The root cause is the lack of a structured process for updating access rights when employees change positions.
The best recommendation is to establish a role-based access control system, where access rights are determined and approved by process owners, not left to administrators.
Option A is corrective but only retrospective. Option B wrongly blames administrators without addressing the systemic issue. Option C risks inconsistency, as administrators should not decide rights.
Reference:
IIA Global Technology Audit Guide (GTAG) - Access Controls.

The net profit margin is calculated as:
Net Profit Margin=Net ProfitTotal Sales×100\text{Net Profit Margin} = \frac{\text{Net Profit}}{\text{Total Sales}} \times 100Net Profit Margin=Total SalesNet Profit×100 The given data shows:
Gross profit margin (Revenue - Cost of Goods Sold) remained constant at 40% in both years.
Net profit margin declined from 18% in Year 1 to 13% in Year 2.
Since the gross profit margin remained unchanged, the cost of sales did not increase relative to sales. This eliminates Option A as a possible cause.
A decline in net profit margin while gross profit remains the same suggests an increase in operating expenses, interest, or taxes.
If the government increased the corporate tax rate, net income after taxes would be lower, leading to a reduced net profit margin.
The IIA's GTAG 14 - Auditing Governance, Risk, and Compliance recommends analyzing external factors like tax rate changes when evaluating financial performance.
A). Cost of sales increased relative to sales # Incorrect. If this were true, gross profit margin would have declined, but it remained stable.
B). Total sales increased relative to expenses # Incorrect. If sales increased while expenses stayed constant, net profit margin would have increased, not decreased.
C). The organization had a higher dividend payout rate in year two # Incorrect. Dividends do not affect net profit margin, as they are paid out from net income after it is calculated.
IIA Standard 2120 - Risk Management states that auditors should analyze changes in financial performance due to external economic factors.
COSO ERM Framework highlights tax rate changes as a key risk factor in financial analysis.
IFRS (International Financial Reporting Standards) require companies to disclose changes in tax rates and their impact on profitability.
Why Option D is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is D. The government increased the corporate tax rate.

According to the Standards, internal audit activities can be provided through in-house resources, outsourcing, or a co-sourcing model. Therefore, it is possible for all resources to come from outside the organization, but ultimate responsibility and accountability remain with the CAE, management, and the board.
Option A is incorrect because oversight cannot be outsourced. Option B is incorrect-coordination with other assurance providers typically increases efficiency. Option D misstates requirements; co-sourcing is an option, not a mandatory practice.
Reference:
IIA Standards - Standard 2070: External Service Provider and Organizational Responsibility for Internal Auditing.

When prioritizing the audit universe, the CAE typically uses a risk-factor approach. This includes a combination of likelihood, impact, control effectiveness, and other relevant criteria. Solely relying on impact (Option C) or likelihood (Option B) is insufficient. Heat maps (Option D) may be tools used within the process, but they are not the actual method of prioritization.
Thus, the correct description is the risk-factor approach (Option A).
Reference:
IIA Practice Guide - Developing a Risk-based Internal Audit Plan.

A right-to-audit clause in a contract allows an organization to review and assess the operations, controls, and security measures of a third-party service provider (such as payroll service providers). Providing "read-only" functionalities supports this clause by enabling internal auditors to access and review relevant data without modifying it.
Read-only access allows auditors to verify transactions, data integrity, and compliance without affecting system operations.
This ensures that internal audit functions can review third-party controls without interference, supporting contractual audit rights.
The IIA's Standard 2070 - External Service Provider Relationships states that organizations should retain the right to audit outsourced functions to ensure compliance with internal control policies.
B). This will enforce robust risk assessment practices # Incorrect. While read-only access can contribute to risk assessment, it does not directly enforce risk management policies.
C). This will address cybersecurity considerations and concerns. # Incorrect. Cybersecurity concerns involve encryption, authentication, and intrusion detection-not just read-only access.
D). This will enhance the third party's ability to apply data analytics # Incorrect. The request is for audit purposes, not to improve the third party's analytics capabilities.
IIA's Global Technology Audit Guide (GTAG) 7: IT Outsourcing recommends a right-to-audit clause in third- party agreements.
IIA Standard 1312 emphasizes that external audits should have transparent access to outsourced functions.
ISACA's COBIT Framework highlights the importance of audit access in managing third-party risks.
Why Option A is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is A. This will support execution of the right-to-audit clause.