Project governance refers to a broad collection of integrated policies, standards, and procedures that provide a framework for planning and executing projects. It establishes decision-making processes, accountability, and risk management controls to ensure that projects align with organizational objectives.
(A) Project portfolio. #
Incorrect. A project portfolio refers to a collection of projects managed together to achieve strategic objectives. It does not specifically define the policies, standards, and procedures for project execution.
(B) Project development. #
Incorrect. Project development focuses on designing, building, and testing a project, but it does not encompass governance structures like policies, standards, and oversight.
(C) Project governance. #
Correct. Project governance includes integrated policies, standards, and procedures that guide project planning, execution, and oversight.
IIA GTAG "Auditing IT Projects" emphasizes project governance as the primary control framework for managing project risks and ensuring alignment with organizational goals.
(D) Project management methodologies. #
Incorrect. Project management methodologies (e.g., Agile, Waterfall, PRINCE2) provide structured approaches for executing projects but do not encompass the full governance framework.
IIA GTAG - "Auditing IT Projects"
IIA Standard 2110 - Governance (Project Risk Management)
COSO ERM Framework - Project Oversight and Risk Governance
Analysis of Answer Choices:IIA References:Thus, the correct answer is C (Project governance), as it provides the integrated policies, standards, and procedures needed for effective project oversight.

Understanding the Margin of Safety Concept:
Margin of Safety (MoS) measures how much sales can drop before the business reaches its break-even point.
It is calculated as: Margin of Safety Sales=Actual Sales#Break-even Sales\text{Margin of Safety Sales} = \text
{Actual Sales} - \text{Break-even Sales}Margin of Safety Sales=Actual Sales#Break-even Sales Applying the Formula:
Selling Price per Shirt: $8
Break-even Sales Volume: 25,000 shirts
Break-even Sales Value: 25,000×8=200,00025,000 \times 8 = 200,00025,000×8=200,000 Actual Sales Revenue: $300,000 Margin of Safety: 300,000#100,000=200,000300,000 - 100,000 = 200,000300,000#100,000=200,000 Why Option B ($200,000) Is Correct?
The margin of safety is the difference between actual and break-even sales.
The correct calculation confirms $200,000 as the margin of safety.
IIA Standard 2120 - Risk Management supports financial risk analysis, including break-even and margin of safety evaluations.
Why Other Options Are Incorrect?
Option A ($100,000): Incorrect subtraction.
Option C ($275,000): Incorrect calculation, not based on break-even sales.
Option D ($500,000): Irrelevant and exceeds actual sales.
The correct margin of safety is $200,000, calculated using standard break-even analysis.
IIA Standard 2120 emphasizes financial risk evaluation in decision-making.
Final Justification:IIA References:
IPPF Standard 2120 - Risk Management (Financial Performance & Cost Analysis) COSO ERM - Financial Stability & Revenue Risk Management Accounting Best Practices - Break-even & Margin of Safety Calculations

When prioritizing the audit universe, the CAE typically uses a risk-factor approach. This includes a combination of likelihood, impact, control effectiveness, and other relevant criteria. Solely relying on impact (Option C) or likelihood (Option B) is insufficient. Heat maps (Option D) may be tools used within the process, but they are not the actual method of prioritization.
Thus, the correct description is the risk-factor approach (Option A).
Reference:
IIA Practice Guide - Developing a Risk-based Internal Audit Plan.

A firewall is a network security device that monitors and controls incoming and outgoing network traffic based on predefined security rules. It is the primary control for preventing unauthorized external access to an organization's network, making it the best answer.
* A. Firewall (Correct Answer) - Firewalls prevent unauthorized access by filtering traffic, blocking malicious connections, and securing the network perimeter.
* B. Encryption - While encryption protects data confidentiality, it does not actively prevent unauthorized access to a network.
* C. Antivirus - Antivirus software protects against malware and viruses but does not prevent unauthorized network access.
* D. Biometrics - Biometrics controls physical or logical access (e.g., fingerprint authentication) but does not secure a network from external threats.
* IIA GTAG 15 - Information Security Governance highlights firewalls as a critical security control for network protection.
* IIA IPPF Standard 2110 - Governance emphasizes the need for network security policies that include firewalls.
* NIST SP 800-41 Rev. 1 - Guidelines on Firewalls and Firewall Policy states that firewalls are the first line of defense in securing organizational networks.
Explanation of Each Option:IIA References:

Integrity controls are application controls designed to monitor data being processed to ensure that it remains accurate, consistent, and valid throughout its lifecycle. These controls help detect and prevent data corruption, unauthorized modifications, and inconsistencies in transactional systems.
Integrity controls enforce data validation, consistency checks, and reconciliation procedures to prevent errors during processing.
Examples include checksum validation, referential integrity constraints, and automated reconciliations to ensure data accuracy.
The IIA's Global Technology Audit Guide (GTAG) 8 - Auditing Application Controls highlights integrity controls as a key measure in maintaining data reliability.
A). Management trail controls # Incorrect. These refer to audit trails and logs that track changes and actions within a system but do not actively monitor or correct data integrity.
B). Output controls # Incorrect. These focus on ensuring final reports, documents, or processed data outputs are accurate but do not monitor data during processing.
D). Input controls # Incorrect. These verify the accuracy and completeness of data at the point of entry, but they do not continuously monitor data throughout processing.
IIA GTAG 8 - Auditing Application Controls recommends integrity controls to maintain data accuracy.
IIA Standard 2120 - Risk Management states that internal auditors should assess data integrity risks in business processes.
ISACA's COBIT Framework identifies data integrity as a key IT control objective.
Why Option C is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is C. Integrity controls.