Certified Internal Auditor (CIA) Business Acumen and Information Technology (Part 3) Syllabus

Business Acumen and Information Technology (Part 3) syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Business Acumen and Information Technology (Part 3) in Certified Internal Auditor (CIA), not a summary of it.

1. 1

   Business Acumen and Organizational Strategy

   4 topics

   • Organizational Objectives and Strategy
     • Strategic planning
     • SWOT, PESTLE, and Porter's Five Forces
   • Organizational Structures and Behavior
     • Centralized vs. decentralized structures
     • Culture and change management
   • Performance Measurement
     • KPIs and the balanced scorecard
     • Benchmarking
   • Project and Change Management
     • Project life cycle and methodologies
     • Managing organizational change
2. 2

   Information Security and IT Governance

   4 topics

   • IT Governance Frameworks
     • COBIT and IT control frameworks
     • IT–business strategy alignment
   • Information Security Concepts
     • Confidentiality, integrity, availability
     • Access controls and authentication
   • Cybersecurity Risks and Controls
     • Malware, phishing, social engineering
     • Data privacy and regulation
   • Emerging Technology Risks
     • Cloud computing and outsourcing
     • Artificial intelligence and automation
3. 3

   IT Operations and Business Continuity

   3 topics

   • Application and System Controls
     • Input, processing, output controls
     • General vs. application controls
   • Systems Development and Change Management
     • System development life cycle
     • Change and configuration management
   • Business Continuity and Disaster Recovery
     • Business impact analysis
     • Recovery time and recovery point objectives

Business Acumen and Information Technology (Part 3) flashcards for Certified Internal Auditor (CIA)

25 of 51 cards from the Business Acumen and Information Technology (Part 3) deck — real questions with worked answers.

1. What is the difference between a mission statement and a vision statement?

   A mission statement defines the organization's current purpose, core business, and reason for existing today. A vision statement describes the aspirational future state the organization wants to achieve.

2. In strategic planning, what does a SWOT analysis assess?

   Strengths and Weaknesses (internal factors) and Opportunities and Threats (external factors), used to align internal capabilities with the external environment.

3. What are Porter's Five Forces used to analyze?

   Industry competitiveness/attractiveness via: (1) threat of new entrants, (2) bargaining power of suppliers, (3) bargaining power of buyers, (4) threat of substitutes, and (5) rivalry among existing competitors.

4. What are Porter's three generic competitive strategies?

   Cost leadership (lowest cost), differentiation (unique value/product), and focus (targeting a narrow market segment via either cost or differentiation).

5. What is the difference between corporate-level, business-level, and functional-level strategy?

   Corporate strategy decides which businesses/markets to compete in; business strategy defines how to compete within a specific industry; functional strategy supports the business strategy within departments (e.g., marketing, operations).

6. What is a value chain in Porter's framework?

   The set of primary activities (inbound logistics, operations, outbound logistics, marketing/sales, service) and support activities (firm infrastructure, HR, technology, procurement) that create value and competitive advantage.

7. What is the PESTLE analysis used for?

   Scanning the macro-environment using Political, Economic, Social, Technological, Legal, and Environmental factors to identify external influences on strategy.

8. What does a mechanistic organizational structure look like, and when is it appropriate?

   Highly formalized, centralized, with rigid hierarchy and narrow spans of control. Appropriate in stable environments with routine tasks.

9. What characterizes an organic organizational structure?

   Flexible, decentralized, low formalization, wide spans of control, and team-based collaboration. Suited to dynamic, changing environments.

10. What is the difference between a functional and a divisional organizational structure?

    Functional groups employees by specialty (e.g., marketing, finance); divisional groups by product, geography, or customer, with each division operating semi-autonomously.

11. What is a matrix organizational structure and its main drawback?

    Employees report to two managers (e.g., functional and project). Main drawback is dual-authority conflict, confusion over priorities, and potential power struggles.

12. What is the difference between centralization and decentralization in decision-making?

    Centralization concentrates decision authority at top levels; decentralization pushes authority down to lower levels closer to operations.

13. What does 'span of control' refer to?

    The number of subordinates a manager directly supervises. Wide spans mean flatter organizations; narrow spans mean taller hierarchies with more layers.

14. According to Maslow's hierarchy, what are the five levels of needs in order?

    Physiological, Safety, Social (belonging), Esteem, and Self-actualization, satisfied from lowest to highest.

15. What is the core idea of Herzberg's Two-Factor Theory of motivation?

    Hygiene factors (salary, working conditions, policies) prevent dissatisfaction but don't motivate; motivators (achievement, recognition, growth) drive satisfaction and motivation.

16. What do Theory X and Theory Y describe about management assumptions?

    Theory X assumes employees dislike work and need control/coercion; Theory Y assumes employees are self-motivated and seek responsibility.

17. What is the purpose of a Balanced Scorecard?

    To measure performance across four perspectives—financial, customer, internal business processes, and learning & growth—linking strategy to measurable objectives.

18. What is the difference between a leading and a lagging performance indicator?

    A leading indicator predicts future performance (e.g., pipeline volume); a lagging indicator measures past results/outcomes (e.g., net profit).

19. What is the formula for Return on Investment (ROI)?

    ROI = (Net Profit / Investment) x 100, or in DuPont terms, ROI = Profit Margin x Asset Turnover.

20. What is Residual Income (RI) as a performance measure?

    RI = Operating Income - (Minimum Required Rate of Return x Operating Assets). It measures profit earned above the minimum required return.

21. What is Economic Value Added (EVA)?

    EVA = Net Operating Profit After Tax (NOPAT) - (Capital Invested x Weighted Average Cost of Capital). It measures value created above the cost of capital.

22. What is the difference between efficiency and effectiveness?

    Efficiency means doing things right (minimizing resources/cost for output); effectiveness means doing the right things (achieving intended objectives).

23. In responsibility accounting, what are the four main responsibility center types?

    Cost center (controls costs), revenue center (controls revenue), profit center (controls costs and revenue), and investment center (controls costs, revenue, and assets/investment).

24. What defines a project versus ongoing operations?

    A project is temporary with a defined start and end, creating a unique product/service/result; operations are ongoing and repetitive to sustain the business.

25. What is the triple constraint (iron triangle) of project management?

    Scope, time (schedule), and cost—balanced to deliver quality. Changing one constraint affects the others.

See more Business Acumen and Information Technology (Part 3) flashcards →

Planning Business Acumen and Information Technology (Part 3) for Certified Internal Auditor (CIA)

Business Acumen and Information Technology (Part 3) (Certified Internal Auditor (CIA)) FAQ