Reference: IIA Business Knowledge for Internal Auditing, Organizational Structure Risks section.

Biometric authentication is the strongest control listed for preventing unauthorized access to data on a stolen mobile device. It relies on a physical characteristic of the authorized user, such as fingerprint, face, or retina recognition, making it harder for a thief to bypass than a passcode, swipe pattern, or security question.
Passcodes and swipe patterns can be guessed, observed, shared, or captured. Security questions are often weak because answers may be discoverable or predictable. Internal audit should also expect supporting controls such as encryption, remote wipe, mobile device management, automatic lockout, and incident reporting. However, among the options provided, biometric authentication provides the strongest access prevention control. Therefore, Option A is correct.

Veracity refers to the reliability, accuracy, trustworthiness, and quality of big data. Big data may be large, fast- moving, and varied, but it is not useful unless the organization can trust its accuracy and consistency. Variety refers to different forms and sources of data, such as structured, semi-structured, and unstructured data. Value refers to the usefulness or business benefit derived from data. Validity is a general data quality concept but is not one of the most common "V" dimensions used to describe big data in this context. Internal auditors should consider veracity when relying on analytics, because poor-quality data can lead to incorrect conclusions, false exceptions, and weak assurance. Therefore, Option A is correct.

The CAE is ultimately accountable for all final engagement communications, even if dissemination is delegated to others. The Standards hold the CAE responsible for ensuring that reports are accurate, objective, clear, concise, constructive, complete, and timely.
Options A and D (supervisor or team) may assist but do not hold accountability. Option C (the board) receives reports but is not responsible for them.
Reference:
IIA Standards - Standard 2400: Communicating Results.

Before an external assessment of the internal audit activity, the CAE should agree with the board on the qualifications and independence of the external assessor or assessment team. This ensures credibility and compliance with the IIA's Quality Assurance and Improvement Program (QAIP) requirements.
Options A and B (specific audit areas or testing levels) are not matters for board approval in external assessments. Option D (specialized skills) is relevant but not as essential as overall qualifications and competence.
Reference:
IIA Standards - Standard 1312: External Assessments; Practice Advisory 1312-1.