Hacking refers to unauthorized access to an IT system, typically with the intent to disrupt, steal, or manipulate data. In this scenario, activists attacking an oil company's IT system as a protest falls under hacking because they are illegally breaking into the company's digital infrastructure to make a statement.
Let's analyze each option:
Option A: Tampering
Incorrect. Tampering refers to physically altering or interfering with a system (e.g., changing sensor readings in an oil rig), rather than attacking an IT system digitally.
Option B: Hacking
Correct.
The individuals are gaining unauthorized access to the company's IT system.
This action is commonly associated with hacktivism, where hackers attack organizations for political or ideological reasons.
IIA Reference: Internal auditors assess cybersecurity threats, including hacking and unauthorized access risks.
(IIA GTAG: Auditing Cybersecurity Risks)
Option C: Phishing
Incorrect. Phishing involves tricking individuals into revealing sensitive information (e.g., login credentials) through fraudulent emails or websites, but this scenario describes a direct attack on the IT system.
Option D: Piracy
Incorrect. Piracy typically refers to copyright infringement (e.g., unauthorized software use) rather than hacking an IT system.
Thus, the verified answer is B. Hacking.

No IT control is perfect. Even a well-designed control can fail because of human error, system malfunction, poor configuration, incomplete data, collusion, or management override. Option D reflects this limitation of internal control. Option A is incorrect because IT risks and controls should be assessed based on risk, change, and business criticality, not only every five years. Option B is too narrow because management owns controls, but effective IT control also depends on users, governance, risk management, and oversight. Option C is unrealistic because an organization should implement appropriate controls based on risk and cost-benefit, not all possible controls. Internal audit should evaluate both design effectiveness and operating effectiveness.
Therefore, Option D is correct.

Implementing enhanced failure detection and backup systems is a risk reduction response because management is taking action to lower the likelihood or impact of data loss, corruption, processing failure, or system unavailability. Risk reduction involves designing and implementing controls to bring risk within the organization's tolerance. Failure detection helps identify errors or system problems quickly, while backup systems support recovery and preservation of data integrity. Option A is incorrect because risk acceptance means management knowingly takes no additional action beyond existing controls. Option B is incorrect because risk sharing involves transferring or distributing risk, such as through insurance, outsourcing, or contractual arrangements. Option C is incorrect because risk avoidance means discontinuing the activity that creates the risk. Here, the organization continues operations but strengthens controls, so Option D is correct.

The project charter is created during project initiation. It formally authorizes the project, identifies the project purpose, high-level objectives, sponsor, authority of the project manager, key stakeholders, major assumptions, constraints, and initial scope direction. Scope planning and scope definition occur after initiation and develop the detailed project scope and work breakdown structure. Scope verification occurs later when completed deliverables are reviewed and accepted. Internal auditors reviewing project governance should confirm that major projects have approved charters before significant work begins. A charter supports accountability, authorization, alignment with strategy, and control over project objectives. Therefore, Option D is correct.

Indirect labor costs incurred in the production process are treated as part of manufacturing overhead. Since the cost was incurred on the last day of the year, it is likely that the related products are still in inventory rather than being sold.
Under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS), indirect labor costs associated with manufacturing should be included in the cost of inventory until the related goods are sold.
Once the goods are sold, the cost will be transferred to the cost of goods sold (COGS) in the income statement.
A). It should be reported as an administrative expense on the income statement. (Incorrect) Indirect labor related to manufacturing is classified as part of manufacturing overhead, not an administrative expense.
B). It should be reported as a period cost other than a product cost on the management accounts. (Incorrect) Indirect labor in production is a product cost (i.e., a cost that is included in inventory and matched with revenues when the product is sold).
Period costs refer to expenses like selling and administrative costs, which are expensed immediately.
C). It should be reported as cost of goods sold on the income statement. (Incorrect) Since the cost was incurred on the last day of the year, the related products have likely not yet been sold, meaning the cost remains in inventory.
D). It should be reported on the balance sheet as part of inventory. (Correct) Manufacturing overhead, including indirect labor, is included in inventory (work-in-process or finished goods) on the balance sheet until the goods are sold.
IIA Practice Guide: Auditing Inventory Management emphasizes that manufacturing costs, including indirect labor, should be allocated properly to inventory.
IIA Standard 2330 - Documenting Information requires auditors to ensure proper financial reporting of costs in accordance with GAAP/IFRS inventory valuation principles.
IFRS (IAS 2 - Inventories) and GAAP (ASC 330 - Inventory) state that indirect production costs must be capitalized as inventory until sold.
Explanation of Answer Choices:IIA References:Thus, the correct answer is D. It should be reported on the balance sheet as part of inventory.