Reference: IIA Business Knowledge for Internal Auditing, Multi-Factor Authentication section.

Acquiring a nondomestic organization can provide relatively fast entry into a foreign market because the acquired company may already have customers, distribution channels, licenses, employees, supplier relationships, market knowledge, and regulatory approvals. Building these capabilities from the ground up can take significant time and involve higher uncertainty. Option B is not necessarily true because acquisitions often require major cash outflows and integration costs. Option C may occur, but cultural diversity is not usually the primary business reason for acquisition. Option D is inappropriate and risky because influencing local government policy may raise ethical, legal, and compliance concerns. Internal audit should evaluate acquisition risks such as due diligence quality, integration planning, corruption exposure, control compatibility, and valuation assumptions. The best answer is Option A.

Understanding Competitive Business Strategies:
The board of directors' focus is on industry leadership and outperforming competitors.
A strong research and development (R&D) strategy drives innovation, allowing the organization to introduce new and differentiated products that enhance competitive advantage.
Why Option C (Investment in R&D) Is Correct?
R&D drives product innovation, helping the organization stay ahead of competitors.
Investing in new technologies and unique product features differentiates the company and strengthens market leadership.
IIA Standard 2120 - Risk Management supports evaluating strategic investments that enhance business growth and competitive positioning.
Why Other Options Are Incorrect?
Option A (Divesting unprofitable product lines):
While divestment improves financial health, it does not directly contribute to market leadership.
Option B (Increasing diversity of business units):
Expanding into new business areas spreads risk but may not provide a focused competitive advantage in the primary industry.
Option D (Relocating manufacturing to another country):
Lowering costs improves efficiency, but it does not directly position the company as an industry leader.
Investing in R&D aligns best with the board's goal of industry leadership and competitive advantage.
IIA Standard 2120 supports strategic risk management and innovation investment.
Final Justification:IIA References:
IPPF Standard 2120 - Risk Management (Strategic Investment & Competitive Advantage) COSO ERM - Business Growth & Innovation Risk Management Porter's Competitive Strategy Model - R&D as a Market Differentiator

Multi-report summaries are designed to provide senior management and the board with aggregated results across multiple audit engagements. To make them effective, internal audit functions typically rate findings (e.
g., high, medium, low) so results can be compared and summarized efficiently.
Option A is incomplete because summaries are not just about describing audit work but about presenting meaningful insights. Option B (tables) refers to presentation style, not the key principle. Option C is incorrect because even if boards review individual reports, summaries provide strategic insights across engagements.
Thus, the correct answer is Option D.
Reference:
IIA Practice Guide - Formulating and Expressing Internal Audit Opinions.

This attack was caused by a phishing email containing malware embedded in an Excel spreadsheet. The most effective way to prevent such attacks is employee awareness training, as human error is the leading cause of successful phishing attempts.
Understanding Phishing Attacks:
Phishing emails trick employees into opening malicious links or attachments, leading to malware infections and data breaches.
Cybercriminals often disguise emails as coming from trusted vendors or colleagues.
Why Employee Training is the Most Effective Control:
Employees must be trained to identify suspicious emails, attachments, and links.
Training reduces the likelihood of employees accidentally opening malicious files.
Many cybersecurity frameworks (e.g., NIST, ISO 27001, and CIS) emphasize employee awareness as the first line of defense.
Why the Other Options Are Less Effective Alone:
A). Monitoring network traffic. #
Can detect unusual activity after an attack but does not prevent phishing attempts.
B). Using whitelists and blacklists to manage network traffic. #
Helps filter harmful websites, but phishing emails often appear legitimate and may bypass filters.
C). Restricting access and blocking unauthorized access to the network. # Helps limit damage after malware enters the network but does not stop employees from opening phishing emails.
IIA GTAG (Global Technology Audit Guide) on Cybersecurity: Recommends employee awareness programs as a key control.
IIA Standard 2110 (Governance): Internal auditors should assess cybersecurity training programs.
NIST Cybersecurity Framework - PR.AT (Protect - Awareness and Training): Emphasizes the role of employee education in preventing cyber threats.
ISO/IEC 27001 - Security Awareness and Training (A.7.2.2): Requires organizations to implement cybersecurity awareness programs.
Step-by-Step Justification:IIA References:Thus, the correct answer is D. Educating employees throughout the company to recognize phishing attacks. #