Both hierarchical and open organizational structures require responsibility to be supported by adequate authority. Assigning responsibility without authority creates accountability failure and control weakness. Both structures also recognize that a superior may delegate tasks or authority but cannot delegate ultimate responsibility for results. Statement 1 is more characteristic of open or decentralized structures, not all hierarchical structures. Statement 2 is an outdated and rigid span-of-control rule; appropriate span depends on complexity, employee competence, technology, geography, and control needs. Internal audit should evaluate whether organizational design supports clear accountability, authority, escalation, segregation of duties, and effective oversight. The principles common to both structures are statements 3 and 4. Therefore, Option D is correct.

An investment center is evaluated not only on revenues and costs but also on how effectively it uses invested capital. Residual income is appropriate because it measures profit after deducting a required return on the investment base. This makes it suitable for assessing whether management generated returns above the organization's minimum required rate. Cost centers are evaluated mainly on cost control, revenue centers on revenue generation, and profit centers on revenues minus expenses; none of these centers is directly responsible for invested capital. Flexible budgets and variance analysis can apply to many responsibility centers. Contribution margin reporting is useful for segment profitability but does not fully evaluate investment use. Therefore, residual income is uniquely suited to investment center evaluation, making Option D correct.

A privacy and data protection program normally begins by understanding the organization's data, defining scope, identifying privacy risks, and selecting an appropriate framework or control model. After the program structure and risks are defined, the organization can establish assessment and communication formats to monitor performance, report issues, and communicate results to stakeholders. Option B therefore comes last among the choices. Selecting the framework, defining implementation scope, and identifying risks are foundational activities that must occur before assessment and reporting can be meaningful. Internal auditors reviewing privacy programs should evaluate whether the organization understands personal data flows, legal obligations, consent, access, retention, third-party sharing, breach response, monitoring, and communication.
Therefore, Option B is correct.

A capital lease (now referred to as a finance lease under IFRS 16 and ASC 842) is a leasing arrangement where an organization records the leased asset and liability on its balance sheet as if it were owned.
Organizations enter into capital leases to improve financial metrics, including free cash flow from operations.
Let's analyze each option:
Option A: To increase the ability to borrow additional funds from creditors Incorrect. A capital lease creates a liability on the balance sheet, which may reduce borrowing capacity rather than increase it.
Option B: To reduce the organization ' s free cash flow from operations Incorrect.
Operating leases impact operating cash flow because lease payments are treated as operating expenses.
Capital leases (finance leases) shift payments to financing activities, improving operating cash flow since lease obligations are classified as debt.
Option C: To improve the organization ' s free cash flow from operations Correct.
Capital lease payments are classified under financing activities rather than operating activities, which increases free cash flow from operations.
This improves financial ratios and liquidity metrics, making the organization appear more attractive to investors.
IIA Reference: Internal auditors assess lease accounting and financial reporting impacts under IFRS 16 (Leases) and ASC 842 (Leases). (IIA Practice Guide: Auditing Financial Reporting Risks) Option D: To acquire the asset at the end of the lease period at a price lower than the fair market value Incorrect. While some capital leases include a bargain purchase option, the primary reason for entering into a capital lease is financial reporting benefits, not necessarily acquiring the asset.
Thus, the verified answer is C. To improve the organization ' s free cash flow from operations.

The most effective control for temporary third-party access is to create user accounts with defined expiration dates and access rights based only on the services provided. This applies least privilege and automatically limits access duration, reducing the risk that accounts remain active after work ends. Manager approval is necessary, but approval alone does not technically restrict access. Providing administrator access, even for a limited period, is excessive unless absolutely required and tightly monitored. Deleting accounts after work is completed is useful but depends on timely manual action and may fail if completion is not communicated.
Internal audit should verify that third-party access is approved, time-bound, role-based, monitored, and promptly revoked. Therefore, Option B is correct.