Organizations that rely on third-party vendors for IT services must ensure secure and controlled communication, especially in areas where external connections are involved. External connections typically include:
Cloud services (e.g., SaaS, PaaS, IaaS)
Third-party APIs
Remote access (VPNs, firewalls, network gateways)
IoT devices and external sensors
These connections introduce cybersecurity risks, requiring continuous monitoring, vendor communication, and security controls.
(A) Applications.
Incorrect. While application security is important, it is typically managed internally. Vendor involvement is needed for software patches and updates, but communication is not as tightly monitored.
(B) Technical infrastructure.
Incorrect. This layer includes internal IT components like servers, databases, and networks, which are mostly managed in-house. Vendor involvement is required for hardware/software updates but not to the same extent as external connections.
(C) External connections. #
Correct. External connections require tightly controlled communication with vendors to prevent security breaches, unauthorized access, and data leaks.
IIA GTAG "Auditing IT Governance" highlights third-party risk management as a key area for IT audits.
IIA Standard 2110 requires organizations to establish governance structures for vendor and IT security management.
(D) IT management.
Incorrect. IT management focuses on internal oversight of IT policies and compliance, but does not necessarily require tightly controlled vendor communication.
IIA GTAG - "Auditing IT Governance"
IIA GTAG - "Managing Third-Party Risks"
IIA Standard 2110 - Governance
Analysis of Answer Choices:IIA References:

Reference: IIA Business Knowledge for Internal Auditing, Workstation Security section.

A turnkey contract is a type of procurement agreement where the contractor is responsible for the entire project from planning and design to construction and delivery, ensuring that the organization receives a fully operational facility. In this case, the organization wants to transfer all risks to the builder, making a turnkey contract the most appropriate choice.
Full Risk Transfer: The contractor assumes all project risks, including design flaws, cost overruns, and delays.
Single-Point Responsibility: The builder is accountable for all aspects of the project until it is fully operational.
Minimal Client Involvement: The client does not have to manage the project's complexities.
Option A (Cost-plus contract): This contract type does not transfer all risk to the builder; instead, the client bears some risk as they pay for actual costs plus a profit margin.
Option C (Service contract): Service contracts typically cover specific services (e.g., maintenance, consulting), not full construction projects.
Option D (Solutions contract): A solutions contract generally refers to software or technology solutions, not physical facility construction.
IIA's Practice Guide on Contract Management and Risk Transfer: Highlights turnkey contracts as a method to shift project risks to third parties.
IIA's Business Knowledge for Internal Auditing (CIA Exam Part 3 Syllabus): Covers procurement and contract types, emphasizing risk transfer mechanisms.
Why Option B is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is B. Turnkey contract.

Understanding the Audit Concern:
The internal auditor observed a significant decline in tire production and needs to assess whether worker inefficiency is the cause.
Worker inefficiency is typically measured in terms of productivity, which relates output (number of tires produced) to input (labor hours worked).
Why Option A is Correct?
Total tire production labor hours provide a direct measure of worker efficiency. By analyzing the number of tires produced per labor hour, the auditor can determine whether efficiency has declined.
If labor hours remained constant or increased while production declined, this indicates inefficiency.
This approach aligns with IIA Standard 1220 - Due Professional Care, which requires auditors to use appropriate analysis to support findings.
Additionally, per IIA Standard 2310 - Identifying Information, auditors must obtain sufficient and relevant data to support conclusions.
Why Other Options Are Incorrect?
Option B (Total tire production costs):
Total costs include factors beyond labor efficiency, such as raw material prices, machinery maintenance, and overhead. This does not directly measure worker productivity.
Option C (Plant production employee headcount average):
Employee headcount alone does not reflect efficiency; it does not account for hours worked or individual performance.
Option D (Production machinery utilization rates):
Machinery efficiency is important but does not directly measure worker inefficiency. A decline in machine utilization could be due to maintenance, material shortages, or other non-labor factors.
Labor hours per unit of production (tires produced per labor hour) is the best metric for evaluating worker efficiency.
IIA Standards 1220 and 2310 support data-driven, relevant information gathering for audit conclusions.
Final Justification:IIA References:
IPPF Standard 1220 - Due Professional Care
IPPF Standard 2310 - Identifying Information
Performance Standard 2320 - Analysis and Evaluation

Extrinsic rewards are external incentives that motivate an employee to perform a task or stay in a job. These rewards include salary, bonuses, benefits, promotions, and other tangible incentives. In this case, the sales manager explicitly states that she remains in the organization because of the high bonuses, making this an example of extrinsic motivation.
(A) Incorrect - Intrinsic reward.
Intrinsic rewards are derived from internal satisfaction, such as personal growth, job fulfillment, or passion for work.
Since the manager stays primarily for monetary bonuses rather than job satisfaction, this is not intrinsic motivation.
(B) Incorrect - Job enrichment.
Job enrichment involves enhancing job roles by adding responsibilities, autonomy, or variety to improve motivation.
The scenario does not mention job enhancement as a reason for staying.
(C) Correct - Extrinsic reward.
High bonuses are a classic example of extrinsic motivation.
The manager is staying for financial incentives rather than job satisfaction.
(D) Incorrect - The hierarchy of needs.
Maslow's Hierarchy of Needs explains different levels of human motivation, but the question asks for a specific type of motivation rather than a broad theoretical framework.
IIA's Guide on Human Resources Risk Management
Highlights the impact of extrinsic vs. intrinsic motivation on employee retention.
COSO's ERM Framework - Employee Retention and Performance Management
Discusses the role of financial incentives in retaining employees.
IIA's Global Internal Audit Standards - Organizational Behavior and Employee Motivation Explains intrinsic vs. extrinsic rewards in workforce management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards: