The incorrect statement is that data within a database management system can only be manipulated directly by the database administrator. In a normal DBMS environment, authorized applications and users can manipulate data through controlled queries, transactions, forms, interfaces, and stored procedures. The database administrator manages database configuration, security, performance, backups, and privileges but is not the only party capable of data manipulation. Options A, B, and C correctly describe DBMS functionality: the DBMS manages data structures, serves as an intermediary between applications and operating system storage, and executes data manipulation instructions. Internal auditors reviewing DBMS controls should evaluate access rights, segregation of duties, transaction integrity, logging, backup, and administrator privileges.
Therefore, Option D is correct.

When a company invests in common stock, it can earn income in two primary ways:
* Dividend income: When the company receives dividends, it recognizes the income.
* Capital gains: When the stock is sold for a higher price than its purchase price, it results in a gain.
* Why Option C (Receives dividends) is Correct:
* Dividends represent income from an investment in common stock when declared and paid by the issuing company.
* Under GAAP and IFRS, dividend income is recognized when received, not when declared.
* Companies record dividends as investment income in their income statement.
* Why Other Options Are Incorrect:
* Option A (Purchases bonds):
* Incorrect because purchasing bonds is an investment transaction, not income recognition.
* Option B (Receives interest):
* Incorrect because interest income applies to bond investments, loans, or deposits, not common stock investments.
* Option D (Sells bonds):
* Incorrect because selling bonds results in capital gains or losses, not regular investment income from common stock.
* IIA Practice Guide - "Auditing Investment & Treasury Activities": Discusses the recognition of investment income.
* IFRS 9 (Financial Instruments) & GAAP Standards: Provide guidance on recording dividends as investment income.
* COSO Internal Control - Integrated Framework: Emphasizes proper financial reporting and income recognition.
IIA References:

The CAE must prioritize engagements based on risk assessment. A risk matrix (considering likelihood and impact of risks) provides the starting point to evaluate which areas of the audit universe present the highest exposure and should be included in the plan.
Option A (maturity model) helps evaluate risk management capability but is not the starting point. Option C (assurance map) supports coordination but follows the risk assessment. Option D (control framework) provides criteria but not prioritization.
Reference:
IIA Standards - Standard 2010: Planning.

To prevent unauthorized wireless network access, the strongest control is to require access through a Virtual Private Network (VPN). A VPN encrypts data and ensures that only authorized users with proper credentials can connect securely.
Encryption & Secure Communication: VPNs use strong encryption protocols (e.g., AES-256) to protect data from unauthorized access.
Restricted Access Control: Users must authenticate through a secure VPN gateway, reducing the risk of unauthorized access.
Compliance with IT Security Standards: VPNs are recommended by security frameworks such as NIST 800-
53, ISO 27001, and CIS Critical Security Controls.
Option B (Logging devices that access the network, including date, time, and user identity): Logging is important for monitoring but does not prevent unauthorized access-it only records it after the fact.
Option C (Tracking all mobile device physical locations and banning access from non-designated areas):
Geofencing can help restrict access but is not as secure as a VPN, and attackers could spoof locations.
Option D (Permitting only authorized IT personnel to have administrative control of mobile devices): While restricting administrative control is good practice, it does not prevent unauthorized users from connecting to the network.
IIA's GTAG on IT Security & Cybersecurity Risks highlights VPNs as a critical security measure to prevent unauthorized access.
ISO 27001 (Annex A.13) - Network Security Management recommends encrypting data transmissions to secure wireless network access.
NIST 800-53 (SC-12, SC-13, SC-28) emphasizes using VPNs for secure remote and wireless network access.
Why Option A is Correct (VPN):Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is A. Allowing access to the organization ' s network only through a virtual private network (VPN).

The auditor should first determine whether there is a documented business need for the vendor employees' remote access. Access should be granted only when justified by a legitimate operational requirement and supported by authorization. Once the business need is confirmed, the auditor can assess whether access is appropriately limited, monitored, and revoked when no longer needed. Read-only access may still be excessive if no business need exists. Immediately identifying who should remove access is premature without determining whether access is valid. Device management is important but secondary to confirming need and authorization. Internal auditors reviewing third-party access should evaluate business justification, approval, least privilege, authentication, monitoring, and periodic recertification. Therefore, Option A is correct.