Access control is about ensuring that only authorized individuals can access specific data, based on their role and necessity. The Principle of Least Privilege (PoLP) dictates that users should only have access to the data they need for their job.
* Minimizes Unauthorized Access Risks - Prevents employees from accessing sensitive data unnecessarily.
* Supports Segregation of Duties (SoD) - Critical in preventing fraud and security breaches.
* Enhances Compliance - Meets regulatory requirements like GDPR, PCI-DSS, and SOX, which demand strict access controls.
* Strengthens System Security - Reduces potential damage from malware, insider threats, or data breaches.
* A. Install and update anti-virus software - Important for cybersecurity but does not directly control user access.
* B. Implement data encryption techniques - Protects stored or transmitted data but does not define access rights.
* D. Upgrade firewall configuration - Controls network traffic, not user-specific access within an automated system.
* IIA's GTAG on Access Management and Controls - Recommends setting data access based on user needs to prevent fraud and misuse.
* COBIT 2019 (Governance and Management of Enterprise IT) - Advocates for role-based access controls.
* ISO 27001 Annex A.9 (Access Control) - Stresses the importance of restricting access based on business requirements.
Why Setting Data Availability by User Need is the Best Strategy?Why Not the Other Options?IIA References:
# Final Answer: C. Set data availability by user need.

A lump-sum contract (also known as a fixed-price contract) is a contract type where the vendor agrees to complete a project for a predetermined price. In this scenario, the organization agreed to pay the vendor
$3,000,000 to design, procure, and construct a power substation.
Lump-Sum Contract (Correct Answer: B)
A lump-sum contract (also called a fixed-price contract) is an agreement where the contractor is responsible for completing the entire project at a set price.
This type of contract transfers cost risk to the contractor since they must manage expenses within the agreed budget.
IIA Standard 2120 - Risk Management states that internal auditors should assess contract risks, including financial and performance risks in vendor contracts.
The contract price is predefined, which aligns with the scenario given in the question.
Why the Other Options Are Incorrect:
A). Cost-Reimbursable Contract (Incorrect)
A cost-reimbursable contract involves reimbursing the vendor for actual costs incurred, plus a fee or profit.
This is not applicable because the contract specifies a fixed price.
C). Time and Material Contract (Incorrect)
This contract type is based on actual time spent and materials used, typically used when scope is uncertain.
The given scenario clearly defines the project and budget, making this option unsuitable.
D). Bilateral Contract (Incorrect)
A bilateral contract refers to a mutual agreement between two parties where both have obligations.
While most contracts are bilateral in nature, this is not a specific contract type like lump-sum or cost- reimbursable contracts.
IIA Standard 2120 - Risk Management (Evaluating contract risks)
IIA Standard 2210 - Engagement Objectives (Assessing vendor contracts)
IIA Standard 2130 - Compliance (Ensuring contract compliance)
Step-by-Step Justification:IIA References for This Answer:Thus, the correct answer is B. A lump-sum contract because the contract is based on a predefined, fixed price of $3,000,000.

Reference: IIA Business Knowledge for Internal Auditing, BCG Matrix section.

The Business Impact Analysis (BIA) plan is a key component of business continuity planning that identifies critical business processes and determines their Recovery Time Objectives (RTOs) and Recovery Point Objectives (RPOs).
Correct Answer (C - Business Impact Analysis Plan)
The BIA is a systematic process that identifies essential functions, assesses potential disruptions, and determines the recovery time requirements to ensure business continuity.
The Recovery Time Objective (RTO) defines the maximum acceptable downtime for critical business functions.
The Recovery Point Objective (RPO) identifies how much data loss is tolerable.
According to the IIA Global Technology Audit Guide (GTAG) 10: Business Continuity Management, a BIA is essential for assessing the financial, operational, and reputational impact of disruptions.
Why Other Options Are Incorrect:
Option A (Business Continuity Management Charter):
A charter defines the governance, responsibilities, and overall framework of business continuity but does not focus on RTOs or critical business processes.
Option B (Business Continuity Risk Assessment Plan):
A risk assessment identifies threats and vulnerabilities but does not define recovery time objectives.
While risk assessments inform the BIA, they do not replace it.
Option D (Business Case for Business Continuity Planning):
A business case justifies investment in continuity planning but does not map business processes to RTOs.
GTAG 10: Business Continuity Management - Defines BIA as the process for identifying critical business functions and their RTOs.
IIA Practice Guide: Auditing Business Continuity - Emphasizes the role of BIA in business resilience.
Step-by-Step Explanation:IIA References for Validation:Thus, the Business Impact Analysis (BIA) Plan (C) is the correct answer because it pairs critical business processes with recovery time objectives.

Fraud in time-tracking systems-such as "buddy punching" (where one employee clocks in/out for another)- is a common payroll fraud scheme. The most effective method to prevent this is biometric authentication, which ensures that only the actual employee can clock in or out.
(A) Face or finger recognition equipment. #
Correct. Biometric authentication (such as fingerprint or facial recognition) is the most effective solution because it uniquely identifies each individual, making it impossible for an employee to clock in on behalf of a colleague.
IIA GTAG "Managing and Auditing IT Vulnerabilities" recommends biometric authentication as a strong fraud prevention measure.
IIA Practice Guide "Fraud Prevention and Detection in an Automated Environment" highlights the use of biometrics for enhancing security in access control systems.
(B) Radio-frequency identification (RFID) chips to authenticate employees with cards.
Incorrect. RFID cards can be shared between employees, allowing fraud to continue. They are useful for access control but do not verify the identity of the person using the card.
(C) A requirement to clock in and clock out with a unique personal identification number (PIN).
Incorrect. PINs can be shared or stolen, making them ineffective in preventing buddy punching.
(D) A combination of a smart card and a password to clock in and clock out.
Incorrect. Like RFID and PIN systems, smart cards and passwords can be shared, making them ineffective against fraudulent time-tracking practices.
IIA GTAG - "Managing and Auditing IT Vulnerabilities"
IIA Practice Guide - "Fraud Prevention and Detection in an Automated Environment" COSO Framework - Fraud Risk Management Analysis of Answer Choices:IIA References:Thus, the correct answer is A, as biometric authentication directly verifies the employee's identity, preventing time-tracking fraud.