Depreciation is the systematic allocation of an asset's cost over its useful life. It reflects how much of the asset's value is used up in each accounting period.
Spreads Cost Over Time - Instead of expensing the total cost immediately, depreciation distributes it across multiple periods.
Matches Expenses with Revenue - Ensures that the cost of long-term assets is allocated in the periods they generate revenue.
Required for Financial Reporting - Compliance with GAAP and IFRS requires proper allocation of asset costs.
B). It is a process of asset valuation - Incorrect because depreciation does not determine market value; it only spreads cost over time.
C). It is a process of accumulating adequate funds to replace assets - Incorrect because depreciation is an accounting concept, not a savings mechanism.
D). It is a process of measuring decline in the value of assets because of obsolescence - Incorrect because depreciation allocates cost, not necessarily measuring value decline (which is impairment).
IIA's GTAG on Financial Controls and Reporting - Defines depreciation as a cost allocation method.
International Financial Reporting Standards (IFRS 16) & US GAAP (ASC 360) - State that depreciation is used to allocate asset costs over time.
COSO's Internal Control Framework - Covers accounting treatments for fixed assets.
Why Depreciation is an Allocation Process?Why Not the Other Options?IIA References:# Final Answer: A. It is a process of allocating cost of assets between periods.

Even if the internal audit activity is outsourced, the organization's senior management and the board retain overall responsibility for governance, risk management, and control processes. Specifically, management must ensure that an annual risk assessment is performed to identify and prioritize organizational risks. This forms the basis of the internal audit plan.
While the external service provider may assist in planning and execution, the assessment of risks to the organization cannot be delegated away because accountability for risk management remains with the organization itself. Activities such as quality assurance programs or audit scope discussions can be supported or executed by the service provider, but responsibility for risk assessment is always with management and the board.
Reference:
IIA Standards - Standard 2070: External Service Provider and Organizational Responsibility for Internal Auditing.

Capital budgeting techniques are used to evaluate investment projects by analyzing potential costs and benefits. One key consideration in capital budgeting is the time value of money (TVM), which states that a dollar received today is worth more than a dollar received in the future due to its earning potential.
Why Option C (Discounted cash flow) is Correct:
Discounted Cash Flow (DCF) explicitly incorporates the time value of money by discounting future cash flows to their present value.
Methods such as Net Present Value (NPV) and Internal Rate of Return (IRR) fall under DCF analysis, making them highly reliable for long-term capital budgeting decisions.
Why Other Options Are Incorrect:
Option A (Annual rate of return):
Incorrect because the annual rate of return (ARR) is based on accounting profits and does not consider the time value of money.
Option B (Incremental analysis):
Incorrect because incremental analysis is a decision-making tool that compares alternative costs and revenues but does not discount future cash flows.
Option D (Cash payback):
Incorrect because the payback period method only measures the time needed to recover an investment and ignores the time value of money.
IIA GTAG - "Auditing Capital Budgeting Decisions": Discusses the importance of time value of money in investment decisions.
COSO ERM Framework - "Risk Considerations in Financial Planning": Recommends using DCF methods for capital investment decisions.
IFRS & GAAP Financial Reporting Standards: Advocate for using DCF techniques for asset valuation and investment analysis.
IIA References:

Hacking refers to unauthorized access to an IT system, typically with the intent to disrupt, steal, or manipulate data. In this scenario, activists attacking an oil company's IT system as a protest falls under hacking because they are illegally breaking into the company's digital infrastructure to make a statement.
Let's analyze each option:
Option A: Tampering
Incorrect. Tampering refers to physically altering or interfering with a system (e.g., changing sensor readings in an oil rig), rather than attacking an IT system digitally.
Option B: Hacking
Correct.
The individuals are gaining unauthorized access to the company's IT system.
This action is commonly associated with hacktivism, where hackers attack organizations for political or ideological reasons.
IIA Reference: Internal auditors assess cybersecurity threats, including hacking and unauthorized access risks.
(IIA GTAG: Auditing Cybersecurity Risks)
Option C: Phishing
Incorrect. Phishing involves tricking individuals into revealing sensitive information (e.g., login credentials) through fraudulent emails or websites, but this scenario describes a direct attack on the IT system.
Option D: Piracy
Incorrect. Piracy typically refers to copyright infringement (e.g., unauthorized software use) rather than hacking an IT system.
Thus, the verified answer is B. Hacking.

Comprehensive and Detailed In-Depth Explanation:
Primary controls in spreadsheet management focus on ensuring data accuracy, integrity, and security.
Option A (Locking formulas and static data) prevents unauthorized changes, ensuring data integrity. This is a direct control over spreadsheet accuracy, making it the correct answer.
Option B (Backup storage) is an IT operational control, not a primary financial reporting control.
Option C (Documentation of spreadsheet use) is important for governance but does not directly prevent errors.
Option D (Version control software) helps manage changes but does not directly ensure financial reporting accuracy.
Thus, locking and protecting spreadsheet formulas is the most critical primary control for accurate financial reporting.
Reference: IIA IT Controls & Data Governance