The norming stage is characterized by reduced conflict, increased cohesion, clearer expectations, and acceptance of team roles. After the storming stage, where disagreement and competition may occur, team members begin to establish norms, trust, cooperation, and shared ways of working. The forming stage is the initial orientation stage, where members are polite but uncertain about roles and objectives. The performing stage comes later, when the group operates effectively and focuses on achieving goals. The storming stage is associated with conflict, not reduced hostility. Internal audit leaders should understand group development because engagement teams, project teams, and quality improvement teams perform better when roles, communication norms, and accountability are clear. Therefore, Option B is correct.

Understanding the Contracting Process PhasesThe contracting process generally follows these phases:
Initiation Phase: Identifies the need for a contract and sets initial objectives.
Bidding Phase: Potential vendors or partners submit proposals, and negotiations begin.
Development Phase: Contracts are drafted, negotiated, and finalized before execution.
Management Phase: The contract is executed, monitored, and evaluated for compliance.
Why Option C is Correct?
The development phase is where contracts are formally drafted based on agreements made during bidding and negotiation.
This phase includes legal review, compliance verification, and risk assessment, ensuring the contract aligns with business objectives and legal requirements.
IIA Standard 2110 - Governance requires auditors to assess how contract risks are managed, ensuring formal contract development processes.
Why Other Options Are Incorrect?
Option A (Initiation phase):
This phase defines the business need but does not involve drafting contracts.
Option B (Bidding phase):
In this phase, businesses solicit proposals, but contracts are not fully drafted until vendor selection.
Option D (Management phase):
The management phase involves executing and monitoring the contract, not drafting it.
Contracts are drafted during the development phase after vendor selection and before execution.
IIA Standard 2110 supports governance over contract risk and formal agreement processes.
Final Justification:IIA References:
IPPF Standard 2110 - Governance (Contract Risk & Compliance)
COSO ERM - Risk Management in Contracting

Comprehensive and Detailed In-Depth Explanation:
Encryption is a security measure that protects the confidentiality of sensitive data by converting it into an unreadable format. This directly addresses privacy risks by preventing unauthorized access to personal or confidential information.
Option A (Information integrity risk) - Integrity controls (e.g., checksums, hash functions) address this risk.
Option C (Access risk) - Managed through authentication and access controls, not encryption.
Option D (Software risk) - Related to vulnerabilities, which encryption does not directly mitigate.
Since encryption protects privacy by securing sensitive data, Option B is correct.
Reference: IIA IT Security - Data Privacy & Encryption Standards

A zero-based budget starts from a zero base and requires each expenditure to be justified for the new budget period. It does not assume that prior-year spending should continue automatically. Managers must identify activities, justify resource needs, evaluate alternatives, and rank priorities. Option A describes flexible budgeting, where costs are estimated at different activity levels. Option B is too vague and does not identify the defining feature. Option D may describe participative budgeting, not necessarily zero-based budgeting.
Internal audit may review budgeting controls to determine whether spending requests are supported, aligned with objectives, and challenged appropriately. Zero-based budgeting can improve cost discipline but may require significant time and analysis. Therefore, Option C is correct.

Strategic fit exists when organizational activities reinforce and complement each other in a way that creates competitive advantage. For example, procurement, production, distribution, customer service, technology, and marketing may be designed to support the same strategic position. This alignment makes the organization harder to imitate and improves performance consistency. A merger is a legal or business combination between entities. A joint venture is a shared business arrangement between two or more parties. A strategic goal is an objective the organization seeks to achieve, but it is not the interaction among activities. Internal audit can assess whether processes, controls, incentives, and resources support strategic fit or create conflicting priorities. Therefore, Option B is correct.