A Wide Area Network (WAN) is the most suitable type of network for an organization that has operations in multiple cities and countries. WANs connect multiple local area networks (LANs) and other types of networks across long geographical distances, enabling seamless communication and data sharing among remote offices and branches.
* A. Wide Area Network (WAN) (Correct Answer)
* WANs cover extensive geographical areas, such as multiple cities, countries, or even continents.
* They use various communication technologies, including leased lines, satellite connections, VPNs, and MPLS.
* WANs enable organizations with distributed operations to centralize data management and enhance business continuity.
* Example: An international corporation like a multinational bank or a global retail chain relies on a WAN to link its offices worldwide.
* B. Local Area Network (LAN) (Incorrect Answer)
* LANs are confined to a small area, such as an office building, factory, or campus.
* They provide high-speed connectivity but are not designed for geographically dispersed locations.
* Example: A single office using Ethernet and Wi-Fi to connect employees' devices.
* C. Metropolitan Area Network (MAN) (Incorrect Answer)
* MANs span a city or a large campus but do not extend to multiple countries.
* Example: A city's government agencies using a fiber-optic MAN for interdepartmental communication.
* D. Storage Area Network (SAN) (Incorrect Answer)
* SANs are dedicated high-speed networks designed for large-scale data storage and retrieval.
* They are not meant for interconnecting geographically dispersed locations.
* Example: A financial institution using a SAN for high-speed access to critical databases.
* The IIA's Global Technology Audit Guide (GTAG) - IT Risks and Controls emphasizes the importance of network infrastructure in securing and managing organizational data across multiple locations.
* IIA Standard 2110 - Governance requires internal auditors to evaluate whether the organization's IT strategy (including WAN infrastructure) supports business objectives and risk management.
* IIA GTAG 17 - Auditing Network Security highlights the importance of WAN security, VPNs, and encryption when managing international operations.
Explanation of Answer Choices:IIA References:Thus, the correct answer is A. Wide Area Network (WAN).

Indirect labor costs incurred in the production process are treated as part of manufacturing overhead. Since the cost was incurred on the last day of the year, it is likely that the related products are still in inventory rather than being sold.
Under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS), indirect labor costs associated with manufacturing should be included in the cost of inventory until the related goods are sold.
Once the goods are sold, the cost will be transferred to the cost of goods sold (COGS) in the income statement.
A). It should be reported as an administrative expense on the income statement. (Incorrect) Indirect labor related to manufacturing is classified as part of manufacturing overhead, not an administrative expense.
B). It should be reported as a period cost other than a product cost on the management accounts. (Incorrect) Indirect labor in production is a product cost (i.e., a cost that is included in inventory and matched with revenues when the product is sold).
Period costs refer to expenses like selling and administrative costs, which are expensed immediately.
C). It should be reported as cost of goods sold on the income statement. (Incorrect) Since the cost was incurred on the last day of the year, the related products have likely not yet been sold, meaning the cost remains in inventory.
D). It should be reported on the balance sheet as part of inventory. (Correct) Manufacturing overhead, including indirect labor, is included in inventory (work-in-process or finished goods) on the balance sheet until the goods are sold.
IIA Practice Guide: Auditing Inventory Management emphasizes that manufacturing costs, including indirect labor, should be allocated properly to inventory.
IIA Standard 2330 - Documenting Information requires auditors to ensure proper financial reporting of costs in accordance with GAAP/IFRS inventory valuation principles.
IFRS (IAS 2 - Inventories) and GAAP (ASC 330 - Inventory) state that indirect production costs must be capitalized as inventory until sold.
Explanation of Answer Choices:IIA References:Thus, the correct answer is D. It should be reported on the balance sheet as part of inventory.

System software controls refer to security measures and protocols that protect an organization's IT infrastructure from unauthorized access, cyber threats, and system failures. Intrusion testing (penetration testing) is a key system software control used to detect vulnerabilities in IT environments.
Correct Answer (D - Performing Intrusion Testing on a Regular Basis)
Intrusion testing is a critical system software security measure that helps identify weaknesses in software configurations and security defenses.
This falls under system software controls because it directly tests the security of operating systems, applications, and network software.
The IIA's GTAG 11: Developing IT Security Audits highlights penetration testing as a necessary control for system software security.
Why Other Options Are Incorrect:
Option A (Restricting server room access to specific individuals):
This is a physical access control, not a system software control.
Option B (Housing servers away from environmental hazards):
This is an environmental control, focusing on disaster prevention rather than software security.
Option C (Ensuring that all user requirements are documented):
This relates to project documentation and system development, but it does not control software security.
IIA GTAG 11: Developing IT Security Audits - Recommends regular penetration testing as a system software control.
IIA Practice Guide: Auditing IT Security - Discusses system software security measures.
IIA References for Validation:Thus, D is the correct answer because intrusion testing is a core system software control ensuring security.

The control environment includes the organization's integrity and ethical values, board oversight, management philosophy, organizational structure, reporting lines, authority, responsibility, accountability, and human resource practices. Establishing structures, reporting lines, authorities, and responsibilities is therefore part of the control environment. Control activities are specific policies and procedures used to address risks. Information and communication involve identifying, capturing, and communicating relevant information. Monitoring evaluates whether internal control components are present and functioning over time.
Internal audit evaluates the control environment because it influences the effectiveness of all other controls.
Weak structure or unclear authority can cause accountability gaps, override, duplicated work, or unmanaged risks. Therefore, Option A is correct.

To identify very small control and transaction anomalies, internal auditors should analyze the entire dataset rather than a sample. Full population analysis increases the likelihood of detecting:
Unusual transaction patterns, including fraud, errors, and control weaknesses.
Rare or subtle anomalies that might be missed in sampling-based audits.
Machine-learning-based fraud detection and exception analysis.
A). Analysis of the full population of existing data. (Correct)
This approach ensures complete coverage, reduces sampling risk, and detects rare anomalies.
Modern data analytics tools allow auditors to analyze entire datasets efficiently.
B). Verification of the completeness and integrity of existing data. (Incorrect) While data integrity checks ensure reliable data, they do not actively identify anomalies or suspicious patterns.
C). Continuous monitoring on a repetitive basis. (Incorrect, but relevant) Continuous monitoring is useful for ongoing fraud detection, but it does not guarantee full anomaly detection unless it covers all transactions.
Full population analysis is more comprehensive for identifying small anomalies.
D). Analysis of the databases of partners, such as suppliers. (Incorrect) While analyzing external data sources can uncover vendor fraud, it does not address internal control or transaction anomalies within the organization.
IIA GTAG 3 - Continuous Auditing recommends full population analysis as a best practice for anomaly detection.
IIA Standard 1220 - Due Professional Care requires auditors to use advanced analytical techniques to detect control weaknesses.
COSO Framework - Fraud Risk Management Guide suggests full transaction data analysis for effective fraud detection.
Explanation of Answer Choices:IIA References:Thus, the correct answer is A. Analysis of the full population of existing data.