

(B) Asset Retirement Calculation Spreadsheet (Correct Answer)

Contains multiple formulas and assumptions, making it complex and prone to errors.

Assumptions introduce subjectivity and risk of incorrect calculations, affecting financial statements and compliance.

No automated controls or independent validations, making it a high-risk UDA.

IIA Standard 2110 – Governance and GTAG 14 (Auditing User-Developed Applications) emphasize assessing high-risk spreadsheets that impact financial decision-making.

(C) Ad-Hoc Inventory Listing Spreadsheet

Used for written-off inventory, which is historical data and not a key financial driver.

Limited impact on financial reporting, making it a low-risk UDA.

(D) Accounts Receivable Reconciliation Spreadsheet

Used by the accounting manager to verify balances, likely cross-checked with ERP or other financial systems.

Since external reconciliation exists, the spreadsheet does not pose a high inherent risk.

GTAG 14 (Auditing User-Developed Applications) – Identifies UDAs with complex formulas, financial impact, and lack of controls as high-risk.

IIA Standard 2110 (Governance) – Internal auditors must assess governance around financial and operational risk management, including IT risks.

IIA Standard 2120 (Risk Management) – Emphasizes identifying and mitigating risks from user-developed applications.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) Asset Retirement Calculation Spreadsheet, as it aligns with IIA guidance on high-risk spreadsheets due to complex formulas, assumptions, and potential financial misstatements.

A detective control is a security measure that identifies and alerts an organization to potential cyberthreats after they occur but before they cause harm. Detective controls do not prevent attacks but help detect them in a timely manner.

Why Option B (Monitoring for vulnerabilities based on industry intelligence) is Correct:

Continuous monitoring for vulnerabilities helps detect emerging threats, security breaches, and weaknesses in IT systems.

Uses threat intelligence feeds, security information and event management (SIEM) systems, and intrusion detection systems (IDS).

Helps organizations respond quickly to cyberattacks by identifying patterns, suspicious activity, or known vulnerabilities.

Why Other Options Are Incorrect:

Option A (A list of trustworthy, good traffic and a list of unauthorized, blocked traffic):

Incorrect because this describes a whitelisting/blacklisting technique, which is a preventive control, not a detective control.

Option C (Comprehensive service level agreements with vendors):

Incorrect because service level agreements (SLAs) ensure contractual obligations, but do not detect security threats.

Option D (Firewall and other network perimeter protection tools):

Incorrect because firewalls are preventive controls, designed to block unauthorized access, not detect threats after they occur.

IIA GTAG – "Auditing Cybersecurity Risks": Discusses detective controls such as vulnerability monitoring and threat intelligence.

COBIT 2019 – DSS05 (Manage Security Services): Recommends continuous monitoring for cyber threats as a detective control.

NIST Cybersecurity Framework – Detect Function: Highlights vulnerability management and threat monitoring as key detective measures.

IIA References:Thus, the correct answer is B. Monitoring for vulnerabilities based on industry intelligence.

A spear phishing attack is a targeted email attack aimed at a specific individual, organization, or business. Unlike general phishing, which casts a wide net, spear phishing is highly personalized and designed to deceive the recipient into providing sensitive information.

Personalization – The email references a golf membership renewal, making it relevant and believable to the recipient.

Social Engineering – The attacker exploits the victim’s trust by pretending to be a legitimate entity.

Malicious Link – The victim clicks a fraudulent hyperlink and enters sensitive credit card details.

Financial Fraud – The goal is to steal payment information, leading to unauthorized transactions.

A. Numerous and consistent attacks on the company’s website caused the server to crash.

This describes a Denial-of-Service (DoS) attack, not spear phishing.

B. A person posing as an IT help desk representative called employees and played a generic message requesting passwords.

This describes vishing (voice phishing) rather than spear phishing.

D. Many users of a social network service received fake notifications about a new investment opportunity.

This is general phishing, as it targets multiple users instead of one individual.

IIA’s GTAG (Global Technology Audit Guide) on Cybersecurity – Emphasizes the risk of spear phishing in cyber fraud.

NIST SP 800-61 (Computer Security Incident Handling Guide) – Defines spear phishing as a highly targeted attack method.

COBIT 2019 (Governance and Management of IT) – Highlights social engineering risks in IT security.

Why Option C is Correct?Why Not the Other Options?IIA References:✅ Final Answer: C. A person received a personalized email regarding a golf membership renewal, and he clicked a hyperlink to enter his credit card data into a fake website.

A highly centralized organization is one where decision-making authority is concentrated at the top management level, with lower levels having minimal autonomy. This change means that most critical decisions are made at the corporate level, and lower-level managers have limited decision-making power.

(A) Incorrect – Top management does little monitoring of the decisions made at lower levels.

In a centralized organization, top management monitors and controls most decisions.

This statement applies more to decentralized structures where decision-making is distributed.

(B) Incorrect – The decisions made at the lower levels of management are considered very important.

In a centralized structure, decisions made at lower levels hold less significance since authority is concentrated at the top.

(C) Correct – Decisions made at lower levels in the organizational structure are few.

Centralized structures limit decision-making power at lower levels, keeping control with top executives.

Lower-level managers mostly follow directives from upper management rather than making independent decisions.

(D) Incorrect – Reliance is placed on top management decision-making by few of the organization’s departments.

In a centralized system, most (not just a few) departments rely on top management for decision-making.

IIA’s Global Internal Audit Standards – Organizational Governance and Decision-Making

Explains centralized vs. decentralized structures and their impact on risk management.

COSO’s ERM Framework – Governance and Decision Authority

Discusses the implications of centralization on strategic decision-making.

IIA’s Guide on Corporate Governance and Internal Control Frameworks

Highlights the effect of centralization on accountability, oversight, and risk management.

Analysis of Answer Choices:IIA References and Internal Auditing Standards: