IIA-CIA-Part3 IIA Internal Audit Function Free Practice Exam Questions (2026 Updated)

Comprehensive and Detailed In-Depth Explanation:

Job rotation involves periodically moving employees between different tasks, roles, or departments to increase engagement, reduce boredom, and enhance skill development.

Option A (Job specification) – Defines job responsibilities but does not address boredom.

Option B (Job objectives) – Focuses on performance goals rather than task variety.

Option D (Job description) – Simply documents job roles without changing daily tasks.

Thus, job rotation (Option C) is the most effective strategy for overcoming monotony and job-related boredom.

A one-time password (OTP) is a unique, temporary password that is valid for a single login session or transaction. It is commonly used in multi-factor authentication (MFA) systems to enhance security.

Correct Answer (D - When an Employee Uses a Key Fob to Produce a Token)

Key fobs generate a time-sensitive one-time password (OTP), which is used in conjunction with a traditional password to enhance security.

These devices are part of two-factor authentication (2FA) or multi-factor authentication (MFA) methods.

The IIA GTAG 9: Identity and Access Management discusses OTP tokens as a strong security control to prevent unauthorized access.

Why Other Options Are Incorrect:

Option A (When an employee accesses an online digital certificate):

Digital certificates authenticate users or devices, but they do not generate one-time passwords.

Option B (When an employee ' s biometrics have been accepted):

Biometric authentication (e.g., fingerprint, facial recognition) grants access based on biological traits, not an OTP.

Option C (When an employee creates a unique digital signature):

Digital signatures authenticate documents and transactions, but they are not time-sensitive one-time passwords.

IIA GTAG 9: Identity and Access Management – Covers OTP tokens as a security measure.

IIA Practice Guide: Auditing IT Security Controls – Recommends OTPs as part of secure authentication.

Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because key fobs generate one-time passwords for secure authentication.

Activity-Based Costing (ABC) is a cost allocation method that assigns overhead costs based on activities that drive costs rather than using a single volume-based measure like labor hours or machine hours. It provides a more accurate allocation of indirect costs to products or services.

ABC Costing and Its Flexibility (Correct Answer: C)

ABC can be applied to both job order costing (which tracks costs for individual products or projects) and process costing (which tracks costs across continuous production processes).

IIA Standard 2120 – Risk Management suggests that internal auditors evaluate whether cost allocation methodologies align with business objectives and financial accuracy.

ABC improves cost accuracy by assigning overhead to specific activities, making it useful in different costing systems.

Why the Other Options Are Incorrect:

A. " ABC is similar to conventional costing in how it treats overhead allocation. " (Incorrect)

Traditional costing allocates overhead based on a single cost driver, such as direct labor or machine hours.

ABC allocates overhead based on multiple activity drivers, making it more precise.

B. " ABC uses a single unit-level basis to allocate overhead. " (Incorrect)

ABC does not rely on a single unit-level measure.

Instead, it uses multiple cost drivers at different levels (unit-level, batch-level, product-level, and facility-level).

D. " The primary disadvantage of ABC is less accurate product costing. " (Incorrect)

ABC is actually more accurate than traditional costing in assigning overhead costs.

The primary disadvantages of ABC are its complexity and cost of implementation, not reduced accuracy.

IIA Standard 2120 – Risk Management (Assessing the appropriateness of costing methodologies)

IIA Standard 2130 – Compliance (Ensuring financial management practices align with standards)

IIA Standard 2210 – Engagement Objectives (Evaluating financial controls and cost allocation methods)

Step-by-Step Justification:IIA References for This Answer:Thus, the best answer is C. An ABC costing system may be used with either a job order or a process cost accounting system, as ABC is flexible and can be applied in both costing environments.

Comprehensive and Detailed In-Depth Explanation:

Physical and environmental IT controls focus on securing IT infrastructure against unauthorized access and environmental hazards. Locating servers in locked rooms with restricted admission protects hardware from theft, tampering, and environmental risks.

Option B (Applying encryption) – A logical security control, not a physical one.

Option C (Access rights allocation) – A logical control related to identity management.

Option D (Software patch control) – Part of IT governance and system maintenance, not physical security.

Since physical access control is a critical component of IT security, Option A is correct.

Customer departmentalization groups organizational activities based on customer type or customer segment. In this case, community banking, institutional banking, and agricultural banking represent different customer groups with distinct needs, products, risk profiles, regulatory requirements, and service expectations. Product departmentalization would group activities by products or services, such as loans, deposits, or wealth management. Process departmentalization would group work by process steps, such as underwriting, processing, and servicing. Functional departmentalization groups activities by functions such as finance, operations, human resources, or marketing. Internal auditors need to understand departmentalization because it affects accountability, performance reporting, risk ownership, and control design. Since the bank is organized around customer categories, the correct answer is customer departmentalization, Option D.

In data analytics, cleaning the data is a crucial step where the auditor eliminates redundancies, corrects inconsistencies, and removes errors to ensure accurate analysis. This step is taken before analyzing the data to identify high-risk areas and relevant processes.

Correct Answer (C - Cleaning the Data in Preparation for Determining Involved Processes)

Data cleaning involves:

Removing duplicate entries to prevent misinterpretation.

Standardizing data formats for consistency.

Handling missing or inaccurate values to ensure reliability.

This step prepares the data for analysis and identification of high-risk processes.

The IIA’s GTAG 16: Data Analysis Technologies emphasizes data cleaning as a critical part of internal audit analytics.

Why Other Options Are Incorrect:

Option A (Normalizing data in preparation for analyzing it):

Normalization refers to structuring data efficiently (e.g., in databases) but does not necessarily involve eliminating redundancies in the way described.

Option B (Analyzing data in preparation for communicating results):

The auditor is still in the data preparation phase, not the analysis or reporting phase.

Option D (Reviewing data prior to defining the question):

The auditor is already working with data. Defining questions typically happens before data collection.

GTAG 16: Data Analysis Technologies – Covers data preparation, cleaning, and analytics in internal auditing.

IIA Practice Guide: Data Analytics in Internal Auditing – Outlines best practices for data validation and cleaning.

Step-by-Step Explanation:IIA References for Validation:Thus, cleaning the data (C) is the correct answer, as it ensures data integrity before identifying relevant processes and risks.

Overseas production usually has the highest market-entry cost because it may require investment in foreign facilities, equipment, employees, supply chains, local compliance, management infrastructure, tax planning, and operational controls. It also exposes the organization to political, currency, labor, environmental, and regulatory risks. Exporting is generally less costly because products are produced domestically and sold abroad. Licensing usually requires lower investment because the licensee performs production or distribution in exchange for fees or royalties. Joint ventures may involve shared costs and risks with a local partner, making them less costly than wholly owned overseas production in many cases. Internal audit should evaluate whether management’s expansion method is consistent with risk appetite, available resources, and control capability. Therefore, Option D is correct.

A debenture bond is an unsecured bond that is not backed by specific assets or collateral. Instead, it is backed only by the issuer’s creditworthiness and general reputation. Since the organization in this scenario has a stable rating from international rating agencies and guarantees interest and principal payments, it aligns perfectly with the definition of a debenture bond.

A. A sinking fund bond – A bond that has a special account (sinking fund) where money is set aside to pay off bondholders over time. This is not mentioned in the scenario.

B. A secured bond – This type of bond is backed by specific assets or collateral to reduce investor risk. However, the scenario states that the bond is not backed by assets or collateral, eliminating this choice.

C. A junk bond – These are high-risk, high-yield bonds issued by companies with low credit ratings. The scenario specifies that the company has a stable rating, making this incorrect.

D. A debenture bond (Correct Answer) – Since this bond is unsecured and relies solely on the organization ' s financial health, it matches the definition of a debenture bond.

IIA IPPF Standard 2120 – Risk Management discusses financial risk management, including bond issuance.

COSO ERM Framework – Financial Risk Management emphasizes evaluating creditworthiness before issuing debt.

IFRS 9 – Financial Instruments provides accounting guidance on different bond types.

Explanation of Each Option:IIA References:

E-commerce transactions involve multiple security layers to ensure the protection of customers ' sensitive financial information. The correct answer is D, as payment gateways serve as intermediaries that authorize online credit card transactions by securely transmitting the payment details to the bank or card networks for approval. Let’s examine each option carefully:

Option A: HTTP sites provide sufficient security to protect customers ' credit card information.

Incorrect. HyperText Transfer Protocol (HTTP) does not provide encryption, meaning that data transmitted over an HTTP connection can be intercepted by malicious actors. Instead, Secure HTTP (HTTPS), which uses Secure Sockets Layer (SSL) or Transport Layer Security (TLS), is required to encrypt the data.

IIA Reference: Internal auditors evaluating e-commerce security should verify that organizations use HTTPS for secure transactions. (IIA GTAG: Information Security Governance)

Option B: Web servers store credit cardholders ' information submitted for payment.

Incorrect. While web servers may temporarily process customer data, they should not store sensitive credit card information due to security risks. Instead, organizations follow the Payment Card Industry Data Security Standard (PCI DSS), which mandates secure storage and encryption protocols.

IIA Reference: IIA Standards recommend compliance with PCI DSS to protect sensitive payment information. (IIA Practice Guide: Auditing IT Governance)

Option C: Database servers send cardholders’ information for authorization in clear text.

Incorrect. Transmitting cardholder data in clear text is a severe security vulnerability. Secure encryption protocols such as SSL/TLS or tokenization must be used to protect data in transit.

IIA Reference: Internal auditors should ensure encryption measures are in place for financial transactions. (IIA GTAG: Auditing Cybersecurity Risk)

Option D: Payment gateways authorize credit card online payments.

Correct. Payment gateways act as secure intermediaries between merchants and payment processors, verifying the transaction details before authorization. This ensures a secure transaction by encrypting sensitive data before transmitting it for approval.

IIA Reference: IIA guidance on IT controls emphasizes the importance of secure payment processing through payment gateways. (IIA GTAG: Managing and Auditing IT Vulnerabilities)

An investment center is evaluated not only on revenues and costs but also on how effectively it uses invested capital. Residual income is appropriate because it measures profit after deducting a required return on the investment base. This makes it suitable for assessing whether management generated returns above the organization’s minimum required rate. Cost centers are evaluated mainly on cost control, revenue centers on revenue generation, and profit centers on revenues minus expenses; none of these centers is directly responsible for invested capital. Flexible budgets and variance analysis can apply to many responsibility centers. Contribution margin reporting is useful for segment profitability but does not fully evaluate investment use. Therefore, residual income is uniquely suited to investment center evaluation, making Option D correct.

The internal audit procedures manual provides detailed policies, methodologies, and processes to guide the internal audit function. This includes the quality assurance and improvement program (QAIP), which ensures engagement performance and overall conformance with the Standards.

Option A (charter) defines authority and purpose but is not part of procedures. Option B (annual plan) is a planning document, not methodology. Option C (engagement results) are outputs, not procedures.

The Internet of Things (IoT) refers to a network of interconnected physical devices that collect and exchange data through the internet. The key benefits of IoT include automation, improved decision-making, cost savings, and efficiency gains.

(A) Employees can choose from a variety of devices they want to utilize to privately read work emails without their employer’s knowledge.

This is incorrect because it focuses on unauthorized access rather than a benefit of IoT. Security and monitoring are major concerns in IoT environments.

IIA Standard 2110 – Governance requires organizations to ensure adequate governance structures for IT and data security.

(B) Physical devices, such as thermostats and heat pumps, can be set to react to electricity market changes and reduce costs. ✅

This is correct because IoT enables smart devices to automatically adjust based on real-time data.

Example: Smart thermostats (e.g., Nest, Honeywell) use IoT to track energy prices and consumption, adjusting temperatures to optimize efficiency.

IIA Practice Guide " Assessing the Governance of Risks in IT Projects " highlights IoT as a tool for operational efficiency and cost savings.

(C) Information can be extracted more efficiently from databases and transmitted to relevant applications for in-depth analytics.

This relates more to big data and data analytics, not necessarily IoT.

IIA GTAG " Auditing IT Governance " discusses IoT in operational efficiency but distinguishes it from data extraction.

(D) Data mining and data collection from the internet and social networks is easier, and the results are more comprehensive.

This describes AI and machine learning rather than IoT, which primarily connects physical devices.

IIA GTAG " Auditing Cybersecurity Risk " highlights IoT risks but does not emphasize social media data mining.

IIA GTAG (Global Technology Audit Guide) – " Auditing IT Governance "

IIA GTAG – " Assessing the Governance of Risks in IT Projects "

IIA Standard 2110 – Governance

IIA GTAG – " Auditing Cybersecurity Risk "

Analysis of Answer Choices:IIA References:Thus, the most appropriate answer is B because IoT improves efficiency by automating energy consumption based on market conditions.

The percentage of sales method estimates bad debt expense as a percentage of credit sales for the period. Its main advantage is that it matches bad debt expense with the revenue that generated the receivables, making it more aligned with the matching principle in income measurement. The percentage of receivables method, especially when supported by an aging schedule, focuses more on estimating the ending allowance for doubtful accounts and presenting receivables at net realizable value on the balance sheet. Option A describes aging of receivables, not percentage of sales. Option B is incorrect because both approaches require an allowance for doubtful accounts. Option C describes the balance sheet emphasis of the percentage of receivables method. Therefore, if the organization wants a method that approximates the matching principle, Option D is correct.

For a customer-facing banking application, the most critical issue is protecting sensitive data while it is transmitted between the customer and the web application. Account numbers, credentials, balances, and other confidential information can be intercepted over networks if communications are not encrypted. Encryption in transit, usually through secure protocols such as TLS, protects confidentiality and integrity during transmission. Option A is useful because logs may contain sensitive information, but it is not the most important control for customer data moving across the internet. Option B may be important for data at rest, but the question focuses on a web-based customer application and submitted data. Option C is relevant to physical security, but it does not address interception risk during online communication. Therefore, Option D is the strongest answer.

Vertical integration occurs when an organization expands into earlier or later stages of its value chain, such as acquiring suppliers or distributors. A major disadvantage is reduced flexibility to change partners. Once the organization owns or controls a supply or distribution stage, it may be locked into specific technologies, capacity levels, cost structures, or operational relationships. Option B is less convincing because vertical integration often reduces supplier or buyer bargaining power. Option C is not generally true because integration may support differentiation through quality or supply control. Option D is also incorrect because vertical integration may increase control over proprietary knowledge. Internal audit should assess integration risks, including fixed-cost exposure, reduced flexibility, and operational complexity. Therefore, Option A is correct.

Ransomware is a type of cyberattack where malicious software encrypts an organization ' s data, making it inaccessible until a ransom is paid to the attacker. This aligns with the question’s scenario, where denial-of-service is caused by malicious data encryption.

Let ' s analyze the options:

A. Phishing:

Phishing is a social engineering attack that tricks individuals into providing sensitive information, such as usernames, passwords, or credit card numbers. It does not involve encryption or direct denial-of-service.

B. Ransomware (✅ Correct Answer):

Ransomware encrypts critical data and demands a ransom for its release, effectively causing a denial-of-service scenario since the victim cannot access their own systems.

Some well-known ransomware attacks include WannaCry and NotPetya.

C. Hacking:

Hacking is a broad term for unauthorized access to systems but does not specifically refer to denial-of-service through encryption. Ransomware is a specific type of hacking attack.

D. Malware:

Malware (malicious software) is a general category that includes viruses, trojans, worms, spyware, and ransomware. While ransomware is a type of malware, not all malware encrypts data to demand ransom.

IIA Global Technology Audit Guide (GTAG) – Auditing Cybersecurity Risks – Discusses various cyber threats, including ransomware.

NIST Cybersecurity Framework (CSF) – Defines ransomware as a major threat that disrupts business continuity.

COBIT Framework (Control Objectives for Information and Related Technologies) – Addresses risks associated with ransomware and how internal auditors should assess controls.

ISO/IEC 27001 – Information Security Management Systems (ISMS) – Identifies the importance of cybersecurity measures to prevent ransomware attacks.

IIA References:

To effectively mitigate and manage risks during a crisis, organizations must implement a combination of preventive and reactive measures:

Preventive measures: These are proactive steps taken before a crisis to reduce the likelihood of occurrence (e.g., risk assessments, internal controls, security protocols).

Reactive measures: These are actions taken after a crisis occurs to minimize damage, restore operations, and recover from the event (e.g., business continuity plans, incident response strategies).

(A) Incorrect – Only preventive measures.

While prevention is essential, not all crises can be avoided. Organizations also need response mechanisms.

(B) Incorrect – Alternative and reactive measures.

Alternative measures (e.g., backup systems) are part of risk management, but without prevention, risks may escalate.

(C) Incorrect – Preventive and alternative measures.

Alternative measures (e.g., backup resources) help maintain operations but do not directly address crisis response.

(D) Correct – Preventive and reactive measures.

Best practice in risk management includes both preventing crises and responding effectively when they occur.

IIA’s Global Internal Audit Standards – Crisis Management and Business Resilience

Emphasizes the need for both prevention and response strategies.

COSO’s ERM Framework – Risk Management in Crisis Situations

Recommends a combination of risk avoidance, mitigation, and crisis response.

ISO 22301 – Business Continuity Management

Highlights the importance of preventive controls and reactive response planning.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

A targeted approach is used when internal audit performs a specific engagement focused directly on organizational culture, including culture-related processes, controls, risks, and indicators. This differs from an integrated approach, where culture considerations are embedded into multiple audits across the audit plan. A top-down approach would begin with senior leadership, governance, tone at the top, and strategic cultural expectations. A blended approach would combine direct culture audits with culture assessment within other engagements. In this question, the CAE scheduled an assurance engagement specifically on key processes and controls related to organizational culture, making it a focused or targeted engagement. Therefore, Option C is correct.

The main purpose of internal control is to provide reasonable assurance that organizational objectives will be achieved. Those objectives generally relate to operations, reporting, compliance, safeguarding of assets, efficiency, effectiveness, and reliability of information. Options A, B, and C are valid control objectives, but each is only one component of the broader internal control purpose. Compliance with policies, safeguarding resources, and reliable information all support objective achievement, but none is complete by itself. Internal control does not provide absolute assurance because limitations exist, including human error, collusion, management override, cost-benefit constraints, and changing conditions. Internal audit evaluates whether controls are suitably designed and operating effectively to reduce risks to acceptable levels. Therefore, the broadest and most accurate answer is Option D: reasonable assurance on achievement of objectives.

When multiple organizations co-own shopping malls, their primary strategy is to increase market synergy, meaning they combine resources and expertise to enhance market presence, attract more customers, and improve competitive positioning.

(A) To exploit core competence.

Incorrect: Core competencies refer to unique internal capabilities, whereas co-owning shopping malls is a collaborative market strategy.

(B) To increase market synergy. (Correct Answer)

Market synergy occurs when businesses collaborate to create greater market impact than they could individually.

Shared ownership enhances customer traffic, brand reach, and business opportunities.

IIA Standard 2110 – Governance highlights the importance of strategic partnerships in achieving synergy.

(C) To deliver enhanced value.

Incorrect: While value is a benefit, the main goal of co-ownership is strategic market advantage and synergy.

(D) To reduce costs.

Incorrect: Cost reduction may be a secondary benefit, but the primary goal is market synergy through shared resources and customer base expansion.

IIA Standard 2110 – Governance: Encourages strategic collaborations for business growth.

COSO ERM – Strategy and Objective-Setting: Highlights market synergy as a key factor in strategic partnerships.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because co-ownership of shopping malls primarily aims to increase market synergy, allowing organizations to leverage shared resources and customer networks for greater market impact.

When inventory is understated (not included in the physical count) at year-end, the financial impact affects both cost of sales (COGS) and net income as follows:

Correct Answer (C - Cost of Sales is Understated and Net Income is Overstated)

The ending inventory is part of the formula used to calculate the cost of goods sold (COGS): COGS=BeginningInventory+Purchases−EndingInventoryCOGS = Beginning Inventory + Purchases - Ending InventoryCOGS=BeginningInventory+Purchases−EndingInventory

If ending inventory is understated, then:

COGS will be understated (because inventory that should have been counted as sold was omitted).

Net income will be overstated because COGS is lower than it should be, making profits appear higher.

This error causes financial misstatements, violating IIA auditing standards for financial accuracy.

Why Other Options Are Incorrect:

Option A (Cost of sales and net income are understated):

Net income would not be understated—it would be overstated because the cost of goods sold is too low.

Option B (Cost of sales and net income are overstated):

COGS would be understated, not overstated. If COGS were overstated, net income would be understated.

Option D (Cost of sales is overstated and net income is understated):

The opposite happens—COGS is understated and net income is overstated.

IIA GTAG 8: Audit of Inventory Management – Covers financial impact of inventory misstatements.

IIA Practice Guide: Auditing Financial Statements – Addresses common inventory errors and financial reporting impacts.

Step-by-Step Explanation:IIA References for Validation:Thus, C is the correct answer because an understated inventory reduces COGS and inflates net income.

User account lockout is the most effective control listed for mitigating bot-driven repeated login attempts. Bots often attempt credential stuffing, brute-force guessing, or repeated authentication attempts. Account lockout limits the number of failed attempts before temporarily disabling access, forcing additional verification, or triggering security review. Password length improves password strength, but it does not stop continuous attempts by bots. Session timeout controls inactive authenticated sessions, not repeated failed logins. Password aging requires periodic password changes, but it is weak against automated attempts and may even lead to poor password practices. Internal auditors reviewing authentication controls should assess lockout thresholds, monitoring, alerting, multifactor authentication, and exception handling. Therefore, Option C is correct.

The Internet of Things connects sensors, machines, devices, and systems so operational data can be captured and transmitted continuously. In a manufacturing plant, the primary benefit is real-time monitoring of production equipment, output, temperature, vibration, downtime, quality indicators, and maintenance conditions. This allows management to detect production issues quickly, reduce downtime, improve preventive maintenance, and optimize throughput. IoT may introduce cybersecurity and data-integrity concerns, but securing sensitive data and detecting cyberattacks are not its main production-process benefit. Data integrity also requires additional controls over devices, transmission, storage, and analytics. Internal auditors should evaluate IoT governance, access control, device security, monitoring, and operational reliance. Therefore, Option A is correct.

Big data refers to extremely large and complex datasets that require advanced analytics to extract insights. Effective visualization is a crucial step in making big data analytics actionable.

Let’s analyze the options:

A. Big data is often structured.

Incorrect. Big data can be structured, semi-structured, or unstructured. Many sources of big data (e.g., social media, sensor data, emails) are unstructured, making analysis more challenging.

B. Big data analytic results often need to be visualized. ✅ (Correct Answer)

Correct. Due to its complexity, big data analytics results must often be visualized using dashboards, charts, or graphs to communicate insights effectively.

Examples of visualization tools include Tableau, Power BI, and Google Data Studio.

C. Big data is often generated slowly and is highly variable.

Incorrect. Big data is typically generated rapidly and continuously (e.g., social media posts, IoT sensors, financial transactions). This relates to the " velocity " characteristic of big data.

D. Big data comes from internal sources kept in data warehouses.

Incorrect. Big data comes from both internal and external sources, including social media, cloud applications, and sensors. Additionally, data warehouses store structured data, whereas big data is often unstructured and stored in data lakes.

IIA GTAG – Auditing Big Data Analytics – Explores best practices for analyzing and visualizing big data.

COSO ERM Framework – Technology & Data Risk – Discusses the need for big data governance and visualization.

ISO/IEC 27032 – Cybersecurity and Data Analytics – Covers big data security and interpretation.

IIA Standard 2120 – Risk Management in Big Data Analytics – Focuses on internal auditors ' role in overseeing data-driven decision-making.

IIA References:

Under the periodic inventory method, closing inventory is calculated using goods available for sale less cost of goods sold. Goods available for sale equals opening inventory of $300,000 plus purchases of $980,000, totaling $1,280,000. Gross margin is 40 percent of sales, so cost of goods sold is 60 percent of sales. Sales of $1,850,000 × 60 percent = $1,110,000 cost of goods sold. Closing inventory is therefore $1,280,000 − $1,110,000 = $170,000. Option B, C, and D do not follow the gross margin calculation correctly. Internal auditors reviewing inventory balances should verify the relationship between sales, gross margin, cost of goods sold, purchases, and ending inventory. Therefore, Option A is correct.

The comparable uncontrolled price method compares the price charged in a controlled transaction with the price charged in a comparable transaction between independent parties. Its major limitation is finding a sufficiently comparable uncontrolled transaction. Differences in product quality, contract terms, geography, volume, timing, market conditions, risks, and functions can make comparison difficult. Option B may describe a general risk of transfer pricing systems but is not the common CUP limitation. Option C is incorrect because adjustments may be possible if differences can be reliably measured. Option D is wrong because CUP is usually a direct method for identifying an arm’s-length price. Internal auditors reviewing transfer pricing should assess comparability, documentation, assumptions, and regulatory compliance. Therefore, Option A is correct.