Commercial software packages can reduce development time, implementation cost, and technical risk, but their major disadvantage is lack of flexibility. Packaged software is designed for a broad market, so it may not fully match the organization's unique processes, reporting needs, workflow, controls, or strategic requirements. Customization may be expensive, difficult to maintain, or unsupported after vendor upgrades.
Option B is not generally correct because many commercial packages are designed for client/server or cloud environments. Option C can occur with any new system, whether purchased or internally developed. Option D is not necessarily true because commercial software often includes vendor support, although support quality should be evaluated. Internal audit should assess fit-gap analysis, vendor risk, customization controls, and upgrade impact. Therefore, Option A is correct.

An unsecured loan is borrowing that is not backed by specific collateral. Commercial paper is a short-term unsecured promissory note issued by financially strong organizations to meet working capital or short-term financing needs. Investors rely primarily on the issuer's creditworthiness rather than pledged assets. A second mortgage is secured by real property, so Option A is not correct. Pledged accounts receivable involve assigning receivables as collateral, making Option C secured. Asset-based financing is explicitly secured by assets such as inventory, receivables, or equipment, so Option D is also incorrect. From an internal audit operations perspective, auditors should distinguish unsecured credit risk from collateralized borrowing when evaluating liquidity, debt covenants, and financing risk. Therefore, Option B is correct.

Comprehensive and Detailed In-Depth Explanation:
Jailbreaking a locked smart device (removing manufacturer-imposed restrictions) increases the risk of infringing on copyright and privacy laws, as it allows unauthorized access to software and applications.
Option A (Not installing anti-malware software) - Increases security risks but does not directly violate regulations.
Option B (Haphazard OS updates) - Can lead to vulnerabilities but is not a legal issue.
Option C (Weak passwords) - Poses a security threat but does not impact compliance with laws.
Since jailbreaking often violates software licenses and may lead to illegal use of software, Option D is the correct answer.
Reference: IIA IT Security & BYOD Compliance Standards

During an audit of IT change management, the internal auditor should validate whether only authorized personnel can migrate changes into production. This directly tests segregation of duties, authorization, and production environment protection. Option B may be relevant in a patch management review, but it is narrower and not the most direct change management audit action. Option C is a management activity, not an internal audit responsibility. Option D is also management's responsibility because internal audit should not update operating processes it may later audit. Effective change management requires proper request approval, testing, migration control, emergency change review, and post-implementation monitoring. Therefore, Option A is correct.

Reference: IIA Business Knowledge for Internal Auditing, Business Continuity Planning section.