CIA IIA-CIA-Part3 Full Course Free

Understanding the Contracting Process PhasesThe contracting process generally follows these phases:

Initiation Phase: Identifies the need for a contract and sets initial objectives.

Bidding Phase: Potential vendors or partners submit proposals, and negotiations begin.

Development Phase: Contracts are drafted, negotiated, and finalized before execution.

Management Phase: The contract is executed, monitored, and evaluated for compliance.

Why Option C is Correct?

The development phase is where contracts are formally drafted based on agreements made during bidding and negotiation.

This phase includes legal review, compliance verification, and risk assessment, ensuring the contract aligns with business objectives and legal requirements.

IIA Standard 2110 – Governance requires auditors to assess how contract risks are managed, ensuring formal contract development processes.

Why Other Options Are Incorrect?

Option A (Initiation phase):

This phase defines the business need but does not involve drafting contracts.

Option B (Bidding phase):

In this phase, businesses solicit proposals, but contracts are not fully drafted until vendor selection.

Option D (Management phase):

The management phase involves executing and monitoring the contract, not drafting it.

Contracts are drafted during the development phase after vendor selection and before execution.

IIA Standard 2110 supports governance over contract risk and formal agreement processes.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (Contract Risk & Compliance)

COSO ERM – Risk Management in Contracting

IT governance controls ensure that an organization's IT systems align with business objectives, manage risks, and comply with regulatory requirements. These controls cover areas such as security, financial oversight, change management, and operational efficiency.

Let’s analyze each option:

Option A: Controls that focus on segregation of duties, financial, and change management.

Correct.

Segregation of duties (SoD) prevents conflicts of interest and reduces fraud risk.

Financial controls ensure IT expenditures align with budgets and policies.

Change management controls ensure system modifications follow formal approval and testing procedures.

These areas are core components of IT governance, ensuring security, compliance, and efficiency.

IIA Reference: Internal auditors evaluate IT governance using frameworks like COBIT (Control Objectives for Information and Related Technologies) and ISO 27001. (IIA GTAG: Auditing IT Governance)

Option B: Personnel policies that define and enforce conditions for staff in sensitive IT areas.

Incorrect.

While personnel policies support IT security, they do not fully represent IT governance controls. IT governance is broader and includes risk management, compliance, and operational efficiency.

Option C: Standards that support IT policies by more specifically defining required actions.

Incorrect.

Standards are part of IT governance but are not controls themselves. IT governance requires enforcement mechanisms like segregation of duties and change management to ensure compliance.

Option D: Controls that focus on data structures and the minimum level of documentation required.

Incorrect.

While data governance is a subset of IT governance, IT governance includes wider financial, security, and operational controls.

Thus, the verified answer is A. Controls that focus on segregation of duties, financial, and change management.

Importance of Secure Protocols for Web Server Management:

Web servers handle sensitive data, including user credentials, financial information, and confidential communications.

Using secure protocols like HTTPS, SFTP, and TLS-encrypted SMTP ensures data is encrypted and protected from cyber threats.

Risks of Clear-Text Protocols (HTTP & FTP):

HTTP (Hypertext Transfer Protocol) and FTP (File Transfer Protocol) transmit data in plaintext, making them vulnerable to man-in-the-middle (MITM) attacks, packet sniffing, and unauthorized access.

SFTP (Secure File Transfer Protocol) and HTTPS (Hypertext Transfer Protocol Secure) encrypt data, mitigating these risks.

Why Other Options Are Incorrect:

A. The file transfer protocol (FTP) should always be enabled – Incorrect.

FTP is not secure, and enabling it can expose the server to unauthorized file access and cyberattacks.

B. The simple mail transfer protocol (SMTP) should be operating under the most privileged accounts – Incorrect.

SMTP should operate with minimal privileges to reduce security risks in case of a breach.

C. The number of ports and protocols allowed to access the web server should be maximized – Incorrect.

Minimizing open ports and protocols reduces the attack surface and limits unauthorized access.

IIA’s Perspective on IT Security and Web Server Management:

IIA Standard 2110 – Governance requires organizations to establish secure IT practices, including encryption and secure protocols.

IIA GTAG (Global Technology Audit Guide) on IT Risks emphasizes minimizing security vulnerabilities by using encrypted communication.

ISO 27001 Security Standard recommends secure transmission protocols for protecting sensitive data.

IIA References:

IIA Standard 2110 – IT Security and Governance

IIA GTAG – IT Risks and Secure Web Server Management

ISO 27001 Security Standard – Data Encryption and Secure Transmission

Thus, the correct and verified answer is D. Secure protocols for confidential pages should be used instead of clear-text protocols such as HTTP or FTP.

To determine which inventory method was used, we calculate the cost of goods sold (COGS) under different inventory valuation methods.

Opening Inventory: 1,000 units @ $2 each = $2,000

Purchased: 5,000 units @ $3 each = $15,000

Total Inventory: 6,000 units

Units Sold: 3,000 at $7 per unit

Reported COGS: $8,500

Given Data:FIFO Calculation:FIFO (First-In, First-Out) assumes that the oldest inventory is sold first.

1,000 units from opening inventory @ $2 = $2,000

2,000 units from purchases @ $3 = $6,000

Total COGS under FIFO: $2,000 + $6,000 = $8,000

Average Cost Calculation:Average cost per unit =

Total Cost of InventoryTotal Units=(2,000+15,000)6,000=17,0006,000=2.83 per unit\frac{\text{Total Cost of Inventory}}{\text{Total Units}} = \frac{(2,000 + 15,000)}{6,000} = \frac{17,000}{6,000} = 2.83 \text{ per unit}Total UnitsTotal Cost of Inventory​=6,000(2,000+15,000)​=6,00017,000​=2.83 per unit

COGS using average cost method: 3,000×2.83=8,4903,000 \times 2.83 = 8,4903,000×2.83=8,490 This is not an exact match to the reported COGS of $8,500.

Since the closest method to the reported value is FIFO ($8,000 vs. $8,500 reported COGS, accounting for possible rounding errors or additional costs), FIFO is the most likely method used.

(A) Average cost method. ❌ Incorrect. The calculated COGS using the weighted average method was $8,490, which does not match exactly with the reported COGS of $8,500.

(B) First-in, first-out (FIFO) method. ✅ Correct. The FIFO method yielded $8,000, which is the closest match to the reported COGS. Minor rounding adjustments or other expenses could explain the difference of $500.

(C) Specific identification method. ❌ Incorrect. This method applies when each inventory item is individually tracked, which is not mentioned in the question.

(D) Activity-based costing method. ❌ Incorrect. Activity-based costing (ABC) is used for overhead allocation and is not a primary inventory valuation method.

IIA GTAG – "Auditing Inventory Management"

IIA Standard 2130 – Control Activities (Inventory and Costing Methods)

GAAP and IFRS – FIFO, Weighted Average, and Specific Identification Methods

Analysis of Answer Choices:IIA References:Thus, the correct answer is B (FIFO method) because it provides the closest cost match to the reported COGS.