When an organization allows managers to use their own smartphones at work under a Bring Your Own Device (BYOD) policy, IT security and risk management become critical. The most important policy and procedure to include would be documenting the process for discontinuing use of the devices to ensure data security, compliance, and risk mitigation when employees leave the company or change roles.
Data Security & Compliance: Ensuring that sensitive company data is removed securely when an employee leaves or replaces a device is crucial to prevent unauthorized access.
Access Control & Endpoint Management: The IT department needs a clear policy to revoke access to corporate applications and networks when a device is no longer in use.
Risk Mitigation: Unauthorized access to company systems through lost, stolen, or retired devices can lead to security breaches.
Option B (Required removal of personal pictures and contacts): Personal data does not impact company security and is irrelevant to corporate IT policies.
Option C (Required documentation of expiration of contract with service provider): This is the employee ' s responsibility, not the organization ' s, and does not address security risks.
Option D (Required sign-off on conflict of interest statement): While conflict of interest policies are important, they are unrelated to IT security concerns related to BYOD.
IIA's GTAG (Global Technology Audit Guide) on Managing and Auditing IT Vulnerabilities emphasizes the importance of BYOD risk management, including clear procedures for device decommissioning.
IIA ' s Business Knowledge for Internal Auditing (CIA Exam Syllabus - Part 3) highlights IT governance frameworks that require policies for data access and security when using personal devices.
Why Option A is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is A. Required documentation of process for discontinuing use of the devices.

A flat organizational structure is characterized by fewer hierarchical levels and wider spans of control, meaning that managers oversee a larger number of employees directly.
Definition of a Flat Structure:
A flat structure reduces middle management layers, promoting direct communication between top executives and employees.
According to IIA's Organizational Governance Guidelines, organizations with a flat structure empower employees and reduce bureaucratic delays.
Key Characteristics of a Flat Structure:
Wide Span of Control: Managers oversee more employees due to fewer hierarchical levels.
Faster Decision-Making: Less bureaucracy allows for quicker responses.
Greater Employee Autonomy: Employees have more decision-making responsibilities.
Why Not Other Options?
A). The structure is dispersed geographically:
A geographically dispersed organization is not necessarily flat; it could be hierarchical or matrix-based.
B). The hierarchy levels are more numerous:
Flat structures have fewer levels, while tall structures have numerous levels.
D). The lower-level managers are encouraged to exercise creativity when solving problems:
While creativity may be encouraged, this is not a defining feature of a flat structure.
IIA Practice Guide: Organizational Governance
IIA Standard 2110 - Governance
Step-by-Step Justification:IIA References:Thus, the correct and verified answer is C. The span of control is wide.

A centralized organizational structure concentrates decision-making authority at the top levels of management. While this ensures control and consistency, it can lead to slower decision-making due to the need for approvals from higher levels.
Let's analyze each option:
Option A: Communication conflicts.
Incorrect.
Centralized structures generally have clear lines of authority and communication, reducing conflicts.
Communication conflicts are more common in decentralized structures where multiple decision-makers exist.
Option B: Slower decision making.
Correct.
Since all decisions must pass through top management, it delays responses to market changes and reduces flexibility.
Lower-level employees have less authority to make operational decisions, leading to bottlenecks.
IIA Reference: Internal auditors assess organizational governance, including decision-making efficiency in centralized vs. decentralized structures. (IIA Practice Guide: Organizational Governance) Option C: Loss of economies of scale.
Incorrect.
Centralization improves economies of scale by standardizing processes and consolidating resources.
Decentralization (not centralization) is more likely to lead to duplication of efforts and a loss of economies of scale.
Option D: Vulnerabilities in sharing knowledge.
Incorrect.
Centralized organizations tend to have structured knowledge-sharing frameworks, such as standardized policies and corporate training programs.

Intellectual property rights are the most effective contractual provision to protect a technology developer's product knowledge, software design, source code, algorithms, documentation, methods, and expertise. A right- to-audit clause helps verify compliance with contract terms but does not itself define ownership or protection of proprietary work. A performance measurement system evaluates service quality, timeliness, or deliverables. Defined roles and responsibilities clarify accountability, but they do not protect ownership of product knowledge. Internal auditors reviewing technology contracts should verify that intellectual property, confidentiality, licensing, source-code ownership, derivative works, data rights, and post-termination restrictions are clearly addressed. Without strong IP provisions, the developer may lose control over valuable knowledge embedded in the software development process. Therefore, Option D is correct.

Understanding the Call Center Performance Issue:
The key performance indicators (KPIs) show a positive trend, meaning the call center appears to be performing well.
However, customer complaints are increasing, indicating that the KPIs are not accurately reflecting service quality.
This suggests that employees may be prioritizing call quantity over call quality, likely due to pressure to meet call quotas.
Why De-Emphasizing Call Quotas is the Best Solution:
Encourages Quality Over Speed: Reducing the emphasis on call volume allows agents to spend more time resolving customer issues effectively.
Improves Customer Satisfaction: Agents can provide more thorough assistance, reducing repeat calls and complaints.
Aligns KPIs with Service Quality: Shifting focus from quantity-based KPIs to quality-based KPIs ensures performance measurements reflect actual customer experience.
Why Other Options Are Incorrect:
A). Review the call center script used by customer service agents to interact with callers, and update the script if necessary - Incorrect.
While updating scripts may help, it does not address the root issue of employees rushing through calls to meet quotas.
C). Retrain call center staff on area processes and common technical issues that they will likely be asked to resolve - Incorrect.
Training is useful, but if agents are pressured to complete calls quickly, training alone will not resolve the issue.
D). Increase the incentive for call center employees to complete calls quickly and raise the number of calls completed daily - Incorrect.
This would worsen the issue by further incentivizing speed over customer satisfaction, leading to more complaints.
IIA's Perspective on Performance Metrics and Customer Service Quality:
IIA Standard 2120 - Risk Management requires organizations to ensure that performance metrics align with actual business objectives.
IIA GTAG (Global Technology Audit Guide) on Performance Measurement recommends balancing quantitative KPIs (e.g., call volume) with qualitative KPIs (e.g., customer satisfaction scores).
COSO Internal Control Framework supports adjusting performance incentives to ensure alignment with business objectives.
IIA References:
IIA Standard 2120 - Risk Management & KPI Alignment
IIA GTAG - Performance Metrics in Customer Service
COSO Internal Control Framework - Effective KPI Design
Thus, the correct and verified answer is B. De-emphasize the importance of call center employees completing a certain number of calls per hour.