Unauthorized external changes to data are best prevented through layered preventive controls. A firewall restricts unauthorized network access from external sources. Antivirus software helps prevent malicious code from modifying or corrupting data. Data encryption protects data confidentiality and can reduce unauthorized use or alteration when combined with proper key controls. Backup procedures are important recovery controls, but they do not prevent unauthorized changes from occurring. Change logs are detective controls because they record activity after changes occur. Internal auditors evaluating data protection should distinguish preventive, detective, and corrective controls. The best preventive combination listed is antivirus software, firewall, and encryption. Therefore, Option A is correct.

The CAE must prioritize engagements based on risk assessment. A risk matrix (considering likelihood and impact of risks) provides the starting point to evaluate which areas of the audit universe present the highest exposure and should be included in the plan.
Option A (maturity model) helps evaluate risk management capability but is not the starting point. Option C (assurance map) supports coordination but follows the risk assessment. Option D (control framework) provides criteria but not prioritization.
Reference:
IIA Standards - Standard 2010: Planning.

The most effective mitigation is to embed ongoing controls within vendor management processes to ensure that both new and existing vendors are continuously screened against updated sanctions lists. This creates a sustainable and automated compliance mechanism.
Option A is reactive and does not address future compliance. Option B only addresses onboarding of new vendors but ignores existing ones. Option D undermines compliance obligations and does not mitigate risk.
Reference:
IIA Global Technology Audit Guide (GTAG): Auditing Third-Party Risk; IIA Standards - Standard 2130:
Control.

According to the IIA Standards, audit communications must be accurate, objective, clear, concise, constructive, and timely. In this case, the auditor's statement that "controls are as effective as last year" is inaccurate, because the prior year's report identified significant weaknesses. Equating ineffective controls with effectiveness misrepresents the actual condition, thereby compromising accuracy.
Objectivity (Option C), conciseness (Option A), and constructiveness (Option B) are not the main issue here.
The primary weakness is accuracy (Option D).
Reference:
IIA Standards - Standard 2420: Quality of Communications.

The Internet of Things connects sensors, machines, devices, and systems so operational data can be captured and transmitted continuously. In a manufacturing plant, the primary benefit is real-time monitoring of production equipment, output, temperature, vibration, downtime, quality indicators, and maintenance conditions. This allows management to detect production issues quickly, reduce downtime, improve preventive maintenance, and optimize throughput. IoT may introduce cybersecurity and data-integrity concerns, but securing sensitive data and detecting cyberattacks are not its main production-process benefit.
Data integrity also requires additional controls over devices, transmission, storage, and analytics. Internal auditors should evaluate IoT governance, access control, device security, monitoring, and operational reliance. Therefore, Option A is correct.