IIA-CIA-Part3 IIA Internal Audit Function Free Practice Exam Questions (2026 Updated)

IT General Controls (ITGCs) refer to foundational IT controls that support the reliability and security of information systems across all applications. Systems development controls fall under ITGCs because they ensure that:

IT systems are developed, tested, and implemented securely.

Change management, system testing, and access controls are enforced before deployment.

Ensuring Secure Development Practices:

IIA GTAG 8: Auditing Application Controls states that strong systems development controls prevent unauthorized access and errors in IT systems.

Risk Mitigation in Software Changes:

IIA Standard 2110 – Governance requires IT governance to enforce security policies for system development.

Weak controls increase risks of security vulnerabilities and financial misstatements.

Alignment with COSO & COBIT Frameworks:

COBIT (Control Objectives for Information and Related Technologies) classifies systems development controls as an ITGC domain.

COSO Internal Control – Integrated Framework supports secure system change processes.

A. Error listings (Incorrect)

Reason: Error listings are application controls that detect transaction errors within specific processes. ITGCs support all systems, not just specific applications.

B. Distribution controls (Incorrect)

Reason: Distribution controls deal with physical/logistical distribution of information or resources, not core ITGC functions.

C. Transaction logging (Incorrect)

Reason: While transaction logging is important for data integrity and security, it is an application control, not a general IT control.

IIA GTAG 8: Auditing Application Controls – Defines IT general controls and application-specific controls.

IIA Standard 2110 – Governance – Requires secure IT development and governance structures.

COBIT & COSO Internal Control Frameworks – Classify system development controls as critical ITGCs.

Why is Answer D Correct?Analysis of Incorrect Answers:IIA References:Thus, the correct answer is D. Systems development controls.

The equity method is used when an investor owns between 20% and 50% of another company’s stock, indicating significant influence over the investee. Since the investor organization is purchasing 40% of the stock, it qualifies for this method.

(A) Cost method.

Incorrect: The cost method is used when the investor has less than 20% ownership and no significant influence.

(B) Equity method. (Correct Answer)

The equity method is required when the investor has significant influence over the investee (typically between 20% and 50% ownership).

Under this method, the investor records a proportional share of the investee’s profits and losses in its financial statements.

IIA Standard 2330 – Documenting Information recommends accurate financial reporting and appropriate accounting method selection.

(C) Consolidation method.

Incorrect: The consolidation method is used when the investor owns more than 50% of the stock, granting control over the investee.

(D) Fair value method.

Incorrect: The fair value method applies when investments are traded in active markets and do not grant significant influence.

IIA Standard 2330 – Documenting Information: Requires appropriate classification of financial investments.

GAAP & IFRS Accounting Standards: Mandate the equity method for ownership between 20% and 50% with significant influence.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) Equity method, as 40% ownership implies significant influence, requiring the use of this method.

Client/server environments often distribute application components across multiple servers, workstations, or network locations. A key change control requirement is ensuring that program versions are synchronized across the network so incompatible versions do not operate simultaneously. Version mismatch can cause processing errors, data corruption, security weaknesses, or failed interfaces. Emergency move procedures, user testing, and controlled migration from test to production are important in both client/server and mainframe environments. They are not unique to client/server architecture. Internal auditors reviewing change management should verify version control, release management, configuration baselines, rollback procedures, and documentation of distributed components. Because synchronization across multiple networked locations is the distinctive client/server concern, Option A is the correct answer.

Comprehensive and Detailed In-Depth Explanation:

An intranet is a private network used by an organization for internal communication and information sharing among employees. It is accessible only to authorized personnel within the company.

Option A (Extranet) – Allows external parties (e.g., suppliers, partners) to access limited information.

Option B (LAN) – Refers to a network infrastructure rather than controlled access.

Option D (Internet) – Is public and not restricted to internal personnel.

Thus, Option C (Intranet) is the correct answer as it ensures access only to organizational personnel.

The described situation is a classic social engineering attack, specifically a phishing or CEO fraud (business email compromise) attempt. Social engineering exploits human psychology rather than technical vulnerabilities. In this case, the attacker attempted to impersonate the CEO and trick the board member into making an unauthorized payment.

(A) Incorrect – A risk of spyware and malware.

Spyware and malware typically involve malicious software installed on a device, which is not the case here.

This attack relied on deception rather than malware to obtain unauthorized funds.

(B) Incorrect – A risk of corporate espionage.

Corporate espionage involves unauthorized data theft, sabotage, or insider threats.

The attacker here attempted financial fraud, not intellectual property theft.

(C) Incorrect – A ransomware attack risk.

Ransomware encrypts files and demands payment for decryption.

There is no mention of system encryption or ransom demands in this case.

(D) Correct – A social engineering risk.

The attacker impersonated the CEO and used urgency to manipulate the board member into processing a fraudulent payment.

This technique is a business email compromise (BEC) scam, a well-known social engineering tactic.

IIA’s GTAG (Global Technology Audit Guide) – Cybersecurity Risks and Controls

Discusses social engineering and its impact on financial fraud.

NIST Cybersecurity Framework – Social Engineering Threats

Defines social engineering tactics, including email impersonation and phishing.

COBIT Framework – Information Security Governance

Recommends controls to mitigate social engineering risks, such as employee training and email authentication mechanisms.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The project charter is created during project initiation. It formally authorizes the project, identifies the project purpose, high-level objectives, sponsor, authority of the project manager, key stakeholders, major assumptions, constraints, and initial scope direction. Scope planning and scope definition occur after initiation and develop the detailed project scope and work breakdown structure. Scope verification occurs later when completed deliverables are reviewed and accepted. Internal auditors reviewing project governance should confirm that major projects have approved charters before significant work begins. A charter supports accountability, authorization, alignment with strategy, and control over project objectives. Therefore, Option D is correct.

The control environment is most negatively affected when unrealistic performance targets pressure employees or management into questionable financial reporting. The control environment includes ethical values, integrity, tone at the top, management philosophy, accountability, and human resource practices. If management creates excessive pressure to meet targets, employees may rationalize manipulation or override controls. Monitoring, control activities, and risk assessment may also be affected, but the root problem is cultural and behavioral. Control activities cannot compensate fully for a weak tone at the top. Internal auditors should treat unrealistic targets, aggressive earnings pressure, and tolerance of questionable reporting as red flags for fraud risk and governance weakness. Therefore, the internal control component most negatively affected is the control environment, making Option D correct.

Physical and environmental controls protect IT assets from physical damage, unauthorized physical access, environmental hazards, and operational disruption. Fire detection and suppression, restricted access to tangible IT resources, and disaster recovery planning are relevant to this review. However, ensuring that a developer has access to both systems and operations is inappropriate because it violates segregation of duties. Developers should generally not have unrestricted operational access because they could introduce unauthorized changes, bypass testing, or manipulate production systems. Internal audit should identify excessive access as a control weakness, not a required control activity. Physical and environmental control reviews should include access badges, visitor logs, server room controls, power supply, fire protection, humidity control, and disaster recovery readiness. Therefore, Option D should not be part of the review.

In contract law, a witness ' s primary role is to confirm that the signatures on the contract were made by the actual parties (promisor and promisee) and that they signed it in the witness’s presence. This helps prevent disputes regarding forgery or coercion.

(A) A witness verifies the quantities of the copies signed.

Incorrect: The witness ' s role is not to verify how many copies were signed but rather to confirm authenticity.

(B) A witness verifies that the contract was signed with the free consent of the promisor and promisee.

Partially correct but not the primary role: The witness’s presence may discourage coercion, but their main function is not to confirm free consent (that is a legal principle covered by contract law and not necessarily the witness ' s duty).

(C) A witness ensures the completeness of the contract between the promisor and promisee.

Incorrect: The completeness of the contract is the responsibility of the parties involved, not the witness.

(D) A witness validates that the signatures on the contract were signed by the promisor and promisee. (Correct Answer)

This aligns with the legal definition of a witness in contract law: verifying the identity of signatories and ensuring that they physically signed the contract.

The witness does not interpret the contract ' s terms or validate its content, only the signatures.

IIA Standard 2410 – Criteria for Communicating: Requires auditors to confirm the authenticity and validity of documents.

IIA Standard 2330 – Documenting Information: Supports the principle of ensuring reliable and complete documentation.

Contract Law Principles: A witness’s role is to verify the signatories’ identities and confirm they signed the document in their presence.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (D) because a witness’s main duty is to validate that the contract was signed by the identified parties, ensuring authenticity and reducing legal disputes.

Comprehensive and Detailed In-Depth Explanation:

In data analytics, data cleaning involves identifying and correcting errors, inconsistencies, and redundancies in the dataset to ensure accuracy and reliability. By eliminating duplicate or irrelevant data, the internal auditor enhances the quality of the dataset, which is crucial for accurate analysis and risk assessment. This process is a preparatory step before analyzing the data to identify high-risk areas. Normalization (option A) refers to organizing data to reduce redundancy but is more specific to database design. Analyzing data (option B) and reviewing data prior to defining the question (option D) are steps that occur before and after data cleaning, respectively.

Transfer pricing regulations aim to prevent tax evasion and ensure that intercompany transactions reflect fair market value, preventing profit shifting to low-tax jurisdictions. Selling inventory at fair value (arm’s length price) aligns with regulatory requirements, reducing the risk of non-compliance.

(A) Correct – The organization sells inventory to an overseas subsidiary at fair value.

Ensuring that transactions reflect fair market value prevents regulatory violations.

Adhering to the arm’s length principle minimizes transfer pricing risks and potential tax penalties.

(B) Incorrect – The local subsidiary purchases inventory at a discounted price.

A discounted price could be seen as an attempt to shift profits between entities, increasing regulatory scrutiny.

(C) Incorrect – The organization sells inventory to an overseas subsidiary at the original cost.

Selling at the original cost does not account for market conditions, potential markup, and fair valuation.

Regulators may view this as non-compliance with the arm’s length principle.

(D) Incorrect – The local subsidiary purchases inventory at the depreciated cost.

Depreciated cost may not represent fair market value and could be interpreted as a tax avoidance mechanism.

IIA’s Global Internal Audit Standards – Compliance with Tax and Transfer Pricing Regulations

Emphasizes fair pricing in intercompany transactions to prevent regulatory violations.

OECD Transfer Pricing Guidelines

Reinforces the arm’s length principle as the standard for pricing related-party transactions.

COSO’s ERM Framework – Compliance Risk Management

Highlights the need for adherence to tax laws and fair-value pricing in financial transactions.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The QAIP (Quality Assurance and Improvement Program) requires both ongoing monitoring and periodic assessments. Among these, ongoing monitoring is the mechanism that ensures continuous evaluation of whether engagements are being performed with quality and in conformance with the Standards.

Option A (periodic assessments) review effectiveness but are not continuous. Option C (external assessments) and Option D (SAIV) are broader and periodic, not engagement-level consistency checks.

A network controls the routing of data packets between linked computers, servers, and other devices. Network infrastructure includes routers, switches, communication protocols, addressing, gateways, and transmission paths that allow data to move from one point to another. An operating system manages local computing resources and may support network communication, but it does not generally control packet routing across linked computers. The control environment is a governance concept within internal control and has nothing to do with packet routing. Application program code performs business logic or transaction processing inside an application, not general network routing. From an internal audit IT perspective, network controls are critical because they affect availability, security, segmentation, traffic flow, and data transmission reliability. Therefore, Option C is correct.

The internal audit procedures manual documents policies and procedures for conducting audit engagements, including steps to follow when issues arise, such as disputes with management regarding findings. It ensures consistency and standardization of audit practice.

Option A (strategic plan) and Option C (resources) are not part of audit procedures but rather part of planning or organizational documents. Option D (authority to collect data) belongs in the internal audit charter, not in the procedures manual.

Therefore, the correct answer is appropriate response options for disputes with management (Option B).

Effectiveness means achieving stated objectives. Efficiency means achieving results with optimal use of resources. The organization achieved its market share goal, so it was effective in reaching that objective. However, it failed to achieve the desired return on investment and output per labor hour, both of which indicate poor efficiency or resource productivity. Option A and B incorrectly frame the issue as a choice between capital investment and marketing. Option C is incorrect because the organization is not demonstrating efficiency; the poor output per labor hour shows the opposite. Internal audit should distinguish effectiveness from efficiency when evaluating performance. A process can achieve its goal while still using too many resources or generating weak returns. Therefore, Option D is correct.

Comprehensive and Detailed In-Depth Explanation:

The Internal Rate of Return (IRR) is the discount rate that makes the net present value (NPV) of a project equal to zero. It is used to evaluate the profitability of investments.

Option A (Annual cost of capital) – While related, the IRR should be compared directly to the required rate of return (hurdle rate).

Option B (Annual interest rate) – Not always relevant, as the cost of borrowing may differ from the required return on investments.

Option D (Compare to NPV) – NPV is a different method of capital budgeting; while related, it is not used for direct comparison with IRR.

Since the IRR is accepted if it meets or exceeds the required rate of return, Option C is correct.

Action plans should be agreed upon collaboratively, with both the responsible managers and senior management involved. Involving senior management earlier in the draft report and action plan stage ensures alignment on deadlines and accountability before final issuance.

Option A would reduce input and transparency. Option C creates fragmented reporting. Option D is excessive and bypasses proper reporting procedures.

The most effective CSR strategy for minimizing confrontations with activists and lobbyists is continual evaluation of stakeholder needs and opinions. Activists and lobbyists often challenge organizations when they believe stakeholder concerns are ignored, concealed, or handled reactively. Ongoing stakeholder engagement allows the organization to identify concerns early, understand expectations, adjust practices, and communicate credibly. Strict legal compliance is necessary but may not satisfy broader social expectations. Publicity campaigns can backfire if they appear superficial or unsupported by action. Philanthropy may build goodwill but does not address underlying stakeholder concerns. Internal audit can assess whether CSR governance includes stakeholder mapping, grievance mechanisms, transparent reporting, and escalation procedures. Therefore, Option A is correct.

Data Mining for Exploratory Purposes:

Exploratory data mining involves analyzing large datasets to identify trends, patterns, and risks before conducting specific audits.

Internal auditors use data mining to assess risks and determine potential audit subjects, making it a key input in audit planning.

Aligns with IIA Practice Guide on Data Analytics:

Exploratory analysis helps auditors prioritize areas with high-risk indicators.

Supports IIA Standard 2010 - Planning, which requires risk-based audit planning.

A. Internal auditors perform reconciliation procedures to support an external audit of financial reporting. (Incorrect)

Reconciliation is a procedural task, not an exploratory data mining activity.

Supports external audit rather than internal audit’s strategic risk assessment role.

B. Internal auditors perform a systems-focused analysis to review relevant controls. (Incorrect)

This relates more to evaluating control effectiveness rather than exploratory data mining.

Does not directly contribute to identifying new audit areas.

D. Internal auditors test IT general controls with regard to operating effectiveness versus design. (Incorrect)

Testing IT general controls is a structured evaluation, not an exploratory data mining technique.

Exploratory data mining is used to identify risks before formal testing occurs.

Explanation of Answer Choice C (Correct Answer):Explanation of Incorrect Answers:Conclusion:The best example of exploratory data mining by internal auditors is risk assessment for audit planning (Option C).

IIA References:

IIA Standard 2010 - Planning

IIA Practice Guide: Data Analytics

A cookie is a small text file or data object stored by a browser for a website or web application. Cookies often include expiration dates that determine how long they remain valid. Poorly designed cookies may contain sensitive information, session identifiers, or even stored clear text passwords, which creates confidentiality and authentication risk. A URL may expose parameters, but it is not normally described as having an expiration date in the same way. HTTP is a communication protocol, not stored credential data. A browser stores and processes web content, but the specific item with expiration and stored text values is the cookie. Internal auditors should evaluate secure cookie attributes, encryption, session management, and password storage controls. Therefore, Option A is correct.

Liquidity measures assess an organization’s ability to meet short-term obligations. Accounts receivable turnover indicates how quickly receivables convert to cash. Inventory turnover in days shows how long inventory remains before sale, affecting cash conversion. The current ratio compares current assets with current liabilities and directly indicates short-term financial capacity. Option A includes times interest earned and return on assets, which are solvency and profitability measures rather than liquidity measures. Option C includes return on assets, which is profitability-based. Option D includes return on equity, another profitability measure. Internal auditors reviewing liquidity risk should evaluate working capital, cash conversion cycle, receivable collection, inventory movement, and short-term debt pressure. Therefore, Option B is correct.

The FIFO (First-In, First-Out) method values inventory based on the assumption that older, lower-cost inventory is sold first, leaving newer, higher-cost inventory in stock. During periods of rising prices, FIFO results in lower cost of goods sold (COGS) and higher net income, making it susceptible to manipulation by management.

(A) Correct – First-in, first-out method (FIFO).

FIFO lowers COGS when older, cheaper inventory is sold first, inflating net income.

Management can manipulate earnings by selectively selling older, lower-cost inventory.

(B) Incorrect – Last-in, first-out method (LIFO).

LIFO assumes newer, higher-cost inventory is sold first, resulting in higher COGS and lower net income.

LIFO is typically used to reduce taxable income, not to inflate net income.

(C) Incorrect – Specific identification method.

This method tracks the exact cost of each unit, eliminating the ability to manipulate costs easily.

(D) Incorrect – Average-cost method.

The average-cost method smooths out fluctuations in inventory costs, preventing significant income manipulation.

IIA’s Global Internal Audit Standards – Financial Reporting and Inventory Valuation Risks

Discusses inventory accounting methods and their impact on financial statements.

IFRS and GAAP Accounting Standards – Inventory Valuation

Defines how FIFO can be used to influence financial performance.

COSO’s ERM Framework – Financial Manipulation Risks

Identifies inventory valuation as an area where earnings management can occur.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

When auditing logical access controls for a workstation, the focus should be on user authentication methods, including:

Password policies (length, complexity, change frequency)

User access rights and permissions

Login activity logs to detect unauthorized access attempts

Correct Answer (B - Reviewing Password Policies and User List for Login Process)

Logical access controls ensure only authorized users can access a workstation.

Reviewing password length, complexity, and change frequency helps assess if security best practices are followed.

Reviewing the list of authorized users ensures that only appropriate personnel have access.

The IIA’s GTAG 9: Identity and Access Management recommends evaluating password policies and user access lists as key control measures.

Why Other Options Are Incorrect:

Option A (Reviewing access badges and room logs):

Physical access controls are important but do not assess logical access (login security, user authentication).

Option C (Reviewing failed access attempts and error messages):

Reviewing failed login attempts identifies security breaches but does not directly assess password policies or user access lists.

Option D (Reviewing unsuccessful passwords and activity logs):

Passwords should not be reviewed due to privacy and security policies. Logs should be checked, but reviewing actual passwords is a security violation.

IIA GTAG 9: Identity and Access Management – Covers password controls and user authentication.

IIA Practice Guide: Auditing IT Security Controls – Recommends reviewing password policies as a key security measure.

Step-by-Step Explanation:IIA References for Validation:Thus, B is the correct answer because reviewing password policies and user lists is essential for auditing logical access controls.

In the context of big data governance, the responsibilities of various stakeholders are delineated as follows:

A. Management ' s Responsibilities:

Management holds the primary responsibility for establishing and maintaining effective data governance frameworks. This includes ensuring that information storage systems are appropriately defined and that processes for updating critical data elements are clear and well-documented. Such measures are essential to maintain data integrity, availability, and confidentiality. The Institute of Internal Auditors (IIA) emphasizes that management is accountable for the design and implementation of data governance structures, policies, and procedures. These structures should encompass data storage solutions and the mechanisms for updating and managing critical data elements.

The Institute of Internal Auditors

B. External Auditors ' Responsibilities:

External auditors are tasked with providing independent assurance on the effectiveness of an organization ' s financial reporting and related controls. While they may consider the implications of big data on financial reporting, their primary focus is not on the periodic monitoring and maintenance of analytical models. Instead, this responsibility typically falls under management or specialized internal functions. The IIA outlines that external auditors assess the overall control environment but do not directly manage or maintain analytical models.

C. The Board ' s Responsibilities:

The board of directors provides oversight and strategic direction for the organization ' s data governance initiatives. However, the implementation of specific controls around data quality dimensions is generally delegated to management. The board ensures that appropriate governance structures are in place and that management is effectively addressing data quality and governance issues. According to the IIA, the board ' s role is to oversee the data governance framework, ensuring that management has implemented effective controls and processes.

The Institute of Internal Auditors

D. Internal Auditors ' Responsibilities:

Internal auditors provide independent assurance on the effectiveness of governance, risk management, and control processes, including those related to data quality and security. While they assess and report on the adequacy of controls over data, the responsibility for ensuring data quality and security rests with management. The IIA states that internal auditors evaluate the effectiveness of data governance practices but do not hold primary responsibility for data quality and security.

The Institute of Internal Auditors

In summary, option A accurately reflects management ' s responsibility in big data governance, aligning with the IIA ' s guidelines on data governance roles and responsibilities.

During an audit of IT change management, the internal auditor should validate whether only authorized personnel can migrate changes into production. This directly tests segregation of duties, authorization, and production environment protection. Option B may be relevant in a patch management review, but it is narrower and not the most direct change management audit action. Option C is a management activity, not an internal audit responsibility. Option D is also management’s responsibility because internal audit should not update operating processes it may later audit. Effective change management requires proper request approval, testing, migration control, emergency change review, and post-implementation monitoring. Therefore, Option A is correct.

An intangible asset is an asset that lacks physical substance but has value due to its legal rights or expected economic benefits. Some intangible assets have finite useful lives (e.g., copyrights, patents) and are amortized, while others have indefinite useful lives and are not amortized but tested for impairment.

(A) Underground oil deposits. ❌

Incorrect. Oil deposits are natural resources, not intangible assets. They are classified as depletable assets because their value declines as they are extracted.

(B) Copyright. ❌

Incorrect. A copyright grants exclusive rights to reproduce and distribute creative works, but it has a finite legal life (typically 50-100 years, depending on jurisdiction). It is amortized over time.

(C) Trademark. ✅

Correct. A trademark (e.g., a company’s logo or brand name) is considered an indefinite-life intangible asset because it can be renewed indefinitely as long as the business continues to use it and follows renewal requirements.

According to IIA GTAG – " Auditing Intangible Assets " , trademarks are subject to impairment testing, but they are not amortized unless their useful life becomes definite.

(D) Land. ❌

Incorrect. Land is a tangible asset, not an intangible one. While it has an indefinite life, it does not fit the category of intangible assets.

IIA GTAG – " Auditing Intangible Assets "

IIA Standard 2130 – Control Activities (Asset Management)

IFRS and GAAP Guidelines – Indefinite and Finite-Lived Intangible Assets

Analysis of Answer Choices:IIA References:Thus, the correct answer is C (Trademark), as trademarks have indefinite lives unless there is evidence to the contrary.

Both hierarchies (traditional organizations with a clear chain of command) and open organizational structures (flatter, decentralized decision-making models) share certain fundamental management principles.

Let’s analyze each statement:

A superior can delegate the authority to make decisions but cannot delegate the ultimate responsibility for the results of those decisions.

Correct. In both hierarchical and open structures, managers can delegate decision-making authority, but they remain accountable for the outcomes.

IIA Reference: Internal auditors assess governance structures to ensure that accountability remains with senior management, even when authority is delegated. (IIA Standard 2110: Governance)

A supervisor ' s span of control should not exceed seven subordinates.

Incorrect. While some management theories suggest an ideal span of control, there is no universal limit of seven subordinates. The optimal number depends on factors like task complexity and organizational structure.

Responsibility should be accompanied by adequate authority.

Correct. Employees must have the necessary authority to fulfill their responsibilities effectively, regardless of the organizational structure.

IIA Reference: The IIA’s guidelines on effective governance and accountability emphasize the need for clear delegation of authority to ensure operational efficiency. (IIA Practice Guide: Organizational Governance)

Employees at all levels should be empowered to make decisions.

Incorrect. While this principle applies to open organizational structures, it does not align with traditional hierarchies, where decision-making authority is concentrated at higher levels.

Thus, the verified answer is A. 1 and 3 only.

An unsecured loan is borrowing that is not backed by specific collateral. Commercial paper is a short-term unsecured promissory note issued by financially strong organizations to meet working capital or short-term financing needs. Investors rely primarily on the issuer’s creditworthiness rather than pledged assets. A second mortgage is secured by real property, so Option A is not correct. Pledged accounts receivable involve assigning receivables as collateral, making Option C secured. Asset-based financing is explicitly secured by assets such as inventory, receivables, or equipment, so Option D is also incorrect. From an internal audit operations perspective, auditors should distinguish unsecured credit risk from collateralized borrowing when evaluating liquidity, debt covenants, and financing risk. Therefore, Option B is correct.