The CAE must first gather data on risk appetite and discuss the matter with senior management. If unresolved, the CAE then escalates to the board (Option C). Only if the board accepts the risk and the CAE believes the exposure remains unacceptable should the final step involve informing regulators (Option D) when required by law or regulation.
Thus, the correct answer for the last step is consulting with regulators (Option D).
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.

Senior management is responsible for establishing direction and expectations for implementing the Three Lines model. Setting implementation goals helps define how risk ownership, risk oversight, and independent assurance will operate. The first line owns and manages risk, the second line provides oversight and specialist risk support, and the third line provides independent assurance. Ensuring compliance, identifying management functions, and identifying emerging issues may be part of broader governance or risk activities, but setting goals for implementation is the senior management responsibility most directly connected to introducing the model. Internal audit should later evaluate whether roles are clear, reporting lines are effective, and assurance coverage is coordinated. Therefore, Option D is correct.

A firewall is a security control mechanism designed to prevent unauthorized access to or from a private network. It monitors and filters incoming and outgoing network traffic based on predefined security rules.
Definition of Control Types:
Preventive Control: Stops an undesirable event from occurring.
Detective Control: Identifies and records events after they have happened.
Corrective Control: Takes action to correct an issue after it has been detected.
Discretionary Control: Provides access control based on user discretion.
Why a Firewall is a Preventive Control:
Firewalls block unauthorized access to protect networks before a security breach can occur.
They enforce security policies in real-time, preventing cyber threats such as malware, intrusions, and unauthorized data access.
As per IIA GTAG (Global Technology Audit Guide) on Information Security, firewalls are categorized as preventive controls because they proactively mitigate threats before they materialize.
Why Not Other Options?
A). Corrective: Firewalls do not correct security breaches; they prevent them.
B). Detective: Firewalls do not just detect threats but actively block them.
D). Discretionary: Firewalls operate based on preset security rules rather than user discretion.
IIA GTAG - Information Security
IIA Standard 2110 - IT Governance & Risk Management
Step-by-Step Justification:IIA References:Thus, the correct and verified answer is C. Preventive.

A data classification policy helps organizations identify data sensitivity levels, such as public, internal, confidential, restricted, or personal data. This supports compliance with data protection regulations because different classes of data require different controls over access, storage, transmission, retention, disclosure, and disposal. Classification does not directly confirm whether a particular record is valid, complete, or free from duplication. Those objectives are handled through input controls, reconciliation, validation routines, and data quality procedures. Internal auditors should assess whether classification rules are clear, applied consistently, linked to access controls, and aligned with legal and regulatory requirements. Strong classification also supports encryption, privacy impact assessment, breach response, and third-party data handling. Therefore, Option D is correct.

When multiple organizations co-own shopping malls, their primary strategy is to increase market synergy, meaning they combine resources and expertise to enhance market presence, attract more customers, and improve competitive positioning.
* (A) To exploit core competence.
* Incorrect: Core competencies refer to unique internal capabilities, whereas co-owning shopping malls is a collaborative market strategy.
* (B) To increase market synergy. (Correct Answer)
* Market synergy occurs when businesses collaborate to create greater market impact than they could individually.
* Shared ownership enhances customer traffic, brand reach, and business opportunities.
* IIA Standard 2110 - Governance highlights the importance of strategic partnerships in achieving synergy.
* (C) To deliver enhanced value.
* Incorrect: While value is a benefit, the main goal of co-ownership is strategic market advantage and synergy.
* (D) To reduce costs.
* Incorrect: Cost reduction may be a secondary benefit, but the primary goal is market synergy through shared resources and customer base expansion.
* IIA Standard 2110 - Governance: Encourages strategic collaborations for business growth.
* COSO ERM - Strategy and Objective-Setting: Highlights market synergy as a key factor in strategic partnerships.
Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because co- ownership of shopping malls primarily aims to increase market synergy, allowing organizations to leverage shared resources and customer networks for greater market impact.