CDE an online ticket sales agent, has unwittingly become an accomplice in cyber crime and is suffering attacks on its own business as a result CDE's website was poorly designed and cyber-attackers have managed to inject the site with malware, so that it collects all of CDE's customer log-in information and enables the cyber-attackers to retrieve it.
The cyber-attackers subsequently use this information to set up Botnet agents in the customers' devices which are then used in a Distributed Denial of Service (DDoS) attack whenever very popular tickets are being placed on sale such as international football matches.
The cyber-attackers secure access to a single portal on the site and buy multiple tickets for subsequent sale on the black market while the DDoS causes all other portals to be overloaded preventing real fans acquiring the tickets at face value.
Which TWO of the following apply in this scenario?

HJK is a retailer, with more than 40 shops around the country. The directors suspect that a serious fraud has occurred at one of the branches and a team of internal auditors has been sent to investigate.
An analytical review investigation shows that sales revenue is in line with budget, but overtime payments to shop staff exceed budget by 20%.
How should the internal audit team proceed?

A's directors do not believe that they always get value for money from their investment in capital projects.
Over the past decade the company has invested in 55 projects that have cost more than $1m. They are considering introducing a system of post completion audit to see if this will help them to understand any problems they have had with projects in the past. They hope to use the results of the post completion audits to significantly improve the results of their capital investments State whether you agree or disagree with the points raised by A's directors.

B uses a balanced scorecard to monitor the performance of its divisions.
Classify each of the following decisions taken by a division's management team as either commercially sound or dysfunctional.

Identify, from the list provided, which category of business risk most accurately describes the events detailed below.