Comprehensive and Detailed In-Depth Explanation:
Authentication methods are categorized into three factors:
Something you know (e.g., passwords, PINs).
Something you have (e.g., ID cards, key fobs, smart cards).
Something you are (e.g., biometrics like fingerprints, retina scans).
Option C (A card-key scanner) aligns with "something you have", as it requires a physical token (card) for authentication.
Option A (Retina scan) and Option D (Fingerprint scanner) fall under biometric authentication ("something you are").
Option B (PIN code reader) is based on "something you know".
Thus, C is the correct answer because a card-key represents a physical access control mechanism based on possession.
Reference: IIA IT Security & Authentication Controls

Preventive controls are generally stronger than detective controls because they stop errors, fraud, or noncompliance before they occur. Systems-based controls are also usually more reliable than people-based controls because automated controls operate consistently, are less subject to fatigue or judgment errors, and can be embedded directly into business processes. A systems-based preventive control is therefore typically the strongest form. A people-based detective control is the weakest because it depends on individuals noticing an issue after it has already occurred and then responding appropriately. Such controls are vulnerable to oversight, workload pressure, poor training, bias, or intentional override. From an internal audit perspective, people-based detective controls may still be useful, but they provide weaker risk management assurance than automated or preventive controls. Therefore, Option D is correct.

An IT steering committee provides governance oversight over IT strategy, priorities, resources, major initiatives, technology direction, and alignment with business objectives. It is appropriate for the committee to monitor the adequacy of software and hardware, assess the effects of new technology, and provide broad oversight of implementation, training, and operation of new systems. However, assessing the technical adequacy of detailed standards for systems design and programming is usually a technical management or IT architecture responsibility, not a broad steering committee function. Internal audit should evaluate whether the IT steering committee has a clear charter, appropriate membership, documented decisions, risk oversight, project prioritization, and alignment with organizational strategy. The appropriate functions are 2, 3, and 4, making Option D correct.

Matrix management uses dual reporting relationships, often combining functional and project, product, or geographic lines. Its main purpose is to increase lateral communication, coordination, and resource sharing across organizational boundaries. It is useful when work requires cross-functional expertise and rapid information flow. Option A is incorrect because matrix structures usually complicate the chain of command rather than simplify it. Option B is not the primary objective; matrix structures may actually distribute authority across functions and projects. Option C is too narrow because focusing on a single market is more consistent with product, customer, or geographic structures. Internal auditors should recognize that matrix structures can improve collaboration but may also create accountability ambiguity, conflict, and control ownership issues. Therefore, Option D is correct.

In an assurance engagement involving smart devices, the first step is to obtain a comprehensive inventory of all devices in use. This ensures that the audit covers all relevant assets and allows the internal auditor to assess risks, controls, and policies effectively.
(A) Incorrect - Train all employees on bring-your-own-device (BYOD) policies.
While employee training is important, it is a control measure rather than the first step in an assurance engagement.
Without an inventory of devices, training effectiveness cannot be assessed.
(B) Incorrect - Understand what procedures are in place for locking lost devices.
This is a specific control measure but not the starting point for an engagement.
The first step should be to identify what devices exist before evaluating security measures.
(C) Correct - Obtain a list of all smart devices in use.
The foundation of an assurance engagement is identifying the scope, which includes listing all smart devices in use.
This allows the auditor to evaluate security risks, compliance, and control measures effectively.
(D) Incorrect - Test encryption of all smart devices.
Testing encryption is an audit procedure that should be performed after understanding the inventory and existing controls.
Without knowing which devices exist, encryption testing would not be effective.
IIA's Global Internal Audit Standards - Technology Assurance and Cybersecurity Audits Outlines steps for conducting technology-related assurance engagements.
IIA's GTAG (Global Technology Audit Guide) on Auditing Smart Devices
Recommends obtaining an inventory of devices as the first step in an audit.
COBIT Framework - IT Asset Management and Control
Emphasizes identifying assets as the foundation of IT governance and risk management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards: