IIA-CIA-Part3-KR 문제 96
Data integrity also requires additional controls over devices, transmission, storage, and analytics. Internal auditors should evaluate IoT governance, access control, device security, monitoring, and operational reliance. Therefore, Option A is correct.
IIA-CIA-Part3-KR 문제 97
Direct Relationship Defined:
As decentralization increases, more decision-making power is transferred to lower levels of the organization.
This means that managers and employees at lower levels are empowered to make a broader range of decisions with greater significance.
The Importance of Lower-Level Decision-Making in a Decentralized Structure:
A decentralized structure allows lower-level managers to respond quickly to operational issues and make important decisions without seeking approval from top management.
This enables increased efficiency, innovation, and adaptability in a dynamic business environment.
IIA ' s Perspective on Governance and Decision-Making:
According to the International Professional Practices Framework (IPPF) by the Institute of Internal Auditors (IIA), internal auditors must assess the governance structure of an organization, which includes understanding how decision-making authority is allocated.
The IIA's Three Lines Model highlights the role of management in decision-making, emphasizing the need for a clear and effective delegation of authority.
IIA Standard 2110 - Governance states that internal auditors must evaluate decision-making processes to ensure they align with the organization's objectives and risk management strategies.
Supporting Business Concepts:
Decentralized organizations like multinational corporations, franchises, and divisional structures benefit from empowering lower levels with decision-making authority.
In contrast, centralized organizations retain control at the top, limiting the scope of decisions at lower levels.
A direct relationship exists because the more decentralized a company is, the greater the responsibility of lower levels in making crucial decisions.
IIA References:
IPPF Standards: Standard 2110 - Governance
IIA's Three Lines Model - Emphasizing clear delegation of authority
COSO Internal Control Framework - Discusses decentralized decision-making in control environments Business Knowledge for Internal Auditing (IIA Study Guide) - Governance and decision-making structure
IIA-CIA-Part3-KR 문제 98
Preventive measures: These are proactive steps taken before a crisis to reduce the likelihood of occurrence (e.
g., risk assessments, internal controls, security protocols).
Reactive measures: These are actions taken after a crisis occurs to minimize damage, restore operations, and recover from the event (e.g., business continuity plans, incident response strategies).
(A) Incorrect - Only preventive measures.
While prevention is essential, not all crises can be avoided. Organizations also need response mechanisms.
(B) Incorrect - Alternative and reactive measures.
Alternative measures (e.g., backup systems) are part of risk management, but without prevention, risks may escalate.
(C) Incorrect - Preventive and alternative measures.
Alternative measures (e.g., backup resources) help maintain operations but do not directly address crisis response.
(D) Correct - Preventive and reactive measures.
Best practice in risk management includes both preventing crises and responding effectively when they occur.
IIA's Global Internal Audit Standards - Crisis Management and Business Resilience Emphasizes the need for both prevention and response strategies.
COSO's ERM Framework - Risk Management in Crisis Situations
Recommends a combination of risk avoidance, mitigation, and crisis response.
ISO 22301 - Business Continuity Management
Highlights the importance of preventive controls and reactive response planning.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:
IIA-CIA-Part3-KR 문제 99
In the context of in-house application system development, establishing a robust development process is crucial. Such a process is designed to prevent, detect, and correct errors that may occur during development and implementation. This includes implementing coding standards, conducting regular code reviews, and performing comprehensive testing phases (unit, integration, system, and user acceptance testing) to identify and rectify errors promptly. While logical access controls (option A) and maintaining records of data processing (option C) are essential, they pertain more to operational controls post-development. Documenting business users' requirements (option D) is a critical initial step; however, without a development process focused on error management, merely documenting requirements doesn't ensure error prevention or correction. Therefore, option B best exemplifies a key systems development control in this context.
IIA-CIA-Part3-KR 문제 100
Option A is too rigid and does not reflect risk-based prioritization. Option B is incorrect because the purpose of follow-up is not to revalidate audit issues but to ensure corrective actions were implemented. Option D incorrectly reverses the escalation order (unresolved issues must go from management # senior management # board).
Reference:
IIA Standards - Standard 2500: Monitoring Progress.
- 다른 버전
- 1868IIA.IIA-CIA-Part3-KR.v2026-05-02.q255
- 1627IIA.IIA-CIA-Part3-KR.v2026-02-16.q207
- 2547IIA.IIA-CIA-Part3-KR.v2025-04-09.q203
- 최근 업로드
- 149Microsoft.DP-700-KR.v2026-08-20.q47
- 306ISC.CISSP-KR.v2026-08-20.q862
- 198Microsoft.SC-100-KR.v2026-08-20.q141
- 238Microsoft.AZ-305-KR.v2026-08-20.q223
- 855IIA.IIA-CIA-Part1-KR.v2026-08-19.q374
- 1354IIA.IIA-CIA-Part3-KR.v2026-08-19.q374
- 183Microsoft.DP-700-KR.v2026-08-19.q59
- 236AMP.CRL.v2026-08-18.q46
- 894Microsoft.AZ-305-KR.v2026-08-17.q162
- 237IIA.IAA-IAP-KR.v2026-08-17.q41
PDF 파일 다운로드
메일 주소를 입력하시고 다운로드 하세요. IIA.IIA-CIA-Part3-KR.v2026-08-19.q374 모의시험 시험자료를 다운 받으세요.