When auditing logical access controls for a workstation, the focus should be on user authentication methods, including:
Password policies (length, complexity, change frequency)
User access rights and permissions
Login activity logs to detect unauthorized access attempts
Correct Answer (B - Reviewing Password Policies and User List for Login Process) Logical access controls ensure only authorized users can access a workstation.
Reviewing password length, complexity, and change frequency helps assess if security best practices are followed.
Reviewing the list of authorized users ensures that only appropriate personnel have access.
The IIA's GTAG 9: Identity and Access Management recommends evaluating password policies and user access lists as key control measures.
Why Other Options Are Incorrect:
Option A (Reviewing access badges and room logs):
Physical access controls are important but do not assess logical access (login security, user authentication).
Option C (Reviewing failed access attempts and error messages):
Reviewing failed login attempts identifies security breaches but does not directly assess password policies or user access lists.
Option D (Reviewing unsuccessful passwords and activity logs):
Passwords should not be reviewed due to privacy and security policies. Logs should be checked, but reviewing actual passwords is a security violation.
IIA GTAG 9: Identity and Access Management - Covers password controls and user authentication.
IIA Practice Guide: Auditing IT Security Controls - Recommends reviewing password policies as a key security measure.
Step-by-Step Explanation:IIA References for Validation:Thus, B is the correct answer because reviewing password policies and user lists is essential for auditing logical access controls.

When the CAE disagrees with local management's acceptance of a risk, the next step is to escalate the issue to higher management responsible for the risk-in this case, the bank's chief security officer. If senior management also accepts the risk and the CAE still considers it unacceptable, the matter should then be reported to the board.
Option A (direct to the board) skips the escalation chain. Option B is ineffective if the security manager has already decided. Option C alone does not address the CAE's responsibility to escalate unacceptable risks.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.

In the context of big data governance, the responsibilities of various stakeholders are delineated as follows:
A). Management's Responsibilities:
Management holds the primary responsibility for establishing and maintaining effective data governance frameworks. This includes ensuring that information storage systems are appropriately defined and that processes for updating critical data elements are clear and well-documented. Such measures are essential to maintain data integrity, availability, and confidentiality. The Institute of Internal Auditors (IIA) emphasizes that management is accountable for the design and implementation of data governance structures, policies, and procedures. These structures should encompass data storage solutions and the mechanisms for updating and managing critical data elements.
The Institute of Internal Auditors
B). External Auditors' Responsibilities:
External auditors are tasked with providing independent assurance on the effectiveness of an organization's financial reporting and related controls. While they may consider the implications of big data on financial reporting, their primary focus is not on the periodic monitoring and maintenance of analytical models. Instead, this responsibility typically falls under management or specialized internal functions. The IIA outlines that external auditors assess the overall control environment but do not directly manage or maintain analytical models.
C). The Board's Responsibilities:
The board of directors provides oversight and strategic direction for the organization's data governance initiatives. However, the implementation of specific controls around data quality dimensions is generally delegated to management. The board ensures that appropriate governance structures are in place and that management is effectively addressing data quality and governance issues. According to the IIA, the board's role is to oversee the data governance framework, ensuring that management has implemented effective controls and processes.
The Institute of Internal Auditors
D). Internal Auditors' Responsibilities:
Internal auditors provide independent assurance on the effectiveness of governance, risk management, and control processes, including those related to data quality and security. While they assess and report on the adequacy of controls over data, the responsibility for ensuring data quality and security rests with management. The IIA states that internal auditors evaluate the effectiveness of data governance practices but do not hold primary responsibility for data quality and security.
The Institute of Internal Auditors
In summary, option A accurately reflects management's responsibility in big data governance, aligning with the IIA's guidelines on data governance roles and responsibilities.

Comprehensive and Detailed In-Depth Explanation:
The Three Lines of Defense Model classifies risk management roles as follows:
First Line of Defense: Operational management responsible for risk controls (e.g., blocking unauthorized traffic, encrypting data).
Second Line of Defense: Risk management and compliance functions that monitor and assess the effectiveness of first-line controls (e.g., reviewing disaster recovery test results).
Third Line of Defense: Independent audit functions providing assurance (e.g., conducting security assessments).
Option C (Reviewing disaster recovery test results) aligns with the second line of defense because it involves oversight and evaluation of IT controls rather than direct execution.
Reference: IIA Three Lines Model - Risk Management

The root cause is the system interface errors between the customer payments portal and the accounting system. The most appropriate recommendation is for the finance manager to collaborate with IT and the system vendor to correct the interfacing issue.
Option A (manual workaround) is temporary and inefficient. Option B (new portal) is costly and unnecessary when the existing one can be fixed. Option D addresses symptoms but not the root cause.
Reference:
IIA Standards - Standard 2130: Control; GTAG - Business and IT Alignment.