Our only savior is our will power. Will is the switch that controls everything in this universe. If you don't exercise your will power, you will be a weakling, easily influenced by your environment. Development of the will is the secret of magnetism. Men of success are men of great will power. When you develop will, no matter how you are pounded down by life, you rise again and say, "I am successful. I can win." Regards from Prof Mahaley Head Gmsisuccess Your Career Mentor Gmsisuccess...

Saturday, January 10, 2026

Question ⁉️ on Decision Analysis CVP Bep marginal analysis Etc CMA Part 2

Below are EXAM-ORIENTED NUMERICAL ILLUSTRATIONS WITH FULL ANSWERS on exactly as tested in US CMA Part 2.

All illustrations include CVP, BEP, Marginal Analysis, Pricing Strategy, Margin of Safety, Make-or-Buy, Replacement, Joint Products (Further Processing).

📊 US CMA PART 2 – DECISION ANALYSIS

ILLUSTRATION 1: CVP Analysis & BEP (Units and Sales Value)

Data:

Selling price per unit = $50

Variable cost per unit = $30

Total fixed cost = $200,000

Required:

1. Contribution per unit

2. BEP (units)

3. BEP (sales value)

Solution:

✅ Answer:

• BEP Units =

• BEP Sales = $

ILLUSTRATION 2: Margin of Safety (MOS)

Actual sales = 14,000 units

BEP sales = 10,000 units

Required: Margin of Safety

✅ Answer: Margin of Safety = ***%

ILLUSTRATION 3: Target Profit (CVP)

Fixed cost = $180,000

Contribution per unit = $30

Target profit = $120,000

Required: Sales units to achieve target profit

✅ Answer: ******units

ILLUSTRATION 4: Special Order Pricing (Idle Capacity)

Normal price = $100

Variable cost = $60

Special order price = $75

Order quantity = 2,000 units

Idle capacity available

Decision: Accept or Reject?

✅ Answer:

📌 CMA Rule: Fixed cost irrelevant if idle capacity exists.

ILLUSTRATION 5: Key Factor / Limiting Factor (Product Mix)

Product Contribution per unit Machine hours/unit

A $40 4 hrs

B $30 2 hrs

Machine hours available = 800 hrs

Required: Optimal product mix

Contribution per limiting factor

Priority:

✅ Answer:

ILLUSTRATION 6: Make or Buy Decision

Particulars Make (per unit)

Direct material $18

Direct labor $12

Variable OH $10

Fixed OH $8 (40% avoidable)

Supplier price = $45

Relevant cost of making:

Decision:

✅ Answer:

ILLUSTRATION 7: Replacement Decision

Old machine:

• Book value = $50,000

• Salvage value now = $10,000

• Annual operating cost = $80,000

New machine:

• Cost = $120,000

• Salvage value = $0

• Annual operating cost = $40,000

• Life = 5 years

Relevant Cost Comparison:

✅ Answer:

ILLUSTRATION 8: Shut Down or Continue

Sales = $500,000

Variable cost = $320,000

Fixed cost = $220,000

Avoidable fixed cost = $120,000

Decision:

✅ Answer:

ILLUSTRATION 9: Joint Products – Further Processing Decision

Joint cost (irrelevant) = $100,000

Product Split-off Value After Processing Value Further Processing Cost

X $80,000 $120,000 $30,000

Incremental Analysis:

Incremental revenue =

Incremental cost =

Net benefit =

✅ Answer:

ILLUSTRATION 10: Pricing Strategy (Minimum Price)

Variable cost per unit = $45

Fixed cost = $200,000 (already covered)

Minimum acceptable price?

Minimum price = Variable cost only

✅ Answer:

🔑 CMA EXAM KEY RULES TO REMEMBER

• Joint cost = Always irrelevant

• Book value = Sunk cost

• Contribution per limiting factor = Decision driver

• Fixed cost = Relevant only if avoidable

• Accept special order if positive contribution

www.gmsisuccess.in

MCQ Questions...

Each question targets common CMA pitfalls: sunk cost confusion, relevant vs irrelevant cost, limiting factor logic, joint cost traps, pricing under capacity constraints, etc.

📊 US CMA PART 2

30 Decision Analysis MCQs...

CVP, BEP & Margin of Safety (Q1–Q6)

Q1. A company has contribution margin ratio of 40%. Fixed costs are $360,000. What is the BEP sales?

A. $900,000

B. $1,200,000

C. $1,440,000

D. $360,000

✅ Answer:

Q2. If selling price increases by 10% and variable cost increases by 10%, BEP sales will:

A. Increase

B. Decrease

C. Remain unchanged

D. Cannot be determined

✅ Answer:

(Contribution per unit increases → BEP decreases)

Q3. Margin of safety is BEST described as:

A. Excess of contribution over fixed cost

B. Excess of actual sales over BEP sales

C. Excess of budgeted sales over actual sales

D. Excess of profit over target

✅ Answer:

Q4. A company earns zero profit when sales are $800,000. If fixed costs increase by $40,000, new BEP sales will be:

A. $760,000

B. $800,000

C. $840,000

D. Cannot be determined

✅ Answer:

(CM ratio unknown – classic CMA trap)

Q5. At BEP level, which statement is TRUE?

A. Contribution equals variable cost

B. Sales equals fixed cost

C. Contribution equals fixed cost

D. Profit equals contribution

✅ Answer:

Q6. If margin of safety is zero, the company is operating:

A. At maximum capacity

B. Above BEP

C. Below BEP

D. At BEP

✅ Answer:

Pricing & Special Order Decisions (Q7–Q11)

Q7. Minimum price for a special order when idle capacity exists equals:

A. Full cost

B. Variable cost

C. Variable + fixed cost

D. Market price

✅ Answer:

Q8. A special order should be REJECTED when:

A. Price < variable cost

B. Price < full cost

C. Fixed cost increases

D. Idle capacity exists

✅ Answer:

Q9. Fixed selling expenses are usually:

A. Relevant for pricing decisions

B. Irrelevant for pricing decisions

C. Relevant if avoidable

D. Always sunk

✅ Answer:

Q10. When capacity is FULL, accepting a special order requires considering:

A. Only variable cost

B. Only fixed cost

C. Opportunity cost

D. Joint cost

✅ Answer:

Q11. A company reduces price to increase volume. Fixed costs remain unchanged. BEP sales:

A. Increase

B. Decrease

C. Remain same

D. Become zero

✅ Answer:

Limiting Factor & Product Mix (Q12–Q16)

Q12. Key factor analysis prioritizes products based on:

A. Contribution per unit

B. Selling price per unit

C. Contribution per limiting factor

D. Gross margin

✅ Answer:

Q13. If labor hours are limiting, optimal product mix maximizes:

A. Total sales

B. Contribution per labor hour

C. Contribution per unit

D. Net profit per unit

✅ Answer:

Q14. Fixed costs are ignored in limiting factor decisions because they are:

A. Sunk

B. Unavoidable

C. Irrelevant to ranking

D. Always zero

✅ Answer:

Q15. When multiple constraints exist, CMA recommends using:

A. Simple ranking

B. Linear programming

C. Break-even analysis

D. Regression

✅ Answer:

Q16. Contribution per unit ranking instead of per limiting factor will MOST likely result in:

A. Optimal profit

B. Overproduction

C. Suboptimal profit

D. Same decision

✅ Answer:

Make or Buy & Replacement (Q17–Q21)

Q17. In a make-or-buy decision, which cost is NEVER relevant?

A. Direct material

B. Avoidable fixed cost

C. Allocated fixed overhead

D. Variable overhead

✅ Answer:

Q18. Book value of an old machine is:

A. Relevant

B. Opportunity cost

C. Sunk cost

D. Avoidable cost

✅ Answer:

Q19. Opportunity cost should be included in decisions when:

A. Capacity is idle

B. Resource has alternative use

C. Fixed costs exist

D. Joint products exist

✅ Answer:

Q20. Replacement decisions compare:

A. Total historical cost

B. Net book value

C. Future relevant costs

D. Market value

✅ Answer:

Q21. If old equipment has zero salvage value, it means:

A. Replace immediately

B. Book value is zero

C. No opportunity cost exists

D. Replacement is irrelevant

✅ Answer:

Shut Down & Continue (Q22–Q25)

Q22. A company should continue operations if:

A. Sales exceed variable cost

B. Contribution exceeds avoidable fixed cost

C. Contribution exceeds total fixed cost

D. Revenue exceeds total cost

✅ Answer:

Q23. Fixed costs are relevant in shutdown decisions when they are:

A. Historical

B. Avoidable

C. Allocated

D. Committed

✅ Answer:

Q24. A temporary shutdown decision is a:

A. Capital budgeting decision

B. Pricing decision

C. Short-term decision

D. Strategic decision

✅ Answer:

Q25. Loss minimization occurs when:

A. Contribution is zero

B. Contribution equals fixed cost

C. Contribution is maximized

D. Variable cost is minimized

✅ Answer:

Joint Products & Further Processing (Q26–Q30)

Q26. Joint cost is:

A. Relevant for pricing

B. Relevant for further processing

C. Always irrelevant for decisions

D. Relevant for inventory valuation only

✅ Answer:

Q27. Decision to process further depends on:

A. Allocated joint cost

B. Incremental revenue vs incremental cost

C. Market demand

D. Total cost

✅ Answer:

Q28. A product should be sold at split-off when:

A. Further processing cost < joint cost

B. Incremental loss occurs

C. Incremental profit occurs

D. Contribution is positive

✅ Answer:

Q29. Which is a by-product characteristic?

A. High sales value

B. Negative contribution

C. Minor relative value

D. Separate production

✅ Answer:

Q30. Incorrect allocation of joint cost leads to:

A. Wrong inventory valuation

B. Wrong further processing decision

C. Wrong tax calculation

D. Wrong contribution analysis

✅ Answer:

🎯 CMA EXAM STRATEGY

Ignore sunk & allocated costs. Focus only on future, incremental, and opportunity costs.

www.gmsisuccess.in

CIA Part 1Comprehensive Mocktest Jan 10

Section A….

📘 CIA Part 1 (2025) – 50 MCQs

SECTION A: Foundations of Internal Auditing (Q1–Q18)

Q1. The primary purpose of the internal audit charter is to:

A. Describe audit techniques

B. Define authority, responsibility, and scope

C. List audit staff qualifications

D. Establish external auditor responsibilities

Answer:

Q2. According to the IIA, internal auditing is best described as:

A. A compliance-focused inspection activity

B. A management control function

C. An independent, objective assurance and advisory activity

D. A financial reporting review function

Answer:

Q3. Which of the following must approve the internal audit charter?

A. Chief Audit Executive (CAE)

B. External auditor

C. Senior management

D. Board or audit committee

Answer:

Q4. Which activity most threatens internal audit independence?

A. Reporting functionally to the audit committee

B. Providing advisory services

C. Designing internal controls

D. Using risk-based audit planning

Answer:

Q5. Assurance services primarily involve:

A. Improving operations

B. Consulting management

C. Objective assessment of evidence

D. Facilitating workshops

Answer:

Q6. Advisory services differ from assurance services because they:

A. Require audit committee approval

B. Involve subjective judgment only

C. Do not include management responsibility

D. Are performed at management’s request

Answer:

Q7. Agile auditing emphasizes:

A. Annual audit plans

B. Compliance checklists

C. Flexibility and continuous risk assessment

D. Detailed documentation before testing

Answer:

Q8. Which tool is MOST consistent with agile auditing?

A. Fixed audit universe

B. Waterfall audit approach

C. Sprint-based audits

D. Year-end audits only

Answer:

Q9. Performance auditing focuses primarily on:

A. Financial accuracy

B. Efficiency and effectiveness

C. Regulatory compliance

D. Fraud detection

Answer:

Q10. Which responsibility belongs to the CAE?

A. Managing business risks

B. Approving internal controls

C. Communicating risk exposures to the board

D. Implementing corrective actions

Answer:

Q11. Internal audit’s role in risk management is to:

A. Own and manage risks

B. Set risk appetite

C. Provide assurance on risk processes

D. Eliminate business risks

Answer:

Q12. Which factor MOST enhances internal audit objectivity?

A. Operational responsibilities

B. Incentive-based compensation

C. Functional reporting to the board

D. Advisory engagements

Answer:

Q13. Risk-based audit planning primarily considers:

A. Management preferences

B. Audit cycle history

C. Inherent and residual risks

D. Budget availability

Answer:

Q14. Which engagement provides the HIGHEST level of assurance?

A. Consulting engagement

B. Advisory engagement

C. Assurance engagement

D. Facilitation engagement

Answer:

Q15. Which activity BEST demonstrates value addition by internal audit?

A. Identifying policy violations

B. Reporting control weaknesses

C. Recommending process improvements

D. Verifying transactions

Answer:

Q16. Internal auditors should avoid assuming management responsibility because it:

A. Reduces audit coverage

B. Impairs independence

C. Increases audit cost

D. Delays reporting

Answer:

Q17. Which reporting line BEST supports independence?

A. Administrative to CFO

B. Functional to audit committee

C. Operational to CEO

D. Dual reporting to management

Answer:

Q18. The internal audit activity must be positioned to:

A. Support management decisions

B. Achieve organizational objectives

C. Enforce policies

D. Detect all fraud

Answer:

SECTION B: Ethics & Professionalism (Q19–Q28)

Q19. The IIA Code of Ethics applies to:

A. Only certified auditors

B. Only CAEs

C. All internal auditors

D. External consultants

Answer:

Q20. Which is NOT a principle of the IIA Code of Ethics?

A. Integrity

B. Objectivity

C. Confidentiality

D. Accountability

Answer:

Q21. Accepting gifts from an auditee MOST threatens:

A. Integrity

B. Objectivity

C. Confidentiality

D. Competency

Answer:

Q22. An auditor discloses confidential data without authorization. This violates:

A. Integrity

B. Objectivity

C. Confidentiality

D. Due care

Answer:

Q23. Professional skepticism requires auditors to:

A. Trust management representations

B. Assume fraud exists

C. Question evidence critically

D. Avoid judgment

Answer:

Q24. If an ethical conflict arises, the auditor should FIRST:

A. Inform regulators

B. Discuss with management

C. Follow IIA decision-making framework

D. Resign immediately

Answer:

Q25. Objectivity is BEST preserved by:

A. Rotating audit assignments

B. Avoiding all advisory services

C. Reporting findings informally

D. Accepting management explanations

Answer:

Q26. Due professional care means auditors should:

A. Guarantee accuracy

B. Exercise reasonable judgment

C. Eliminate all risks

D. Detect every fraud

Answer:

Q27. Which situation MOST threatens integrity?

A. Time pressure

B. Conflict of interest

C. Limited resources

D. Sampling risk

Answer:

Q28. Professional competency requires auditors to:

A. Rely on experience only

B. Perform services beyond skills

C. Maintain knowledge and skills

D. Follow management directions

Answer:

SECTION C: Governance, Risk Management & Control (Q29–Q43)

Q29. COSO ERM 2017 focuses primarily on:

A. Internal controls only

B. Strategy and performance

C. Financial reporting

D. Compliance testing

Answer:

Q30. Which is a COSO ERM component?

A. Monitoring activities

B. Risk response

C. Control activities

D. Strategy and objective-setting

Answer:

Q31. Corporate governance primarily ensures:

A. Profit maximization

B. Ethical leadership and accountability

C. Operational efficiency

D. Regulatory compliance

Answer:

Q32. The board’s role in risk management is to:

A. Identify risks

B. Own risks

C. Oversee risk management

D. Mitigate risks directly

Answer:

Q33. Which is an example of a preventive control?

A. Reconciliation

B. Exception report

C. Authorization approval

D. Audit trail

Answer:

Q34. Detective controls are designed to:

A. Prevent errors

B. Identify errors after occurrence

C. Correct errors

D. Eliminate risk

Answer:

Q35. Control effectiveness depends MOST on:

A. Design and operation

B. Cost of controls

C. Documentation

D. Management preference

Answer:

Q36. Risk appetite is BEST defined as:

A. Total risk exposure

B. Risk tolerance limit

C. Amount of risk organization is willing to accept

D. Risk mitigation strategy

Answer:

Q37. Internal audit evaluates governance by reviewing:

A. Profitability

B. Board oversight and ethics

C. Market share

D. Budget variances

Answer:

Q38. Which control weakness indicates a poor control environment?

A. Lack of reconciliations

B. Management override of controls

C. Missing audit trail

D. IT access issues

Answer:

Q39. Residual risk is:

A. Risk before controls

B. Risk after controls

C. Unidentified risk

D. Insignificant risk

Answer:

Q40. Which is an alternative ERM framework?

A. COBIT

B. ISO 31000

C. ITIL

D. PMBOK

Answer:

Q41. A strong governance structure improves:

A. Risk elimination

B. Fraud prevention

C. Decision-making and accountability

D. Audit efficiency only

Answer:

Q42. Testing controls primarily assesses:

A. Risk appetite

B. Control design and operation

C. Strategy formulation

D. Board effectiveness

Answer:

Q43. Internal auditors add value in ERM by:

A. Managing risks

B. Setting risk tolerance

C. Providing assurance on ERM effectiveness

D. Approving risk responses

Answer:

SECTION D: Fraud Risks (Q44–Q50)

Q44. Fraud risk assessment should be:

A. One-time activity

B. Periodic and dynamic

C. Management-only responsibility

D. External auditor’s role

Answer:

Q45. Cyber fraud primarily involves:

A. Manual theft

B. System manipulation

C. Financial statement fraud

D. Bribery

Answer:

Q46. AI-based fraud MOST commonly exploits:

A. Human error

B. Weak governance

C. Automated decision systems

D. Physical assets

Answer:

Q47. Data tampering affects data:

A. Availability

B. Confidentiality

C. Integrity

D. Authenticity

Answer:

Q48. Internal auditors detecting potential fraud should FIRST:

A. Report to media

B. Confront suspect

C. Follow established reporting protocols

D. Investigate independently

Answer:

Q49. The primary role of internal audit in fraud is to:

A. Detect all fraud

B. Investigate fraud

C. Evaluate fraud risk management

D. Prosecute offenders

Answer:

Q50. Professional fraud investigation requires:

A. Intuition

B. Assumptions

C. Evidence and due care

D. Management approval

Answer:

www.gmsisuccess.in

Section B….

Essay based questions 1…

Each case integrates ethics, governance, risk management, agile auditing, and fraud risks.

📘 CIA PART 1 (2025) – CASE-BASED QUESTIONS WITH ANSWERS

CASE 1: Independence & Objectivity

The Chief Audit Executive (CAE) of XYZ Ltd. reports administratively to the CFO and functionally to the audit committee. Due to resource constraints, the CFO asks internal audit to design and implement new inventory controls before auditing them.

Q1. What is the MOST significant concern for the internal audit activity?

A. Reduced audit efficiency

B. Increased audit cost

C. Impairment of independence and objectivity

D. Lack of management support

Answer:

CASE 2: Advisory vs Assurance Services

Internal audit is requested to facilitate a risk workshop to identify emerging risks related to AI-based decision systems. Management wants recommendations but will retain decision-making authority.

Q2. This engagement is BEST classified as:

A. Assurance engagement

B. Compliance audit

C. Advisory (consulting) engagement

D. Investigative engagement

Answer:

CASE 3: Ethics & Confidentiality

An internal auditor shares sensitive payroll data with a colleague who is not assigned to the engagement, “for learning purposes.”

Q3. Which principle of the IIA Code of Ethics is MOST violated?

A. Integrity

B. Objectivity

C. Confidentiality

D. Competency

Answer:

CASE 4: Professional Skepticism

During an audit, management provides explanations for unusual revenue trends but no supporting documentation. The auditor accepts the explanation due to time pressure.

Q4. The auditor failed to apply:

A. Due professional care

B. Independence

C. Objectivity

D. Professional skepticism

Answer:

CASE 5: COSO ERM 2017 – Strategy Alignment

The board approved a new aggressive growth strategy without reassessing risk appetite. Internal audit notes increasing risk exposure.

Q5. Which COSO ERM 2017 component is MOST affected?

A. Risk response

B. Review and revision

C. Strategy and objective-setting

D. Information, communication & reporting

Answer:

CASE 6: Governance Oversight

The audit committee rarely meets and does not review internal audit reports in detail.

Q6. This indicates a weakness in:

A. Risk identification

B. Control activities

C. Corporate governance

D. Fraud prevention

Answer:

CASE 7: Control Environment

Management frequently overrides established approval limits to “speed up operations.”

Q7. This MOST negatively impacts which COSO component?

A. Control activities

B. Risk assessment

C. Control environment

D. Monitoring

Answer:

CASE 8: Agile Auditing

Internal audit switches from annual audit plans to short, iterative audits focused on rapidly changing cyber risks.

Q8. This approach BEST reflects:

A. Traditional auditing

B. Compliance auditing

C. Agile auditing

D. Continuous monitoring

Answer:

CASE 9: Fraud Risk Assessment

A company experienced multiple phishing attacks. Internal audit recommends employee awareness training and access controls.

Q9. Internal audit is primarily addressing:

A. Fraud investigation

B. Fraud risk assessment and prevention

C. Fraud prosecution

D. Financial reporting fraud

Answer:

CASE 10: Cyber & AI Fraud

An AI system automatically approves loans. Hackers manipulate input data, resulting in unauthorized approvals.

Q10. This fraud MOST directly affects data:

A. Availability

B. Confidentiality

C. Integrity

D. Retention

Answer:

Explanation:

🎯 Exam Tip (CIA Part 1 – 2025):

In case-based questions, first identify the role of internal audit (assurance, advisory, governance oversight) and then apply IIA Standards, Code of Ethics, and COSO ERM logic

Essay based questions..2

All cases integrate internal audit fundamentals, ethics, COSO ERM 2017, governance, agile auditing, and fraud risks, exactly as tested in the CIA exam.

📘 CIA PART 1 – CASE-BASED QUESTIONS (WITH ANSWERS)

Case 1: Internal Audit Independence

XYZ Ltd.’s internal audit department reports administratively and functionally to the CFO. The CFO frequently modifies audit reports before they are issued to the audit committee.

Q1. What is the MOST significant issue in this scenario?

A. Lack of audit resources

B. Impaired independence and objectivity

C. Ineffective audit planning

D. Weak control environment

✅ Answer:

Case 2: Advisory Services & Objectivity

Internal audit helped design a new procurement system last year. This year, the same auditors are assigned to audit procurement controls.

Q2. What is the BEST action for the CAE?

A. Proceed with audit as planned

B. Cancel the audit

C. Assign different auditors or use external support

D. Issue a disclaimer

✅ Answer:

Case 3: Agile Auditing

Due to frequent regulatory changes, management requests quicker audit feedback rather than waiting for annual audits.

Q3. Which audit approach BEST meets this need?

A. Traditional audit cycle

B. Compliance-based auditing

C. Agile auditing with sprints

D. Post-implementation review

✅ Answer:

Case 4: Ethical Dilemma

An internal auditor discovers a minor control violation involving a senior manager. The manager requests the issue not be reported, calling it “immaterial.”

Q4. What should the auditor do FIRST?

A. Ignore the issue

B. Report directly to regulators

C. Follow the IIA ethical decision-making framework

D. Resign from engagement

✅ Answer:

Case 5: Confidentiality Breach

An auditor discusses sensitive audit findings with a friend outside the organization.

Q5. Which ethical principle is violated?

A. Integrity

B. Objectivity

C. Confidentiality

D. Competency

✅ Answer:

Case 6: Governance Oversight

The board approves strategy but rarely reviews risk reports or control weaknesses.

Q6. This situation indicates a weakness in:

A. Risk identification

B. Control activities

C. Corporate governance

D. Compliance management

✅ Answer:

Case 7: COSO ERM 2017

Management aligns business objectives with risk appetite and monitors performance indicators linked to strategy.

Q7. Which COSO ERM 2017 focus area is demonstrated?

A. Review and revision

B. Information & communication

C. Strategy and objective-setting

D. Control activities

✅ Answer:

Case 8: Risk Appetite

A company accepts higher cybersecurity risk to launch digital products faster than competitors.

Q8. This decision BEST reflects:

A. Risk tolerance

B. Residual risk

C. Risk appetite

D. Inherent risk

✅ Answer:

Case 9: Control Environment

Management frequently overrides established approval controls to meet targets.

Q9. What is the MOST serious implication?

A. Increased audit cost

B. Weak control environment

C. Inefficient processes

D. Poor documentation

✅ Answer:

Case 10: Preventive vs Detective Controls

A system blocks unauthorized access, while logs are reviewed weekly.

Q10. Blocking access is a:

A. Detective control

B. Corrective control

C. Preventive control

D. Compensating control

✅ Answer:

Case 11: Fraud Risk Assessment

Internal audit conducts fraud risk assessment only during investigations.

Q11. What is the BEST recommendation?

A. Continue current practice

B. Perform fraud risk assessment periodically

C. Leave fraud to external auditors

D. Eliminate fraud assessments

✅ Answer:

Case 12: Cyber Fraud

Hackers alter transaction data without changing system availability.

Q12. Which data attribute is MOST affected?

A. Availability

B. Confidentiality

C. Integrity

D. Authenticity

✅ Answer:

Case 13: AI Fraud

An AI-based loan system approves fraudulent loans due to biased training data.

Q13. The primary risk arises from:

A. Manual override

B. Poor governance over AI models

C. Weak physical controls

D. Human error

✅ Answer:

Case 14: Fraud Detection

An auditor suspects fraud but lacks concrete evidence.

Q14. What should the auditor do NEXT?

A. Accuse the employee

B. Ignore the suspicion

C. Follow established investigation and reporting protocols

D. Inform law enforcement

✅ Answer:

Case 15: Internal Audit Role in Fraud

Management expects internal audit to guarantee zero fraud.

Q15. What is the MOST appropriate response?

A. Accept responsibility

B. Reject involvement in fraud

C. Clarify that IA provides assurance on fraud risk management, not guarantees

D. Transfer responsibility to external auditors

✅ Answer:

🎯 EXAM TIP (CIA PART 1 – 2025)

Independence, objectivity, governance oversight, COSO ERM language, and ethical judgment are heavily tested.

Case questions often ask “BEST” or “MOST appropriate”, not absolute answers.

Solve all questions ‼️ submit your answers for evaluation.

www.gmsisuccess.in

Wednesday, January 7, 2026

ISO 21500 & PMBOK: CISA cerification

important points for ISO 21500 & PMBOK for CISA Certification Exam

ISO 21500 and PMBOK provide foundational project management frameworks relevant to CISA Domain 3 on information systems acquisition, development, and implementation, emphasizing governance, risk, and controls in IT projects.[1] For the CISA exam, auditors evaluate project governance using these standards to ensure alignment with business objectives and effective control design.[1][2]

## ISO 21500 Key Points

ISO 21500 offers high-level guidance on project management processes, applicable to any organization or project size.[3][3] It structures processes around five lifecycle stages: Initiating, Planning, Implementing, Controlling, and Closing, with subject groups including integration, scope, time, cost, risk, quality, resource, stakeholder, communication, and procurement.[3][1][3] The standard focuses on concepts, inputs, and outputs without detailing tools or techniques, promoting good practices like stakeholder alignment and continuous improvement.[4][5]

## PMBOK Key Points

PMBOK, particularly the 7th edition, emphasizes 6 core principles: holistic view, value focus, quality embedding, accountable leadership, sustainability integration, and empowered culture.[6] It covers 10 knowledge areas (e.g., scope, schedule, cost, quality, resource, communication, risk, procurement, stakeholder, integration) mapped to 5 process groups matching ISO 21500's lifecycle.[7][5] Inputs, Tools & Techniques, and Outputs (ITTOs) guide detailed process execution, crucial for CISA topics like feasibility analysis and SDLC controls.[7][8]

## CISA Exam Relevance

In CISA Domain 3 (12% weight), auditors assess project governance, business cases, SDLC methodologies, and post-implementation reviews using ISO 21500 and PMBOK principles.[1][2] Key exam focuses include risk management, control identification, system readiness testing, and ensuring IT projects meet objectives via structured lifecycle oversight.[1][8] ISO 21500 serves as a process-oriented international baseline, while PMBOK adds depth for auditing project alignment and efficiency.[5][9]

www.gmsisuccess.in

🔹 ISO 21500 – IMPORTANT POINTS FOR CISA

1️⃣ Nature of ISO 21500

Guidance standard, NOT certifiable ❌
Provides high-level framework for project management
No mandatory processes, only recommended practices
Designed for organizations & governance, not just project managers

📌 CISA Trap:

If question asks about certification, compliance, audit checklist → NOT ISO 21500

2️⃣ ISO 21500 Structure

ISO 21500 has 2 main dimensions:

A. Process Groups (5)

Same names as PMBOK:

Initiating
Planning
Implementing (≠ Executing) ⚠️
Controlling
Closing

📌 Exam Trap:
PMBOK uses Executing, ISO uses Implementing

B. Subject Groups (10)

(similar but not identical to PMBOK knowledge areas)

Integration
Stakeholder
Scope
Resource
Time
Cost
Risk
Quality
Procurement
Communication

📌 Key Difference:

Stakeholder is a separate group in ISO (earlier than PMBOK 6)

3️⃣ Governance Focus (VERY IMPORTANT FOR CISA)

Emphasizes:
- Alignment with organizational strategy
- Benefits realization
- Sponsor accountability
- Governance framework

📌 CISA Scenario:

Project failing due to lack of executive oversight → ISO 21500 highlights sponsor & governance weakness

4️⃣ Risk Management (ISO View)

Risk is treated at project & organizational level
Focus on:
- Risk identification
- Risk response
- Continuous monitoring

📌 CISA Trap: ISO does NOT prescribe:

Quantitative risk models
Risk registers formats
Probability × impact matrices

5️⃣ Control & Assurance Angle (CISA Favorite)

Control occurs mainly in Controlling process group
Focus on:
- Performance measurement
- Change control
- Variance analysis

📌 Exam Logic:

ISO tells WHAT should be controlled, not HOW to control

6️⃣ Change Management

Formal change control encouraged
Emphasis on:
- Impact assessment
- Stakeholder communication

📌 CISA MCQ: If question mentions lack of documented change approval → governance gap

🔹 PMBOK (PMI) – IMPORTANT POINTS FOR CISA

1️⃣ Nature of PMBOK

Best-practice framework, NOT a standard ❌
More detailed & prescriptive than ISO
Designed for project managers

📌 CISA Trap:

PMBOK ≠ compliance standard
PMBOK ≠ audit framework

2️⃣ Process Groups (PMBOK)

Initiating
Planning
Executing
Monitoring & Controlling
Closing

3️⃣ Knowledge Areas (10 – PMBOK 6)

Integration
Scope
Schedule
Cost
Quality
Resource
Communication
Risk
Procurement
Stakeholder

📌 ISO vs PMBOK:

PMBOK = How to do
ISO = What should exist

4️⃣ Key Documents (EXAM GOLD)

Project Charter → authorizes project
Project Management Plan → integrated baseline
Baselines:
- Scope baseline
- Schedule baseline
- Cost baseline

📌 CISA Scenario:

No approved charter → project lacks authorization → governance failure

5️⃣ Risk Management (PMBOK)

Formal steps:
1. Identify risks
2. Qualitative analysis
3. Quantitative analysis
4. Plan responses
5. Monitor risks

📌 PMBOK is more detailed than ISO

6️⃣ Change Control (Very Important)

Integrated Change Control
Change requests evaluated for:
- Scope
- Cost
- Schedule
- Quality
- Risk

📌 CISA Trap:

Unauthorized scope changes = scope creep = control weakness

7️⃣ Stakeholder Management

Identify → Analyze → Engage
Continuous communication is critical

📌 CISA Scenario:

Project failure due to user resistance → stakeholder engagement failure

🔴 ISO 21500 vs PMBOK – COMPARISON (HIGH PROBABILITY MCQ)

Area	ISO 21500	PMBOK
Nature	International standard	Best practice guide
Certification	❌ No	❌ No
Detail level	High-level	Detailed
Focus	Governance & alignment	Project execution
Processes	Fewer, generic	Detailed
Control guidance	Conceptual	Procedural

🔑 ONE-LINE EXAM TAKEAWAYS

ISO 21500 = Governance + alignment + guidance
PMBOK = Tools + techniques + execution
ISO tells WHAT, PMBOK tells HOW
ISO good for audit & assurance perspective
PMBOK good for operational control questions

www.gmsisuccess.in

🔑 KEY DIFFERENCES: ISO 21500 vs PMBOK (CISA VIEW)

Basis	ISO 21500	PMBOK (PMI)
Nature	International guidance standard	Best-practice framework / guide
Certification	❌ Not certifiable	❌ PMBOK itself not certifiable
Primary Focus	Governance & strategic alignment	Project execution & management
Audience	Organization, sponsors, governance bodies	Project managers & teams
Level of Detail	High-level (WHAT)	Detailed (HOW)
Prescriptiveness	Non-prescriptive	More prescriptive
Compliance Use	Reference for governance & assurance	Not a compliance or audit standard
Orientation	Enterprise-level	Project-level
Control Perspective	Conceptual control framework	Procedural controls

⚠️ MOST TESTED DIFFERENCES (EXAM GOLD)

1️⃣ Implementing vs Executing

ISO 21500 → Implementing
PMBOK → Executing

📌 Very common MCQ trap

2️⃣ Stakeholder Management

ISO 21500: Stakeholder is a core subject group from start
PMBOK: Became a separate knowledge area later (PMBOK 5+)

📌 ISO stresses early stakeholder governance

3️⃣ Governance Emphasis

ISO 21500:
- Sponsor accountability
- Benefits realization
- Alignment with organizational strategy
PMBOK:
- Focus on deliverables, schedules, cost, scope

📌 CISA answer prefers ISO when governance fails

4️⃣ Change Management

ISO 21500:
- Change control conceptually required
- No tools or formats prescribed
PMBOK:
- Integrated Change Control
- Change requests, CCB, impact analysis

📌 ISO = principle, PMBOK = procedure

5️⃣ Risk Management

ISO 21500:
- Risk at organizational & project level
- High-level approach
PMBOK:
- Detailed steps
- Qualitative & quantitative techniques

📌 CISA exam: ISO = risk governance, PMBOK = risk execution

6️⃣ Documentation

ISO 21500:
- Mentions required concepts
- No mandated documents
PMBOK:
- Specific documents:
  - Project Charter
  - PM Plan
  - Baselines
  - Registers

🧠 ONE-LINE MEMORY TRICKS (CISA)

ISO 21500 = WHAT should exist
PMBOK = HOW to do it
ISO = Governance
PMBOK = Management
ISO = Assurance friendly
PMBOK = Operations friendly

🎯 EXAM SCENARIO QUICK RULE

If question talks about audit, oversight, governance, strategic alignment → ISO 21500
If question talks about tools, techniques, procedures, documents → PMBOK

www.gmsisuccess.in

Below are CISA-style WRONG OPTIONS explained for ISO 21500 vs PMBOK.
These are classic traps used in the exam — read the reason for rejection, not just the correct answer.