A business impact analysis begins by identifying business processes and determining their criticality, dependencies, impacts of disruption, recovery priorities, recovery time objectives, and recovery point objectives. Identifying business processes is a core BIA step because recovery planning cannot be effective until the organization understands which processes are essential and what resources support them. Staffing alternatives, recovery solutions, recovery sites, and alternative sourcing are later continuity and recovery strategy decisions based on BIA results. Internal auditors should evaluate whether the BIA includes all significant processes, considers operational and financial impacts, and is updated when business conditions change. Therefore, Option C is correct.

A high-performance culture is one where employees are motivated to achieve excellence, innovate, and contribute to organizational success. This requires recognition of individual contributions, team collaboration, and strong leadership.
Let ' s analyze each option:
A). Reiterating the importance of compliance with established policies and procedures.
Incorrect. While compliance is crucial for governance and risk management, simply enforcing policies does not inherently promote high performance. High-performance cultures go beyond compliance to encourage innovation, creativity, and ownership.
B). Celebrating employees ' individual excellence. # (Correct Answer)
Correct. Recognizing and rewarding employees for their achievements, innovation, and outstanding performance fosters motivation, engagement, and a culture of continuous improvement.
Examples include employee recognition programs, awards, and performance-based incentives.
C). Periodically rotating operational managers.
Incorrect. While job rotation can provide exposure to different roles, frequent changes in leadership may disrupt continuity and stability, potentially harming long-term performance.
D). Avoiding status differences among employees.
Incorrect. While reducing hierarchical barriers can improve collaboration, completely eliminating status differences is unrealistic. A well-structured leadership framework helps set clear roles, expectations, and accountability.
IIA Standard 2110 - Governance - Encourages fostering a performance-driven culture.
COSO ERM Framework - Performance & Strategy Alignment - Discusses the role of motivation and recognition in achieving organizational goals.
ISO 30414 - Human Capital Reporting - Covers employee engagement and performance culture.
IIA Practice Guide - Evaluating Corporate Culture - Highlights employee recognition as a key factor in high- performance environments.
IIA References:

A systems development methodology refers to a structured approach used in software development and systems engineering to guide the design, development, and implementation of software applications.
* Why Option A (Waterfall) is Correct:
* Waterfall methodology is a linear and sequential systems development methodology where each phase (e.g., requirements, design, implementation, testing, deployment) must be completed before moving to the next.
* It is widely established and historically one of the first software development methodologies.
* Used in large-scale enterprise projects where detailed planning and structured execution are required.
* Why Other Options Are Incorrect:
* Option B (PRINCE2 - Projects in Controlled Environments):
* Incorrect because PRINCE2 is a project management framework, not a systems development methodology.
* Option C (ITIL - Information Technology Infrastructure Library):
* Incorrect because ITIL is a set of IT service management (ITSM) best practices, not a software development methodology.
* Option D (COBIT - Control Objectives for Information and Related Technologies):
* Incorrect because COBIT is a governance framework for IT management and controls, not a development methodology.
* IIA GTAG - "Auditing IT Projects and Systems Development": Highlights Waterfall as a traditional systems development methodology.
* IIA's Global Technology Audit Guide on IT Risks: Discusses software development lifecycle risks, including Waterfall methodology.
* COBIT Framework - BAI03 (Manage Solutions Identification and Build): References structured methodologies like Waterfall in IT governance.
IIA References:

The phrase "confidentiality of different records within the database" points to authorization and access restrictions. The best control is restricting access permissions when mobile devices are used, because users should only access records required for their role and business purpose. Encryption protects data in transit, but it does not control which database records an authenticated user can view. Remote wiping helps after a device is lost but does not manage record-level confidentiality during normal use. Two-factor authentication strengthens login security, but after authentication, confidentiality still depends on authorization rules.
Internal audit should evaluate least privilege, role-based access, mobile access restrictions, logging, and periodic access reviews. Therefore, Option C is correct.

A biometric lock can support both physical and logical access control because biometric characteristics may be used to restrict entry to secure areas and authenticate users to information systems. Biometrics rely on something the person is, such as fingerprint, facial recognition, retina pattern, or hand geometry. An identification card primarily supports physical identification or card access and can be lost, shared, or stolen.
An electromechanical lock is mainly physical. A plenum is a building air-handling space and is not an access- control device. Internal auditors should evaluate biometric enrollment, template storage, false acceptance risk, privacy requirements, fallback procedures, and revocation controls. Because biometrics can control both facility and system access, Option B is correct.