Internal auditors may advise management about outsourcing risks and typical controls without impairing independence, provided they do not assume management responsibility. However, controls provided by the service provider alone may be insufficient to protect the organization. Management must also establish internal oversight, contract monitoring, review of service organization reports, data protection requirements, access controls, issue escalation, and right-to-audit provisions. Option A is incorrect because recommending controls in an advisory capacity does not automatically compromise independence. Option B is also incorrect if internal audit remains advisory and management makes decisions. Option C would be inappropriate if internal audit takes responsibility for ensuring controls operate. Therefore, Option D is the most accurate statement.

The matching principle is a fundamental accounting concept that ensures that expenses are recorded in the same period as the revenues they help generate.
* Why Option C (Expense recognition is tied to revenue recognition) is Correct:
* The matching principle states that expenses should be recognized in the same period as the revenue they help generate to ensure accurate financial reporting.
* This principle is applied in accrual accounting under GAAP and IFRS, ensuring that expenses and revenues are properly aligned.
* Why Other Options Are Incorrect:
* Option A (Revenues should be recognized when earned):
* This describes the revenue recognition principle, not the matching principle.
* Option B (Revenue recognition is matched with cash):
* Incorrect because the matching principle applies to accrual accounting, not cash accounting. Revenue can be recognized before cash is received.
* Option D (Expenses are recognized at each accounting period):
* Incorrect because expenses are not necessarily recognized in every period; they are matched to revenue.
* IIA Practice Guide - "Auditing Financial Reporting Controls": Discusses the importance of the matching principle.
* GAAP & IFRS Accounting Standards: Define and require the application of the matching principle.
* COSO Internal Control Framework: Emphasizes revenue-expense alignment for accurate financial reporting.
IIA References:

* Understanding the Three Lines of Defense Model:
* First Line of Defense (Operational Management): Performs daily IT security tasks, such as blocking unauthorized traffic and encrypting data.
* Second Line of Defense (Risk Management & Compliance): Monitors and reviews security controls, including disaster recovery testing and risk management activities.
* Third Line of Defense (Internal Audit): Provides an independent assessment of IT security controls.
* Why Option C (Review Disaster Recovery Test Results) Is Correct?
* The second line of defense is responsible for monitoring and evaluating IT risk management processes, including disaster recovery and business continuity planning.
* Reviewing disaster recovery test results ensures that the organization is prepared for IT disruptions and meets compliance requirements.
* IIA Standard 2110 - Governance requires auditors to evaluate whether IT risk management activities (such as disaster recovery) are being effectively monitored.
* Why Other Options Are Incorrect?
* Option A (Block unauthorized traffic):
* This is a first-line defense task, typically handled by IT security teams (e.g., firewall and intrusion detection system monitoring).
* Option B (Encrypt data):
* Encryption is part of daily IT security operations and is handled by the first line of defense.
* Option D (Provide an independent assessment of IT security):
* Independent assessments are the responsibility of internal audit (third line of defense), not the second line.
* The second line of defense focuses on monitoring IT risk, making disaster recovery test review a key responsibility.
* IIA Standard 2110 and the Three Lines of Defense Model confirm this role.
Final Justification:IIA References:
* IPPF Standard 2110 - Governance (IT Risk Management)
* IIA Three Lines of Defense Model
* COBIT Framework - IT Governance & Risk Management

The carrying amount (inventory value) of defective items is calculated based on the lower of cost or net realizable value (NRV) principle under Generally Accepted Accounting Principles (GAAP) and International Financial Reporting Standards (IFRS).
Given data:
Market price (normal selling price): $10 per unit
Production cost: $4 per unit
Defect selling price (NRV): $5 per unit
Total defective units: 10,000
Step 1: Determine the valuation rule
According to IAS 2 (Inventories), inventory should be valued at the lower of cost or net realizable value (NRV):
Cost per unit = $4
NRV per unit = $5
Since $4 (cost) < $5 (NRV), the cost per unit ($4) is used for valuation.
Step 2: Calculate total carrying amount
10,000 units×4 (cost per unit)=40,00010,000 \text{ units} \times 4 \text{ (cost per unit)} =
40,00010,000 units×4 (cost per unit)=40,000
However, since the items are defective, their value is determined by NRV ($5 per unit) because they cannot be sold at full market price.
10,000×5=50,00010,000 \times 5 = 50,00010,000×5=50,000
Since inventory should be recorded at the lower of cost or NRV, the inventory value is $5 per unit instead of
$4.
10,000×5=5,00010,000 \times 5 = 5,00010,000×5=5,000
Thus, the verified answer is C. $5,000.