A directive control is a policy, procedure, or guideline that establishes expected behavior to mitigate risks. In the context of outsourcing HR functions, a data protection clause in the contract ensures that the service provider is legally obligated to protect sensitive employee data.
* Legal and Regulatory Compliance - It ensures the service provider complies with GDPR, CCPA, ISO 27001, SOC 2, and other data protection laws.
* Defines Security Responsibilities - Specifies encryption, access controls, data retention policies, and penalties for non-compliance.
* Enforceable Accountability - The contract holds the provider accountable for data breaches or misuse.
* Industry Best Practice - Most outsourcing agreements include a Data Processing Agreement (DPA) as part of contractual terms.
* A. Require a SOC report - A SOC (Service Organization Control) report assesses the provider's internal controls, but it does not enforce compliance.
* C. Obtain a nondisclosure agreement (NDA) - An NDA is useful, but it only prevents individuals from sharing data; it does not define data security requirements.
* D. Encrypt the employees' data before transmitting it - Encryption is a strong preventive control, but it does not provide a directive policy like a contract clause does.
* IIA's International Professional Practices Framework (IPPF) - Standard 2201 - Requires internal auditors to assess contract terms related to risk management.
* COSO's Enterprise Risk Management (ERM) Framework - Recommends contractual agreements for third-party risk mitigation.
* ISO 27001 Annex A.15.1.2 - Specifies that security requirements must be addressed in supplier contracts.
Why a Data Protection Clause Is the Most Appropriate Directive Control?Why Not the Other Options?IIA References:# Final Answer: B. Include a data protection clause in the contract with the service provider.
(Most appropriate directive control).

A relevant cost is a future cost that differs among decision alternatives. It matters because it can influence the decision being made. Costs that are the same under all alternatives are irrelevant because they do not change the outcome. Past costs are sunk costs and should not affect current decisions because they cannot be changed, even if they differ historically. For example, in a make-or-buy decision, avoidable future production costs are relevant, while already-incurred equipment costs are usually not. Internal auditors reviewing management decisions should determine whether analyses improperly include sunk costs or exclude avoidable future costs. Option A is incorrect because a future cost that is the same among alternatives is irrelevant.
Options C and D are incorrect because past costs are not relevant to future decisions. Therefore, Option B is correct.

Reference: IIA Business Knowledge for Internal Auditing, Organizational Structure and Culture section.

An IT steering committee provides governance oversight over IT strategy, priorities, resources, major initiatives, technology direction, and alignment with business objectives. It is appropriate for the committee to monitor the adequacy of software and hardware, assess the effects of new technology, and provide broad oversight of implementation, training, and operation of new systems. However, assessing the technical adequacy of detailed standards for systems design and programming is usually a technical management or IT architecture responsibility, not a broad steering committee function. Internal audit should evaluate whether the IT steering committee has a clear charter, appropriate membership, documented decisions, risk oversight, project prioritization, and alignment with organizational strategy. The appropriate functions are 2, 3, and 4, making Option D correct.

According to IIA Standards, engagement communications must be complete, objective, and balanced. When disagreements arise, the auditor should present both the audit team's findings and management's perspective so senior management and the board can make informed decisions.
Option A is excessive; raw correspondence is not necessary. Option C omits management's opinion, reducing objectivity. Option D limits reporting to agreed items only, which would conceal significant unresolved issues.
Reference:
IIA Standards - Standard 2410: Criteria for Communicating.