CIA Part 3 common mistakes
CIA Part 3 · Understand the traps and how to avoid them.
On a variance or flexible-budget question, the candidate computes the difference and labels it favorable merely because the number came out positive (or labels a cost overrun favorable because actual exceeded budget), without first asking which line item the variance belongs to.
Most of the arithmetic work is sign-based, so attention locks onto the magnitude and the plus/minus sign rather than on the economics of the line. Under time pressure the brain treats 'positive number' as 'good outcome'.
What to do instead
Before writing F or U, state the base rule in one sentence in the margin: for revenue and contribution lines, actual above budget is favorable; for cost and expense lines, actual above budget is unfavorable. Then re-read the line label and apply the rule deliberately rather than reading the sign.
In a contribution-margin, break-even, or flexible-budget item, the candidate carries a per-unit fixed cost forward as if it were constant when volume changes, producing a wrong break-even point or an incorrect flexible budget.
Absorption-costing presentation shows fixed costs as dollars per unit, so the figure looks and behaves like a variable rate. Exam tables place fixed and variable items in identical $/unit columns, which rewards pattern-matching over cost behaviour.
What to do instead
Rewrite every fixed cost as a total dollar amount for the relevant range before doing any arithmetic, and only allow truly variable costs to stay per unit. Sanity-check by asking whether doubling volume should double that cost line; if not, it must be converted to a total.
The candidate attributes a motivation or leadership theory to the wrong author or reverses its core claim, for example calling Herzberg's hygiene factors the motivators, describing Theory X as participative, or crediting Vroom with equity theory.
The theories were memorized as separate lists rather than as a contrasting set, so the names blur when options are worded abstractly and no author name appears in the stem.
What to do instead
Build a five-row contrast table with columns for theory, author, core claim, one concrete workplace example, and 'what it is NOT'. Drill by covering the author and claim columns and writing the negative column from memory, since exam distractors are usually near-miss versions of the neighbouring theory.
The candidate classifies a security control by its familiar name rather than by when it acts, labelling a password policy detective, a log review preventive, or a backup corrective when the question hinges on timing.
Control names feel intuitive and many are memorized alongside a single example, so the label arrives before the timing question is actually asked. Stems that describe a scenario without naming the control make the reflex unreliable.
What to do instead
Force every option through one question in a fixed order: does it stop the event before it occurs (preventive), discover it after it occurs (detective), or restore after damage (corrective)? Assign the category only after answering that question, and never on the basis of the control's name.
The candidate reverses which key is used in asymmetric cryptography, saying a digital signature is created with the sender's public key or that a confidential message is encrypted with the sender's private key.
Both operations are called 'asymmetric' and candidates memorize one sentence about public/private key pairs, then apply it to the wrong half of the pair under exam pressure.
What to do instead
Use a fixed two-line matrix: confidentiality means encrypt with the recipient's public key and decrypt with the recipient's private key; proof of origin means sign with the sender's private key and verify with the sender's public key. Condense it to 'private for proof, public for privacy' and test each answer against both lines.
On backup and recovery items the candidate builds the wrong restore sequence for incremental versus differential backups, or answers with RTO when the stem's scenario is about acceptable data loss.
The four terms are short, similar-sounding, and usually taught together, and the arithmetic of restore chains is rarely rehearsed in writing. RTO and RPO both read as 'recovery time' at a glance.
What to do instead
Anchor on the definitions first: RPO is how much data may be lost, measured backward from the failure; RTO is how long the system may be down, measured forward. Then apply the fixed restore rules: incremental equals the last full plus every incremental since; differential equals the last full plus only the most recent differential.
The candidate treats 'incident' and 'problem' as interchangeable in service-management scenarios, or routes a standard, pre-approved change through full change-advisory-board review.
Everyday usage collapses incidents and problems into 'something went wrong', and change categories are memorized as a list of labels rather than as a decision rule based on risk and pre-authorization.
What to do instead
Fix two one-line definitions and apply them to the stem: an incident is a single unplanned interruption to be restored quickly; a problem is the underlying cause to be eliminated. For changes, ask whether the change type is pre-authorized and low risk, which is standard and bypasses the board, versus requiring assessment and approval.
In the operating section of a statement of cash flows prepared under the indirect method, the candidate adds an increase in receivables or subtracts an increase in payables, producing the wrong operating cash flow.
Candidates memorize a mnemonic about current assets moving in the same direction as cash instead of deriving each adjustment, and the mnemonic fails as soon as the item is a liability or the direction of the change flips.
What to do instead
Replace the mnemonic with a one-sentence cash story for each line before choosing a sign, for example: sales were booked but cash has not arrived, so the receivables increase must be subtracted. If the story cannot be told in one sentence, the adjustment is not yet understood well enough to answer.
The candidate mixes interest-rate frequencies in a present-value or bond problem, discounting monthly payments with an annual nominal rate, or treats a stream as an ordinary annuity when the first payment occurs immediately; a related error is predicting that a bond price rises when yields rise.
Rate quotations are given annually while payment periods are not, so frequency conversion is a silent step that is easy to skip. The annuity classification is decided by the first cash flow date, which is often buried in the stem rather than stated as a label.
What to do instead
Before computing, write the rate and the number of periods in the same unit and confirm they match, and explicitly note whether the first cash flow occurs at time zero (annuity due) or time one (ordinary annuity). For bonds, state the inverse relationship out loud once: price moves opposite to yield, so a yield increase means a price decrease.
In ratio analysis the candidate divides a flow measure by a year-end balance instead of an average balance, or ranks two companies on a ratio without checking whether differing accounting policies or industry norms make the comparison meaningless.
The ratio formulas are recalled without the data-quality conditions attached to them, and the exam supplies both year-end and average figures in the same block, so the first available number gets used.
What to do instead
Default to average balances for any ratio that pairs an income-statement flow with a balance-sheet stock, and state that choice in the working. Before drawing a comparative conclusion, check one line of context: same industry, comparable accounting method, and whether the difference is large enough to be meaningful rather than noise.