IIA IIA-CIA-Part3 Dumps Questions Answers

Data governance refers to the policies, processes, and controls an organization implements to ensure data integrity, security, and compliance. When an organization has a weak data governance culture, the most compromised attribute of data is " veracity, " which refers to the accuracy, reliability, and trustworthiness of data.

Why Option D (Veracity) is Correct:

Weak data governance leads to poor data quality, inconsistencies, and errors, reducing data veracity (trustworthiness and accuracy).

Without strong governance, data may be incomplete, outdated, or manipulated, leading to flawed decision-making.

Data veracity is critical for risk management, internal audit, and regulatory compliance, as unreliable data can lead to financial misstatements and operational risks.

Why Other Options Are Incorrect:

Option A (Variety):

Variety refers to different types and sources of data (structured, unstructured, semi-structured).

A weak data governance culture does not necessarily affect the diversity of data sources.

Option B (Velocity):

Velocity refers to the speed at which data is generated, processed, and analyzed.

Weak governance impacts data quality more than processing speed.

Option C (Volume):

Volume refers to the quantity of data being processed and stored.

Weak data governance might lead to data duplication or loss but does not directly impact data volume.

IIA GTAG – " Auditing Data Governance " : Emphasizes the importance of data veracity in decision-making.

COSO Internal Control Framework: Highlights the role of data integrity in financial and operational controls.

IIA’s Global Technology Audit Guide on Data Analytics: Discusses the risks of poor data governance affecting veracity.

IIA References:

Effective risk management is indicated by controls that promote compliance with laws and regulations and by monitoring systems that alert management to unexpected events. These show that the organization has control activities and monitoring processes linked to risk exposure. Statement 2 is unrealistic because no control environment can address all identified risks completely; risk responses must be prioritized based on risk appetite and cost-benefit considerations. Statement 3 is not necessarily positive because key controls should change when risks, systems, regulations, or processes change. Internal audit should evaluate whether controls are risk-based, adaptive, monitored, and aligned with objectives. The most valid indicators listed are compliance-supporting controls and effective monitoring systems. Therefore, Option B is correct.