The Define, Measure, Analyze, Improve, and Control (DMAIC) methodology is the core framework of Six Sigma, a data-driven process improvement approach that aims to reduce defects, enhance efficiency, and optimize performance.
(A) Correct - Six Sigma.
DMAIC is a structured Six Sigma methodology used for problem-solving and process improvement.
It helps organizations identify inefficiencies, eliminate errors, and standardize processes.
(B) Incorrect - Quality circle.
A quality circle is a group of employees who meet to discuss and resolve work-related issues, but it does not follow the structured DMAIC approach.
(C) Incorrect - Value chain analysis.
Value chain analysis focuses on evaluating business activities to improve competitive advantage, not structured process improvement like Six Sigma.
(D) Incorrect - Theory of constraints.
The Theory of Constraints (TOC) focuses on identifying and eliminating bottlenecks in processes, but it does not use the DMAIC approach.
IIA's Global Internal Audit Standards - Process Improvement and Risk Management Emphasizes methodologies like Six Sigma for operational efficiency.
COSO's ERM Framework - Continuous Improvement and Quality Management
Discusses the role of Six Sigma in improving processes and reducing risks.
IIA's Guide on Business Process Auditing
Recommends structured approaches such as Six Sigma for evaluating process efficiency.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

When the CAE disagrees with local management's acceptance of a risk, the next step is to escalate the issue to higher management responsible for the risk-in this case, the bank's chief security officer. If senior management also accepts the risk and the CAE still considers it unacceptable, the matter should then be reported to the board.
Option A (direct to the board) skips the escalation chain. Option B is ineffective if the security manager has already decided. Option C alone does not address the CAE's responsibility to escalate unacceptable risks.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.

A root cause-based recommendation addresses the underlying problem rather than symptoms. In this case, the real issue is the spider infestation, which attracts the birds, which in turn leads to droppings that require harsh cleaning. By enhancing cleaning and displacement of spiders, the organization eliminates the root cause and prevents recurrence.
Options A, B, and C treat symptoms but do not address the true root cause.
Reference:
IIA Practice Guide - Audit Findings: Condition, Criteria, Cause, Effect, and Recommendation.

Access control is about ensuring that only authorized individuals can access specific data, based on their role and necessity. The Principle of Least Privilege (PoLP) dictates that users should only have access to the data they need for their job.
Minimizes Unauthorized Access Risks - Prevents employees from accessing sensitive data unnecessarily.
Supports Segregation of Duties (SoD) - Critical in preventing fraud and security breaches.
Enhances Compliance - Meets regulatory requirements like GDPR, PCI-DSS, and SOX, which demand strict access controls.
Strengthens System Security - Reduces potential damage from malware, insider threats, or data breaches.
A). Install and update anti-virus software - Important for cybersecurity but does not directly control user access.
B). Implement data encryption techniques - Protects stored or transmitted data but does not define access rights.
D). Upgrade firewall configuration - Controls network traffic, not user-specific access within an automated system.
IIA's GTAG on Access Management and Controls - Recommends setting data access based on user needs to prevent fraud and misuse.
COBIT 2019 (Governance and Management of Enterprise IT) - Advocates for role-based access controls.
ISO 27001 Annex A.9 (Access Control) - Stresses the importance of restricting access based on business requirements.
Why Setting Data Availability by User Need is the Best Strategy?Why Not the Other Options?IIA References:
# Final Answer: C. Set data availability by user need.

Reference: IIA Business Knowledge for Internal Auditing, Decentralization Advantages section.