The most effective mitigation is to embed ongoing controls within vendor management processes to ensure that both new and existing vendors are continuously screened against updated sanctions lists. This creates a sustainable and automated compliance mechanism.
Option A is reactive and does not address future compliance. Option B only addresses onboarding of new vendors but ignores existing ones. Option D undermines compliance obligations and does not mitigate risk.
Reference:
IIA Global Technology Audit Guide (GTAG): Auditing Third-Party Risk; IIA Standards - Standard 2130:
Control.

Both hierarchical and open organizational structures require responsibility to be supported by adequate authority. Assigning responsibility without authority creates accountability failure and control weakness. Both structures also recognize that a superior may delegate tasks or authority but cannot delegate ultimate responsibility for results. Statement 1 is more characteristic of open or decentralized structures, not all hierarchical structures. Statement 2 is an outdated and rigid span-of-control rule; appropriate span depends on complexity, employee competence, technology, geography, and control needs. Internal audit should evaluate whether organizational design supports clear accountability, authority, escalation, segregation of duties, and effective oversight. The principles common to both structures are statements 3 and 4. Therefore, Option D is correct.

Comprehensive and Detailed In-Depth Explanation:
The Internal Rate of Return (IRR) is the discount rate that makes the net present value (NPV) of a project equal to zero. It is used to evaluate the profitability of investments.
Option A (Annual cost of capital) - While related, the IRR should be compared directly to the required rate of return (hurdle rate).
Option B (Annual interest rate) - Not always relevant, as the cost of borrowing may differ from the required return on investments.
Option D (Compare to NPV) - NPV is a different method of capital budgeting; while related, it is not used for direct comparison with IRR.
Since the IRR is accepted if it meets or exceeds the required rate of return, Option C is correct.
Reference: IIA Financial Management - Capital Budgeting Techniques

Social engineering is a psychological manipulation technique used by attackers to trick individuals into divulging sensitive information. Instead of exploiting technical vulnerabilities, it targets human weaknesses such as trust, fear, or urgency.
Manipulates Human Behavior - The attacker impersonates a trusted entity (a bank representative) to deceive the employee.
Leads to Unauthorized Information Disclosure - The employee unknowingly provides sensitive financial data.
Results in Fraud - The stolen information is misused, causing financial loss.
A). Shoulder Surfing - This occurs when an attacker physically observes someone entering sensitive data (e.g., watching a person type a password).
B). Pharming - This involves redirecting users to a fraudulent website to steal their credentials, not direct impersonation.
C). Phishing - This is a broad category of social engineering that typically involves emails or fake websites, whereas this scenario describes a direct impersonation attack.
IIA's GTAG on Cybersecurity - Discusses social engineering as a key risk for organizations.
NIST SP 800-61 (Incident Handling Guide) - Identifies social engineering as a common attack vector.
COBIT 2019 (IT Governance Framework) - Highlights human-related cybersecurity risks.
Why Social Engineering is the Correct Answer?Why Not the Other Options?IIA References:

An assurance map provides an overview of assurance activities across the organization and helps identify gaps (uncovered risks) and duplications (overlap of work). This enhances coordination among assurance providers and supports the board's governance oversight.
Option B is incorrect because the board does not coordinate activities; internal audit facilitates assurance mapping. Option C misinterprets the tool-it does not assign specific audits. Option D refers to staff competencies, not assurance coverage.
Reference:
IIA Practice Guide - Coordination and Reliance: Developing an Assurance Map.