Preventing security breaches requires proactive security controls, and the approval of identity requests ensures that only authorized individuals gain access to systems and data.
Types of Security Controls:
Preventive Controls (Stop security incidents before they happen)
Detective Controls (Identify security breaches after they occur)
Corrective Controls (Address security issues after detection)
Why Identity Request Approval is the Most Effective Preventive Control?
User access approval ensures that only verified personnel receive credentials.
According to IIA GTAG on Identity and Access Management, user provisioning must follow strict approval workflows to prevent unauthorized access.
By restricting access before a breach occurs, organizations reduce risks related to insider threats, phishing attacks, and credential misuse.
Why Not Other Options?
B). Access Logging:
Access logs record activity but do not prevent security breaches.
C). Monitoring Privileged Accounts:
Monitoring privileged accounts helps detect suspicious activity but does not stop unauthorized access beforehand.
D). Audit of Access Rights:
Regular audits ensure compliance but do not actively prevent unauthorized access in real-time.
IIA GTAG - Identity and Access Management
IIA Standard 2120 - Risk Management and IT Controls
COBIT 2019 - Access Control and Security Management
Step-by-Step Justification:IIA References:Thus, the correct and verified answer is A. Approval of identity request.

Similar frames of reference usually improve communication because the sender and receiver share comparable background, terminology, assumptions, or experiences. This reduces misunderstanding and helps messages be interpreted as intended. Filtering is a communication barrier because information may be intentionally or unintentionally altered as it passes through people or organizational levels. Communication overload is also a barrier because excessive information can prevent the receiver from identifying what is important. Lack of source credibility weakens communication because the receiver may distrust or discount the message. Internal auditors must manage these barriers when conducting interviews, issuing reports, and presenting results to management and the board. Clear terminology, credible evidence, concise communication, and audience awareness are essential. Since similar frames of reference support communication rather than hinder it, Option C is correct.

Project governance refers to a broad collection of integrated policies, standards, and procedures that provide a framework for planning and executing projects. It establishes decision-making processes, accountability, and risk management controls to ensure that projects align with organizational objectives.
(A) Project portfolio. #
Incorrect. A project portfolio refers to a collection of projects managed together to achieve strategic objectives. It does not specifically define the policies, standards, and procedures for project execution.
(B) Project development. #
Incorrect. Project development focuses on designing, building, and testing a project, but it does not encompass governance structures like policies, standards, and oversight.
(C) Project governance. #
Correct. Project governance includes integrated policies, standards, and procedures that guide project planning, execution, and oversight.
IIA GTAG " Auditing IT Projects " emphasizes project governance as the primary control framework for managing project risks and ensuring alignment with organizational goals.
(D) Project management methodologies. #
Incorrect. Project management methodologies (e.g., Agile, Waterfall, PRINCE2) provide structured approaches for executing projects but do not encompass the full governance framework.
IIA GTAG - " Auditing IT Projects "
IIA Standard 2110 - Governance (Project Risk Management)
COSO ERM Framework - Project Oversight and Risk Governance
Analysis of Answer Choices:IIA References:Thus, the correct answer is C (Project governance), as it provides the integrated policies, standards, and procedures needed for effective project oversight.

Comprehensive and Detailed In-Depth Explanation:
Authentication ensures that only authorized users can access a system by requiring credentials such as PINs, passwords, or biometrics.
Option A (Remote wipe) - Deletes data but does not control initial access.
Option B (Software encryption) - Protects stored data, not user access.
Option C (Device encryption) - Secures the device, but authentication controls access.
Since authentication ensures secure user verification, Option D is correct.
Reference: IIA IT Security - Access Control Mechanisms

Ineffective change management is indicated by poor impact analysis, increased production issues, and frequent emergency changes. If IT management cannot predict how changes affect interdependent systems or business processes, change risk assessment is weak. Increased trouble calls or programmer support hours suggest changes are causing defects, instability, or user disruption. Frequent emergency changes that bypass normal controls indicate inadequate planning, testing, or release management. A lack of turnover in systems support and business analyst groups is not a negative indicator; stability may actually support institutional knowledge. Internal auditors reviewing change management should evaluate authorization, testing, segregation of duties, migration controls, emergency change approval, backout plans, and post- implementation review. Therefore, items 1, 2, and 4 are correct, making Option C the answer.