A Value-Added Network (VAN) is a third-party network service that securely connects an organization with its trading partners, facilitating secure electronic data interchange (EDI) and business communications.
* (A) Value-added network (VAN). (Correct Answer)
* A VAN is a private, managed network service that provides secure data transmission between business partners.
* It is commonly used for B2B transactions, supply chain management, and EDI.
* IIA GTAG 7 - IT Outsourcing recognizes VANs as critical third-party networks for secure business data exchange.
* (B) Local area network (LAN).
* Incorrect: A LAN connects computers within a limited area (e.g., an office or building), but it is not designed for external trading partner connections.
* (C) Metropolitan area network (MAN).
* Incorrect: A MAN covers a city or region, but it is not designed for B2B communication.
* (D) Wide area network (WAN).
* Incorrect: A WAN connects multiple geographic locations, but it is a general networking term, not specific to trading partner communications.
* IIA GTAG 7 - IT Outsourcing: Discusses the use of third-party networks like VANs for secure data exchange.
* IIA Standard 2110 - Governance: Recommends secure third-party integration for business continuity and security.
Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (A) Value- Added Network (VAN) because it is specifically designed for secure communication between an organization and its trading partners.

Understanding the "Something You Have" Concept:
Access control methods are classified into three main authentication factors:
Something You Know - Passwords, PINs, security questions.
Something You Have - Physical devices like keycards, smart cards, or security tokens.
Something You Are - Biometrics such as fingerprints, retina scans, or voice recognition.
Why a Card-Key Scanner is the Correct Answer:
A card-key scanner verifies access using a physical card, which aligns with the "something you have" authentication factor.
Users must possess the key card to gain entry, making it a classic example of physical token-based security.
Why Other Options Are Incorrect:
A). A retina characteristics reader - Incorrect, as retina scans fall under "something you are" (biometrics), not
"something you have".
B). A PIN code reader - Incorrect, as PIN codes are "something you know", not a physical possession.
D). A fingerprint scanner - Incorrect, as fingerprints are biometric ("something you are"), not a physical object.
IIA's Perspective on Physical Security Controls:
IIA Standard 2110 - Governance emphasizes the importance of using multi-factor authentication to enhance security.
IIA GTAG (Global Technology Audit Guide) on Access Control recommends the use of physical security devices like card-key scanners to prevent unauthorized access.
ISO 27001 Information Security Standard identifies "something you have" authentication methods as critical components of access control.
IIA References:
IIA Standard 2110 - Governance & IT Security
IIA GTAG - Physical Security & Access Controls
ISO 27001 Information Security Standard - Multi-Factor Authentication
Thus, the correct and verified answer is C. A card-key scanner.

The first step in a project management plan is to break the project into manageable components, known as Work Breakdown Structure (WBS). This step ensures clarity, task allocation, and effective tracking.
* (A) Estimate time required to complete the whole project.
* Incorrect: Time estimation comes after breaking the project into smaller tasks.
* (B) Determine the responses to expected project risks.
* Incorrect: Risk management is important but is planned after defining project tasks and scope.
* (C) Break the project into manageable components. (Correct Answer)
* Dividing the project into smaller tasks (WBS) helps in resource allocation, scheduling, and risk assessment.
* IIA GTAG 12 - Project Risk Management suggests using WBS to define tasks clearly.
* (D) Identify resources needed to complete the project.
* Incorrect: Resources can only be allocated effectively after defining project components.
* IIA GTAG 12 - Project Risk Management: Recommends Work Breakdown Structure (WBS) as the first step in project planning.
* PMBOK (Project Management Body of Knowledge): Defines WBS as the foundation of project planning.
Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (C) Break the project into manageable components, as this is the first step in structuring and planning a successful project.

Textual analysis is the best description because the auditor is reviewing bidding requirements across tender documents and identifying wording or specifications that appear to favor one supplier. Tender requirements are largely text-based, and unusual language, restrictive specifications, repeated phrases, or biased technical descriptions may indicate bid tailoring or bid-rigging risk. Diagnostic analysis explains why an event occurred, but the technique described is focused on analyzing written tender content. Predictive analysis forecasts future outcomes, and network analysis examines relationships between entities or nodes. Internal auditors may use textual analysis in procurement audits to detect suspicious specifications, duplicated wording, vendor-favored criteria, and manipulation of bid requirements. Therefore, Option C is correct.

In a centralized technology department, the auditor would expect controls over segregation of duties, continuity planning, maintenance agreements, and prevention or detection of unauthorized data file changes.
These controls directly protect centralized processing and accounting information. Documented procedures for remote job entry and local data file retention are less likely to be controls within the centralized technology department because remote job entry and local retention relate more to user departments or local entities submitting data. Internal audit should distinguish central IT controls from local user controls.
Centralized technology environments require strong access controls, file security, change management, backup, disaster recovery, and operational monitoring. The exception is Option B because it is not typically a centralized technology department control.