Centralized authority refers to decision-making being concentrated at the top levels of an organization, ensuring uniform policies and procedures across departments.
Let ' s analyze each option:
A). Fraud committed through collusion is more likely when authority is centralized.
Incorrect. Centralized authority reduces the chances of fraud by enforcing strict oversight and controls.
Decentralized structures may create more opportunities for fraud due to inconsistent policies.
B). Centralized managerial authority typically enhances certainty and consistency within an organization. # (Correct Answer) Correct. Centralized authority ensures consistent decision-making, standardized processes, and clear policies, reducing uncertainty.
For example, in a multinational company, a centralized governance structure ensures compliance with financial reporting standards across all subsidiaries.
C). When authority is centralized, the alignment of activities to achieve business goals typically is decreased.
Incorrect. Centralized authority actually helps in aligning business activities toward strategic goals by ensuring uniform direction and coordination.
D). Using separation of duties to mitigate collusion is reduced only when authority is centralized.
Incorrect. Separation of duties (SoD) is a key internal control mechanism that exists regardless of centralization. Organizations implement SoD through policies, not just governance structures.
IIA Standard 2110 - Governance - Emphasizes the importance of clear governance structures in organizations.
COSO Internal Control - Integrated Framework - Discusses centralization and its impact on risk management and control effectiveness.
IIA Global Technology Audit Guide (GTAG) - Enterprise Risk Management (ERM) - Highlights the role of centralized authority in aligning corporate strategies.
ISO 37000:2021 - Governance of Organizations - Outlines how centralized governance improves organizational consistency and decision-making.
IIA References:

A cost leadership strategy focuses on becoming more efficient than competitors so the organization can offer products or services at lower cost while maintaining acceptable quality. Efficiency may come from economies of scale, process standardization, supply-chain control, technology, automation, tight cost management, or high asset utilization. A differentiation strategy focuses on uniqueness, quality, brand, innovation, or customer experience. A focus strategy targets a narrow market segment, either through cost focus or differentiation focus. Portfolio strategy concerns managing a mix of businesses or investments rather than competing through operating efficiency. Internal auditors reviewing strategy should understand the selected competitive approach because it affects risks, controls, performance measures, and investment priorities. Therefore, Option B is correct.

To ensure security when employees use their own smart devices to access organizational applications, the best approach is to allow only pre-approved devices that meet the organization's security standards.
Device Security & Compliance: Approved devices are verified for security measures like encryption, mobile device management (MDM), and antivirus protection.
Risk Management: Restricting access to pre-approved devices reduces the risk of malware, unauthorized access, and vulnerabilities.
IT Control & Monitoring: IT can enforce security updates, compliance policies, and access control mechanisms on pre-approved devices.
Option A (Using a jailbroken or rooted smart device feature): Jailbroken or rooted devices remove security protections and create severe security vulnerabilities.
Option C (Obtaining written assurance from the employee that security policies and procedures are followed):
Written assurances alone are not a security measure; technical controls must be enforced.
Option D (Introducing a security question known only by the employee): Security questions are weak authentication measures and do not verify the legitimacy of a device.
IIA ' s GTAG on Information Security Management stresses the importance of device security and requiring IT-approved devices.
NIST Special Publication 800-124 (referenced in IIA's IT Audit Guidance) highlights best practices for securing mobile devices in an enterprise setting, recommending pre-approved devices.
Why Option B is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is B. Using only smart devices previously approved by the organization.

A highly collectivist culture values group identity, shared success, cooperation, and team recognition more than individual rewards. If employees are strongly collectivist, a lucrative individual reward system may fail to motivate because it emphasizes personal gain rather than group achievement. High masculinity would generally support competition, achievement, and individual performance rewards, so Option A is less likely.
Low uncertainty avoidance relates to tolerance for ambiguity, not primarily reward preference. Low long-term orientation concerns short-term versus long-term focus, not the central motivation problem described. Internal audit functions reviewing incentive systems should consider whether compensation structures align with organizational culture and desired behavior. Therefore, Option C is correct.

A disaster recovery plan (DRP) ensures that critical systems and data can be restored after an incident. If backup plans exist but no recovery and restore processes are defined, then the organization lacks a functional recovery plan altogether.
(A) Hot recovery plan.
Incorrect. A hot recovery plan includes real-time data replication and immediate failover systems, allowing for almost instant recovery in case of an outage. Since the scenario mentions that no restore process is defined, this cannot be a hot recovery plan.
(B) Warm recovery plan.
Incorrect. A warm recovery plan involves regular backups and a standby system that can be activated within hours or days. However, without defined restore procedures, the organization does not even have a warm recovery plan.
(C) Cold recovery plan.
Incorrect. A cold recovery plan means that backups exist but recovery takes significant time because systems and infrastructure need to be rebuilt. However, a cold plan still includes a recovery process, which the scenario lacks.
(D) Absence of recovery plan. #
Correct. If data backup plans exist but no restore processes are defined, then there is no functional recovery plan. Without a structured approach to data recovery, backups alone are useless in an actual disaster scenario.
IIA GTAG " Business Continuity and Disaster Recovery " highlights the need for detailed recovery processes as part of an overall disaster recovery plan.
IIA GTAG - " Business Continuity and Disaster Recovery "
IIA Standard 2120 - Risk Management
COBIT Framework - IT Disaster Recovery Controls
Analysis of Answer Choices:IIA References:Thus, the correct answer is D, as data backups without recovery procedures indicate the absence of a recovery plan.