An investment center is evaluated not only on revenues and costs but also on how effectively it uses invested capital. Residual income is appropriate because it measures profit after deducting a required return on the investment base. This makes it suitable for assessing whether management generated returns above the organization's minimum required rate. Cost centers are evaluated mainly on cost control, revenue centers on revenue generation, and profit centers on revenues minus expenses; none of these centers is directly responsible for invested capital. Flexible budgets and variance analysis can apply to many responsibility centers. Contribution margin reporting is useful for segment profitability but does not fully evaluate investment use. Therefore, residual income is uniquely suited to investment center evaluation, making Option D correct.

Comprehensive and Detailed In-Depth Explanation:
An intranet is a private network used by an organization for internal communication and information sharing among employees. It is accessible only to authorized personnel within the company.
Option A (Extranet) - Allows external parties (e.g., suppliers, partners) to access limited information.
Option B (LAN) - Refers to a network infrastructure rather than controlled access.
Option D (Internet) - Is public and not restricted to internal personnel.
Thus, Option C (Intranet) is the correct answer as it ensures access only to organizational personnel.
Reference: IIA IT Security - Network Access Controls

Verbal answers recorded in video interviews are unstructured data because they do not follow a predefined table, field layout, or database schema. The information may include speech, tone, pauses, gestures, and narrative explanations that require transcription, tagging, or text analytics before systematic analysis.
Structured data is organized in rows and columns, such as transaction records. Semi-structured data contains some organizing tags or metadata, such as emails or XML files. Quasi-structured data may have inconsistent or irregular formatting. Internal auditors using video, audio, emails, documents, or interview notes should understand that these sources often require specialized methods before analysis. Since recorded verbal responses are not organized in a fixed structure, Option C is correct.

Logical access controls are security measures that restrict electronic access to systems, applications, and data based on user roles and permissions. These controls ensure that only authorized personnel have access to specific functions or information.
* Logical access controls enforce role-based access management, ensuring users only have permissions aligned with their job functions.
* Proper role definitions help prevent fraud and unauthorized access by enforcing segregation of duties (SoD).
* The IIA's GTAG 4 - Management of IT Auditing highlights logical access as a core security control that supports SoD.
* A. Require complex passwords to be established and changed quarterly # Incorrect. While strong passwords are an access control measure, they are not a comprehensive logical access control (they are part of authentication mechanisms).
* B. Require swipe cards to control entry into secure data centers. # Incorrect. Swipe card access is a physical access control, not a logical access control.
* C. Monitor access to the data center with closed-circuit camera surveillance. # Incorrect. CCTV surveillance is also a physical security control, not a logical access control.
* IIA GTAG 4 - Management of IT Auditing emphasizes that logical access controls should be role- based and support segregation of duties.
* IIA Standard 2110 - Governance states that organizations should maintain appropriate access controls to protect sensitive information.
* NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) identifies logical access control as a fundamental cybersecurity measure.
Why Option D is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is D. Maintain current role definitions to ensure appropriate segregation of duties.

The root cause is the lack of a structured process for updating access rights when employees change positions.
The best recommendation is to establish a role-based access control system, where access rights are determined and approved by process owners, not left to administrators.
Option A is corrective but only retrospective. Option B wrongly blames administrators without addressing the systemic issue. Option C risks inconsistency, as administrators should not decide rights.
Reference:
IIA Global Technology Audit Guide (GTAG) - Access Controls.