Preventive security controls proactively stop unauthorized access before it occurs. The most effective method is strict access management, where new or additional access rights require formal validation before being granted.
* Prevents Unauthorized Entry - Ensures that only approved personnel have access to the power plant.
* Implements Segregation of Duties (SoD) - Supervisors validate access requests, reducing insider threats.
* Aligns with Least Privilege Principle - Employees get only the minimum access necessary for their role.
* Prevents Security Risks Before They Happen - Unlike detective or corrective controls, this method stops unauthorized access before it occurs.
* A. Offboarding procedure (monthly review) - This is a detective control, identifying issues after access is granted, not preventing them.
* B. Smart lock anomaly scanning - Also detective, as it identifies suspicious behavior after access has been used.
* D. Automatic notifications for after-hours entry - A corrective control, responding to potential violations instead of preventing them.
* IIA's GTAG on Identity and Access Management - Recommends pre-approval processes for sensitive locations.
* ISO 27001 Annex A.9 (Access Control) - Requires role-based access management for critical infrastructures.
* NIST SP 800-53 (Security and Privacy Controls for Federal Information Systems) - Defines supervisor approval as a key preventive measure.
Why Approval-Based Access Control is the Best Preventive Measure?Why Not the Other Options?IIA References:

Fingerprint identification has the lowest risk of inaccurate authentication among the listed options because it uses a biometric characteristic that is difficult to guess, share, or replicate compared with knowledge-based methods. Complex passwords can still be stolen, phished, reused, or written down. Signature verification can be subjective and vulnerable to forgery or poor capture quality. Personal security questions are often weak because answers may be discoverable through social media, public records, or personal knowledge. Biometric controls are not perfect and require proper enrollment, template protection, false acceptance monitoring, and privacy safeguards. However, in comparison with the other options, fingerprint identification provides stronger identity assurance. Therefore, Option A is correct.

Reference: IIA Business Knowledge for Internal Auditing, Inventory Valuation section.

Reference: IIA Business Knowledge for Internal Auditing, Logical Access Controls section.

Market price is the most appropriate transfer price when there is a competitive external market for the service.
An external market provides an objective benchmark for what independent parties would pay or charge. This improves fairness, supports performance evaluation, and reduces internal disputes between responsibility centers. If no external market exists, the organization may need to use cost-based, negotiated, or administrative transfer pricing. Option B may affect whether internal transfer is economically beneficial, but it does not make market price the best benchmark by itself. Option C is irrelevant because transfer pricing should not be determined merely by bargaining power. Option D is the opposite of the condition needed for reliable market pricing. Internal auditors should assess whether transfer prices support goal congruence and accurate performance measurement. Therefore, Option A is correct.