A systems development methodology refers to a structured approach used in software development and systems engineering to guide the design, development, and implementation of software applications.
Why Option A (Waterfall) is Correct:
Waterfall methodology is a linear and sequential systems development methodology where each phase (e.g., requirements, design, implementation, testing, deployment) must be completed before moving to the next.
It is widely established and historically one of the first software development methodologies.
Used in large-scale enterprise projects where detailed planning and structured execution are required.
Why Other Options Are Incorrect:
Option B (PRINCE2 - Projects in Controlled Environments):
Incorrect because PRINCE2 is a project management framework, not a systems development methodology.
Option C (ITIL - Information Technology Infrastructure Library):
Incorrect because ITIL is a set of IT service management (ITSM) best practices, not a software development methodology.
Option D (COBIT - Control Objectives for Information and Related Technologies):
Incorrect because COBIT is a governance framework for IT management and controls, not a development methodology.
IIA GTAG - " Auditing IT Projects and Systems Development " : Highlights Waterfall as a traditional systems development methodology.
IIA's Global Technology Audit Guide on IT Risks: Discusses software development lifecycle risks, including Waterfall methodology.
COBIT Framework - BAI03 (Manage Solutions Identification and Build): References structured methodologies like Waterfall in IT governance.
IIA References:

Client/server environments often distribute application components across multiple servers, workstations, or network locations. A key change control requirement is ensuring that program versions are synchronized across the network so incompatible versions do not operate simultaneously. Version mismatch can cause processing errors, data corruption, security weaknesses, or failed interfaces. Emergency move procedures, user testing, and controlled migration from test to production are important in both client/server and mainframe environments. They are not unique to client/server architecture. Internal auditors reviewing change management should verify version control, release management, configuration baselines, rollback procedures, and documentation of distributed components. Because synchronization across multiple networked locations is the distinctive client/server concern, Option A is the correct answer.

Textual analysis is the best description because the auditor is reviewing bidding requirements across tender documents and identifying wording or specifications that appear to favor one supplier. Tender requirements are largely text-based, and unusual language, restrictive specifications, repeated phrases, or biased technical descriptions may indicate bid tailoring or bid-rigging risk. Diagnostic analysis explains why an event occurred, but the technique described is focused on analyzing written tender content. Predictive analysis forecasts future outcomes, and network analysis examines relationships between entities or nodes. Internal auditors may use textual analysis in procurement audits to detect suspicious specifications, duplicated wording, vendor-favored criteria, and manipulation of bid requirements. Therefore, Option C is correct.

A strong internationally recognized brand creates customer loyalty, trust, reputation, and perceived quality.
New competitors must spend heavily on advertising, promotion, distribution support, customer education, and brand-building to overcome that loyalty. Therefore, the entrance barrier is increased marketing cost. A new competitor does not necessarily have to initiate a price war, although price competition may occur. Production costs are not automatically higher simply because an incumbent has a strong brand. Learning costs may exist in some industries, but they are not the primary barrier created by brand recognition. Internal auditors reviewing strategic risk should consider brand strength because it affects market entry risk, customer retention, intangible asset value, and competitive positioning. Therefore, Option C is correct.

Internal audit has a mandatory assurance responsibility to assess whether IT governance supports the organization's strategies and objectives. IT governance remains the responsibility of the board and senior management, but internal audit must evaluate and provide assurance over its effectiveness. Therefore, Statement 1 is incorrect. Statement 2 is correct because it reflects internal audit's required role. Statement 3 is too weak because the responsibility is not merely optional. Statement 4 is also correct because internal audit may perform advisory services related to IT governance, provided independence and objectivity are protected and management retains decision-making responsibility. Internal audit should evaluate IT strategy alignment, value delivery, risk management, resource management, and performance measurement. Therefore, the accurate combination is 2 and 4, making Option C correct.