The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least- privilege access to restrict users based on their job responsibilities.
(A) Incorrect - The authentication process relies on a simple password only, which is a weak method of authorization.
While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.
(B) Correct - The system authorization of the user does not correctly reflect the access rights intended.
The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.
Proper role-based access controls (RBAC) should limit user permissions based on job functions.
(C) Incorrect - There was no periodic review to validate access rights.
While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.
(D) Incorrect - The application owner apparently did not approve the access request during the provisioning process.
Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.
IIA's GTAG (Global Technology Audit Guide) - Access Control and Authorization Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.
COBIT Framework - IT Security Governance
Discusses proper authorization mechanisms to align system access with business needs.
NIST Cybersecurity Framework - Access Management Controls
Recommends restricting access rights based on the principle of least privilege (PoLP).
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The CAE may engage external experts to provide specialized knowledge when the internal audit function lacks expertise. However, the CAE and internal audit activity must remain responsible for the engagement and for forming the final opinion.
Options A and B are inappropriate because they outsource the responsibility and independence of internal audit to the consultant. Option D improperly delegates forming the opinion to an external party. The correct approach is collaborating with the consultant while retaining responsibility (Option C).
Reference:
IIA Standards - Standard 1210: Proficiency; Implementation Guide 1210.

Comprehensive and Detailed In-Depth Explanation:
File encryption protects the confidentiality and integrity of information during transmission and storage. It ensures that only authorized recipients can access the data by converting it into an unreadable format.
Option A (Firewalls) - Prevents unauthorized access to networks but does not secure data exchange.
Option B (Activity logs) - Tracks actions but does not protect data confidentiality.
Option C (Antivirus software) - Protects against malware but does not encrypt data in transit.
Thus, file encryption (Option D) is the best security control for protecting exchanged information.
Reference: IIA IT Security & Encryption Controls

Understanding Organizational Structures:
Organizations structure their workforce based on functions, products, or a combination of both.
A matrix organization combines functional and project-based structures, where employees report to both a functional manager and a project manager.
Why Option C (Matrix Organization) Is Correct?
The software development firm uses employees from multiple departments who report to a single project manager, which is a defining characteristic of a matrix structure.
Employees maintain their departmental roles while contributing to project-based work.
IIA Standard 2110 - Governance supports evaluating flexible organizational structures like matrix organizations to ensure accountability and risk management.
Why Other Options Are Incorrect?
Option A (Functional departmentalization):
In functional structures, employees report to one department head, not a project manager.
Option B (Product departmentalization):
In product-based structures, employees are grouped based on specific product lines, not cross-functional projects.
Option D (Divisional organization):
A divisional structure separates business units based on markets, regions, or customer segments, not cross- functional teams.
A matrix organization allows employees to work across departments under a project manager, making option C the best choice.
IIA Standard 2110 supports assessing governance structures that involve cross-functional teams.
Final Justification:IIA References:
IPPF Standard 2110 - Governance (Organizational Structures & Reporting Lines) COSO ERM - Risk Management in Matrix Organizations Project Management Institute (PMI) - Matrix Management Best Practices

Understanding Strategic Levels in an Organization:
Corporate-Level Strategy: Defines overall company direction, including mergers, acquisitions, and diversification.
Business-Level Strategy: Focuses on how the company competes in its industry (e.g., cost leadership, differentiation).
Functional-Level Strategy: Relates to specific departments (marketing, HR, IT) supporting business-level goals.
Why Option C (Business-Level Strategy) Is Correct?
The question "How does our organization compete?" directly relates to business-level strategy.
It focuses on competitive positioning within the industry, such as:
Cost leadership (competing on price)
Differentiation (unique product offerings)
IIA Standard 2110 - Governance requires auditors to evaluate strategic alignment with competitive positioning.
Why Other Options Are Incorrect?
Option A (Functional-Level Strategy):
Focuses on departmental decisions, not overall competition.
Option B (Corporate-Level Strategy):
Corporate strategy defines broad company direction, not specific competition strategies.
Option D (Department-Level Strategy):
Similar to functional strategy, it does not define how the company competes in the industry.
Business-level strategy answers "How does our organization compete?" by defining industry-specific competitive approaches.
IIA Standard 2110 supports governance over strategic positioning.
Final Justification:IIA References:
IPPF Standard 2110 - Governance (Strategic Planning & Competitive Advantage) Porter's Competitive Strategy Framework COSO ERM - Strategic Risk Management