Security awareness training is the most effective option listed for preventing phishing attacks from impacting business systems because phishing relies heavily on deceiving users. Employees must be able to recognize suspicious links, spoofed domains, unusual payment requests, fake login pages, malicious attachments, and social engineering indicators. Monitoring system usage may detect suspicious activity after exposure.
Malware detection is useful but may not prevent credential theft or fraudulent instructions if the user is deceived. Blocking user accounts is a response action, not a broad preventive control. Internal audit should evaluate whether phishing training is recurring, practical, tested through simulations, and supported by reporting channels. Since user behavior is central to phishing defense, Option A is correct.

If an organization has an immediate need for servers but lacks time for a capital acquisition, the best solution is Infrastructure as a Service (IaaS).
On-Demand Computing Power: IaaS provides virtual servers, storage, and networking resources on a pay-as- you-go basis, eliminating the need for capital purchases.
Scalability & Flexibility: The organization can quickly deploy the necessary infrastructure without long procurement processes.
Reduced IT Management Overhead: The cloud provider manages the hardware, while the organization manages the applications and data.
Option B (Platform as a Service - PaaS): PaaS offers a development environment for building applications, not infrastructure (e.g., servers and networking).
Option C (Enterprise as a Service - EaaS): EaaS is not a standard cloud service model recognized by NIST (National Institute of Standards and Technology) or ISO 17788.
Option D (Software as a Service - SaaS): SaaS provides software applications over the internet (e.g., Gmail, Microsoft 365) but does not address server needs.
IIA's Global Technology Audit Guide (GTAG) on Cloud Computing emphasizes IaaS as a viable solution for organizations requiring immediate infrastructure deployment.
NIST Special Publication 800-145 (Cloud Computing Definition) defines IaaS as a method to deliver computing resources efficiently without physical acquisition.
IIA Standard 2110 - IT Governance: Highlights the importance of agile IT solutions for meeting business needs, including cloud computing.
Why Option A is Correct (IaaS):Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is A. Infrastructure as a Service (IaaS).

Best practice and accounting standards require that receivables unlikely to be collected be written off to avoid overstating assets. Internal audit should recommend that management review the receivables and write off uncollectible debts accordingly.
Option A (escalation to the board) is premature; it should first be addressed with management. Option B (removing from cash flow statement) is not correct because write-offs affect the balance sheet and income statement, not just cash flows. Option D ignores a material risk of misstated financial statements.
Reference:
IIA Standards - Standard 2410: Criteria for Communicating; Accounting best practices for doubtful accounts.

A root cause-based recommendation addresses the underlying problem rather than symptoms. In this case, the real issue is the spider infestation, which attracts the birds, which in turn leads to droppings that require harsh cleaning. By enhancing cleaning and displacement of spiders, the organization eliminates the root cause and prevents recurrence.
Options A, B, and C treat symptoms but do not address the true root cause.
Reference:
IIA Practice Guide - Audit Findings: Condition, Criteria, Cause, Effect, and Recommendation.

Robust project cost control requires active monitoring, analysis, and explanation of variances. Researching both positive and negative variances shows that management is not merely checking whether costs are below budget, but is understanding why actual results differ from expectations. Favorable variances can indicate omitted work, timing delays, underuse of resources, or inaccurate estimates, while unfavorable variances may indicate overruns, scope creep, inefficiency, or poor planning. A compiled and approved budget is only a planning control. Costs being precisely within budget may be unusual and does not prove strong control.
Allocating cost estimates correctly supports planning but not ongoing control. Internal audit should assess cost baseline monitoring, variance analysis, escalation, and corrective action. Therefore, Option C is correct.