IIA IIA-CIA-Part3 Actual Questions

When an organization faces unexpected disruptions, such as the inability to receive raw materials due to a military conflict, it should have contingency plans in place to manage such risks.

Contingency Planning for Unforeseen Events (Correct Answer: C)

Contingency plans are designed to prepare for and respond to unexpected disruptions, such as supply chain failures, political instability, or natural disasters.

IIA Standard 2120 – Risk Management requires organizations to have business continuity and disaster recovery plans, which include contingencies for supply chain disruptions.

A well-prepared contingency plan could involve alternative suppliers, stockpiling critical materials, or adjusting production schedules.

Why the Other Options Are Incorrect:

A. Just-in-time (JIT) delivery plans (Incorrect)

JIT is a supply chain management strategy that minimizes inventory and relies on timely delivery.

While JIT increases efficiency, it is not a backup plan for unexpected disruptions.

In fact, JIT makes companies more vulnerable to supply chain interruptions.

B. Backup plans (Incorrect)

A backup plan generally refers to IT/data backup or system recovery strategies, not a comprehensive risk management approach for supply chain issues.

Contingency plans encompass broader business continuity strategies beyond simple backup plans.

D. Standing plans (Incorrect)

Standing plans are routine, long-term procedures for normal operations, such as HR policies or standard operating procedures.

They do not specifically address unexpected crises like supply chain failures due to war.

IIA Standard 2120 – Risk Management (Ensuring business continuity planning)

IIA Standard 2110 – Governance (Assessing organizational resilience strategies)

IIA Standard 2130 – Compliance (Evaluating regulatory and risk mitigation plans)

Step-by-Step Justification:IIA References for This Answer:Thus, the correct answer is C. Contingency plans, as they are specifically designed to address unexpected disruptions like supply chain failures due to military conflict.

The CAE must communicate significant risk exposures and control issues to the board. A regulatory noncompliance issue that could result in significant fines qualifies as a high residual risk. Internal audit should not implement corrective actions (management’s responsibility) or recommend disciplinary action. While discussions with management (Option A) are appropriate, the ultimate duty is to escalate the matter to the board (Option C).

The QAIP (Quality Assurance and Improvement Program) requires both ongoing monitoring and periodic assessments. Among these, ongoing monitoring is the mechanism that ensures continuous evaluation of whether engagements are being performed with quality and in conformance with the Standards.

Option A (periodic assessments) review effectiveness but are not continuous. Option C (external assessments) and Option D (SAIV) are broader and periodic, not engagement-level consistency checks.