Database administrators (DBAs) have privileged access, meaning they can make unauthorized or hidden changes to data, database structures, and security settings without detection. This presents a high risk of fraud, data manipulation, and security breaches.
A). The risk that database administrators will disagree with temporarily preventing user access to the database for auditing purposes. (Incorrect) While resistance from DBAs during an audit can be a challenge, it is not a significant risk compared to the ability to manipulate data unnoticed.
B). The risk that database administrators do not receive new patches from vendors that support database software in a timely fashion. (Incorrect) Patch management is a security concern but does not directly relate to the unique risk of DBAs abusing privileged access.
C). The risk that database administrators set up personalized accounts for themselves, making the audit time- consuming. (Incorrect) While personal accounts can complicate audits, the greater risk is that DBAs can make changes without detection.
IIA GTAG 4 - Management of IT Auditing emphasizes the need for controls over privileged access to prevent unauthorized database modifications.
IIA Standard 2110 - Governance requires internal auditors to assess risks related to IT governance and privileged access management.
IIA GTAG 8 - Auditing Application Controls highlights that auditors must review DBA activity logs and ensure segregation of duties.
Explanation of Answer Choices:IIA References:Thus, the correct answer is D. The risk that database administrators could make hidden changes using privileged access.

VAT payable is calculated on value added, which in this simplified case equals sales less purchases of materials. Sales are $2,300,000 and purchases are $700,000, so value added is $1,600,000. Applying the VAT rate of 20 percent gives VAT payable of $320,000. Profit before interest and tax and corporate income tax are irrelevant to the VAT calculation because VAT is a transaction-based tax, not a tax on profit. Interest expense is also irrelevant here because it is not part of the taxable value-added computation given in the question.
Internal auditors reviewing tax controls should verify that VAT calculations use the correct tax base, rate, input credits, and reporting period. Therefore, Option D is correct.

A directive control is a policy, procedure, or guideline that establishes expected behavior to mitigate risks. In the context of outsourcing HR functions, a data protection clause in the contract ensures that the service provider is legally obligated to protect sensitive employee data.
Legal and Regulatory Compliance - It ensures the service provider complies with GDPR, CCPA, ISO 27001, SOC 2, and other data protection laws.
Defines Security Responsibilities - Specifies encryption, access controls, data retention policies, and penalties for non-compliance.
Enforceable Accountability - The contract holds the provider accountable for data breaches or misuse.
Industry Best Practice - Most outsourcing agreements include a Data Processing Agreement (DPA) as part of contractual terms.
A). Require a SOC report - A SOC (Service Organization Control) report assesses the provider's internal controls, but it does not enforce compliance.
C). Obtain a nondisclosure agreement (NDA) - An NDA is useful, but it only prevents individuals from sharing data; it does not define data security requirements.
D). Encrypt the employees ' data before transmitting it - Encryption is a strong preventive control, but it does not provide a directive policy like a contract clause does.
IIA's International Professional Practices Framework (IPPF) - Standard 2201 - Requires internal auditors to assess contract terms related to risk management.
COSO's Enterprise Risk Management (ERM) Framework - Recommends contractual agreements for third- party risk mitigation.
ISO 27001 Annex A.15.1.2 - Specifies that security requirements must be addressed in supplier contracts.
Why a Data Protection Clause Is the Most Appropriate Directive Control?Why Not the Other Options?IIA References:# Final Answer: B. Include a data protection clause in the contract with the service provider.
(Most appropriate directive control).

The internal audit strategy must be aligned with the organization's business objectives. This ensures that the internal audit function provides assurance and advisory services that support the achievement of strategic goals. While risk assessment (Option B), controls (Option C), and compliance (Option A) are important inputs, they are secondary to aligning with organizational objectives, which is the foundation of strategy.
Reference:
IIA Standards - Standard 2010: Planning; IIA Practice Guide - Developing the Internal Audit Strategic Plan.

Software licenses commonly permit the purchaser to make one backup copy for protection against loss or damage, provided it is not used as an additional installed copy. Copy 1, made solely for backup purposes, is therefore generally legal. Copy 2, made for use by another member of the department, is not legal unless the license permits multiple installations or concurrent users. Making an additional working copy without authorization violates license terms and copyright law. Internal auditors should review software asset management controls, license inventories, installation monitoring, procurement records, and user awareness.
Unauthorized copying exposes the organization to legal penalties, vendor claims, reputational damage, and compliance findings. Therefore, only Copy 1 is legal, making Option B correct.