Biometric authorization is the most effective control listed for restricting access to secure areas because it authenticates users based on unique physical characteristics, such as fingerprints, retina patterns, facial geometry, or hand geometry. It is stronger than a policy because it directly prevents unauthorized access.
Access log reviews are detective; they identify access after it occurs rather than restricting it at the point of entry. Security cameras are also primarily detective or deterrent controls. A security policy is necessary, but it does not physically stop unauthorized entry. Internal auditors reviewing secure areas should evaluate whether physical access is limited, logged, reviewed, revoked timely, and appropriate to the sensitivity of assets protected. Therefore, Option C is correct.

Self-actualization needs involve personal growth, realizing potential, mastery, creativity, achievement, and meaningful challenge. Assigning the auditor to complex and challenging audits is the best motivator because it allows professional development, judgment, problem-solving, and higher-level contribution. Rotating the auditor to a multidisciplinary team may provide variety, but it is not as directly tied to self-actualization. Job security addresses safety needs, which are lower in Maslow's hierarchy. Increased benefits address compensation and security needs rather than growth and fulfillment. Internal audit leaders should align assignments with staff motivation, competence, and development goals to improve performance and retention.
Since complex audit work best supports self-actualization, Option B is correct.

When performing data analytics, the process typically follows a structured approach. Once the internal auditor has determined the expected value from the review, the next logical step is to obtain the data. Without acquiring the necessary datasets, further actions such as normalization, risk identification, and analysis cannot be effectively carried out.
(A) Incorrect - Normalize the data.
Normalization is a preprocessing step that occurs after data has been obtained.
Before normalizing, the auditor must first access and collect relevant data sources.
(B) Correct - Obtain the data.
Data acquisition is a critical step in data analytics.
The auditor must gather relevant and reliable data from internal and external sources before proceeding with further steps such as cleansing, normalization, and analysis.
(C) Incorrect - Identify the risks.
Risk identification is an essential part of the audit process but typically comes after obtaining and reviewing data patterns.
Without data, identifying risks would be speculative rather than evidence-based.
(D) Incorrect - Analyze the data.
Data analysis comes after obtaining, cleaning, and structuring the data.
Jumping straight to analysis without ensuring data quality would lead to inaccurate conclusions.
IIA's GTAG (Global Technology Audit Guide) - Data Analytics
Recommends obtaining data as the initial step in data-driven audits.
IIA's Global Internal Audit Standards - Use of Data Analytics in Auditing Stresses the importance of data acquisition before proceeding with normalization and analysis.
COSO's ERM Framework - Data-Driven Decision Making
Highlights the importance of securing data for risk identification and mitigation.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

To efficiently protect business data from corruption and errors, the best approach is proactive detection through validation controls. Batch total calculations help verify data integrity before approval, ensuring errors are caught early.
(A) Controls to ensure data is unable to be accessed without authorization.
Incorrect: Access controls prevent unauthorized access, but they do not detect or prevent data corruption
/errors.
(B) Controls to calculate batch totals to identify an error before approval. (Correct Answer) Batch control totals ensure that data entries match expected values before processing, helping detect errors before approval.
IIA GTAG 3 - Continuous Auditing recommends automated validation and reconciliation checks for data integrity.
(C) Controls to encrypt the data so that corruption is likely ineffective.
Incorrect: Encryption protects data confidentiality, but it does not prevent or detect errors or corruption.
(D) Controls to quickly identify malicious intrusion attempts.
Incorrect: Intrusion detection systems focus on cybersecurity, not data corruption or errors.
IIA Standard 2120 - Risk Management: Recommends controls for error prevention and early detection.
IIA GTAG 3 - Continuous Auditing: Suggests automated validation processes like batch totals to detect errors before approval.
Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because batch total calculations effectively detect errors before approval, ensuring data integrity.

The internal audit plan must be risk-based, as required by the IIA Standards. If cybersecurity has been identified as a high risk during the annual risk assessment, then it should be included in the audit plan to provide assurance over the adequacy of controls.
Including engagements simply to satisfy management (Option A) or for auditor learning purposes (Option B) does not align with risk-based planning principles. Likewise, management requests alone (Option D) do not dictate audit plan content; engagements must be prioritized based on risk to the organization.
Reference:
IIA Standards - Standard 2010: Planning; Implementation Guide 2010 - Risk-Based Planning.