PDF IIA-CIA-Part3 Study Guide

A debenture bond is an unsecured bond that is not backed by specific assets or collateral. Instead, it is backed only by the issuer’s creditworthiness and general reputation. Since the organization in this scenario has a stable rating from international rating agencies and guarantees interest and principal payments, it aligns perfectly with the definition of a debenture bond.

A. A sinking fund bond – A bond that has a special account (sinking fund) where money is set aside to pay off bondholders over time. This is not mentioned in the scenario.

B. A secured bond – This type of bond is backed by specific assets or collateral to reduce investor risk. However, the scenario states that the bond is not backed by assets or collateral, eliminating this choice.

C. A junk bond – These are high-risk, high-yield bonds issued by companies with low credit ratings. The scenario specifies that the company has a stable rating, making this incorrect.

D. A debenture bond (Correct Answer) – Since this bond is unsecured and relies solely on the organization's financial health, it matches the definition of a debenture bond.

IIA IPPF Standard 2120 – Risk Management discusses financial risk management, including bond issuance.

COSO ERM Framework – Financial Risk Management emphasizes evaluating creditworthiness before issuing debt.

IFRS 9 – Financial Instruments provides accounting guidance on different bond types.

Explanation of Each Option:IIA References:

In accounting, the terms debit (Dr.) and credit (Cr.) refer to the two sides of an account in the double-entry accounting system.

Definition of Debit and Credit in Accounting:

Every financial transaction affects at least two accounts in a double-entry system: one account is debited, and another is credited.

Debits (Dr.) appear on the left side, while credits (Cr.) appear on the right side of an account.

Accounting Equation:

Step-by-Step Justification:Assets=Liabilities+Equity\text{Assets} = \text{Liabilities} + \text{Equity}Assets=Liabilities+Equity

Debits increase assets and expenses.

Credits increase liabilities, equity, and revenues.

Why the Other Options Are Incorrect:

A. Debit indicates the right side of an account and credit the left side ❌

Incorrect, as debits are always recorded on the left side, and credits are always on the right side.

B. Debit means an increase in an account and credit means a decrease. ❌

Partially incorrect; it depends on the type of account:

For assets and expenses, debits increase and credits decrease.

For liabilities, equity, and revenues, credits increase and debits decrease.

D. Credit means an increase in an account and debit means a decrease. ❌

Also incorrect because increases and decreases depend on the type of account (e.g., debits increase assets but decrease liabilities).

IIA Standard 1210.A1: Internal auditors must be familiar with fundamental accounting principles.

IIA Practice Guide: Auditing Financial Statements: Ensures proper understanding of debits and credits in financial reporting.

GAAP & IFRS Accounting Standards: Define how debits and credits are recorded in financial statements.

IIA References:Thus, the correct answer is C. Credit indicates the right side of an account and debit the left side. ✅

Physical controls are security measures that prevent unauthorized physical access to critical assets, such as IT infrastructure, sensitive documents, or restricted areas.

(A) Preventing database administrators from initiating program changes:

This is a logical (IT) control rather than a physical control. Logical controls manage access permissions and prevent unauthorized software changes.

(B) Blocking technicians from getting into the network room (Correct Answer):

This is a physical control because it prevents unauthorized personnel from physically accessing critical IT infrastructure, such as servers and networking devices.

Unauthorized access to a network room could lead to data breaches, hardware manipulation, or cyberattacks.

(C) Restricting system programmers' access to database facilities:

This is an access control measure, which can be either logical (permissions, role-based access) or physical. However, it primarily refers to IT access controls rather than a physical security measure.

(D) Using encryption for data transmitted over the public internet:

This is a technical control, not a physical one. Encryption protects data but does not prevent physical breaches.

IIA GTAG 17: Auditing IT Security – Emphasizes the role of physical security in protecting IT infrastructure.

COBIT Framework – DSS05 (Manage Security Services) – Highlights physical access restrictions as a key security measure.

ISO/IEC 27001: Information Security Management System – Identifies physical security as a fundamental control for IT risk management.

Analysis of Each Option:IIA References:Conclusion:Since physical security controls prevent unauthorized physical access, option (B) is the correct answer.

Understanding Physical Access Controls:

Physical access controls protect assets by preventing unauthorized access and detecting potential security violations.

Controls can be preventive (stop incidents from occurring) or detective (identify incidents after they occur).

Why Surveillance Cameras Function as Both Preventive and Detective Controls:

Preventive: The presence of cameras discourages unauthorized access and malicious activities.

Detective: If an incident occurs, cameras provide recorded evidence for investigation and accountability.

Why Other Options Are Less Suitable:

A. Locked doors – Purely preventive, as they block unauthorized access but do not detect breaches.

B. Firewalls – Primarily an IT security measure, not a physical access control.

D. Login IDs and passwords – These are logical (IT) access controls, not physical controls.

IIA GTAG 15 – Auditing Privacy and Security Risks: Highlights the dual role of surveillance as a preventive and detective control.

IIA Standard 2120 – Risk Management: Encourages controls that both prevent and detect risks.

COSO’s Internal Control Framework: Supports security measures that serve multiple control functions.

Relevant IIA References:✅ Final Answer: Surveillance cameras (Option C).