Authentication is the process of confirming that a user is who they claim to be. It normally involves identification, such as entering a user ID, and verification or validation through credentials such as passwords, tokens, biometrics, or certificates. Authorization is different. Authorization determines what an authenticated user is allowed to access or perform after identity has been confirmed. Confusing authentication with authorization is a basic access-control weakness. Internal audit should evaluate whether systems properly separate identity proofing, authentication, authorization, privilege management, and logging. Strong authentication alone is insufficient if authorization rules grant excessive access. Since authorization is not part of authentication itself, Option A is correct.

Comprehensive and Detailed In-Depth Explanation:
A Project Management Information System (PMIS) is a centralized tool used throughout a project's planning, execution, and monitoring phases. It helps track schedules, costs, and risks.
Option A (EVM) - Used primarily in monitoring and control phases, not all three.
Option B (Organizational procedures) - Provides guidance but is not actively used in all project phases.
Option C (Performance measurement) - Important in monitoring, but not central to planning or execution.
Since PMIS is used throughout the project lifecycle, Option D is correct.
Reference: IIA Project Management - Tools & Techniques

To effectively mitigate and manage risks during a crisis, organizations must implement a combination of preventive and reactive measures:
Preventive measures: These are proactive steps taken before a crisis to reduce the likelihood of occurrence (e.
g., risk assessments, internal controls, security protocols).
Reactive measures: These are actions taken after a crisis occurs to minimize damage, restore operations, and recover from the event (e.g., business continuity plans, incident response strategies).
(A) Incorrect - Only preventive measures.
While prevention is essential, not all crises can be avoided. Organizations also need response mechanisms.
(B) Incorrect - Alternative and reactive measures.
Alternative measures (e.g., backup systems) are part of risk management, but without prevention, risks may escalate.
(C) Incorrect - Preventive and alternative measures.
Alternative measures (e.g., backup resources) help maintain operations but do not directly address crisis response.
(D) Correct - Preventive and reactive measures.
Best practice in risk management includes both preventing crises and responding effectively when they occur.
IIA's Global Internal Audit Standards - Crisis Management and Business Resilience Emphasizes the need for both prevention and response strategies.
COSO's ERM Framework - Risk Management in Crisis Situations
Recommends a combination of risk avoidance, mitigation, and crisis response.
ISO 22301 - Business Continuity Management
Highlights the importance of preventive controls and reactive response planning.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

Understanding the Cash Conversion Cycle (CCC):
The Cash Conversion Cycle (CCC) measures the time taken for a company to convert raw materials into cash flow.
CCC is calculated using the formula: CCC=DaysInventoryOutstanding(DIO)+DaysSalesOutstanding(DSO)
#DaysPayableOutstanding(DPO)CCC = Days Inventory Outstanding (DIO) + Days Sales Outstanding (DSO)
- Days Payable Outstanding (DPO)CCC=DaysInventoryOutstanding(DIO)+DaysSalesOutstanding(DSO)
#DaysPayableOutstanding(DPO)
Where:
DIO (Days Inventory Outstanding) = 55 days (time to convert raw materials to finished products).
DSO (Days Sales Outstanding) = 42 days (time to collect receivables).
DPO (Days Payable Outstanding) = 10 days (time to pay for raw materials).
Applying the Formula:
CCC=55+42#10CCC = 55 + 42 - 10CCC=55+42#10 CCC=100 daysCCC = 100 \text{ days}CCC=100 days Why Option C (100 Days) Is Correct?
The CCC represents the time the company's cash is tied up in production and sales before receiving payment.
This calculation aligns with IIA Standard 2120 - Risk Management, which requires auditors to assess financial liquidity and operational efficiency.
Why Other Options Are Incorrect?
Option A (26 days): Incorrect calculation.
Option B (90 days): Does not subtract DPO correctly.
Option D (110 days): Incorrect addition of all components instead of following the CCC formula.
The correct cash conversion cycle is 100 days, calculated using standard CCC methodology.
IIA Standard 2120 and financial management principles confirm the correct calculation.
Final Justification:IIA References:
IPPF Standard 2120 - Risk Management (Financial Performance & Liquidity Risk) COSO ERM - Working Capital & Cash Flow Management Financial Management Best Practices - Cash Conversion Cycle Analysis

According to IIA guidance, if a nonconformance occurs, the CAE must evaluate its impact on the overall scope and operations of the internal audit activity. If the deficiency materially affects internal audit's overall ability to fulfill its responsibilities, conformance cannot be claimed. If the impact is limited, conformance may still be declared with appropriate disclosure.
Options A and B assume automatic conformance without evaluation. Option C is incorrect because there is no concept of "partial conformance" under the Standards.
Reference:
IIA Standards - Standard 1321: Use of "Conforms with the Standards."