The sales budget is prepared first because it drives most other operating and financial budgets. Expected sales volume and selling price determine revenue forecasts, production requirements, inventory planning, purchasing needs, labor needs, overhead planning, and cash inflows. The production budget cannot be prepared until expected unit sales and desired inventory levels are known. The cash budget depends on sales collections, purchases, payroll, expenses, capital spending, and financing activity, so it comes later in the budgeting sequence. Selling and administrative expenses may be estimated independently in some areas, but they are still commonly influenced by sales levels and planned business activity. In internal audit planning, auditors reviewing budgeting controls should verify whether the organization begins with realistic sales assumptions. Therefore, Option C is correct.

IT General Controls (ITGCs) refer to foundational IT controls that support the reliability and security of information systems across all applications. Systems development controls fall under ITGCs because they ensure that:
* IT systems are developed, tested, and implemented securely.
* Change management, system testing, and access controls are enforced before deployment.
* Ensuring Secure Development Practices:
* IIA GTAG 8: Auditing Application Controls states that strong systems development controls prevent unauthorized access and errors in IT systems.
* Risk Mitigation in Software Changes:
* IIA Standard 2110 - Governance requires IT governance to enforce security policies for system development.
* Weak controls increase risks of security vulnerabilities and financial misstatements.
* Alignment with COSO & COBIT Frameworks:
* COBIT (Control Objectives for Information and Related Technologies) classifies systems development controls as an ITGC domain.
* COSO Internal Control - Integrated Framework supports secure system change processes.
* A. Error listings (Incorrect)
* Reason: Error listings are application controls that detect transaction errors within specific processes. ITGCs support all systems, not just specific applications.
* B. Distribution controls (Incorrect)
* Reason: Distribution controls deal with physical/logistical distribution of information or resources, not core ITGC functions.
* C. Transaction logging (Incorrect)
* Reason: While transaction logging is important for data integrity and security, it is an application control, not a general IT control.
* IIA GTAG 8: Auditing Application Controls - Defines IT general controls and application-specific controls.
* IIA Standard 2110 - Governance - Requires secure IT development and governance structures.
* COBIT & COSO Internal Control Frameworks - Classify system development controls as critical ITGCs.
Why is Answer D Correct?Analysis of Incorrect Answers:IIA References:Thus, the correct answer is D.
Systems development controls.

The defensible answer is B. When assessing whether a risk mitigation strategy is adequate, internal audit should consider management's risk tolerance, the cost-benefit relationship of the control, and whether the control's effectiveness can be tested. Risk tolerance determines whether residual risk is acceptable. Cost- benefit analysis is necessary because controls should be proportionate to the risk. Testability matters because a control that cannot be evaluated provides weak assurance. Whether one control can mitigate multiple risks may be efficient, but it is not a core adequacy criterion. A control can mitigate only one major risk and still be fully adequate. Internal audit should focus on residual risk, control design, operating effectiveness, and alignment with risk appetite. Therefore, Option B is correct.

Definition of a Firewall:
A firewall is a network security device (hardware or software) that monitors and controls incoming and outgoing network traffic.
It is designed to filter or prevent specific information from moving between internal and external networks, ensuring unauthorized access is blocked.
How a Firewall Works:
It uses rules and policies to determine whether to allow or block traffic.
Firewalls can be configured to prevent malware, hacking attempts, and unauthorized data transfers.
There are different types, including packet-filtering firewalls, stateful inspection firewalls, and next- generation firewalls (NGFWs).
Why Other Options Are Incorrect:
A). Authorization:
Authorization refers to user access control, ensuring users have the correct permissions, but it does not filter network traffic.
B). Architecture model:
An architecture model defines the structure of an IT system but does not actively prevent or filter data movement.
D). Virtual private network (VPN):
A VPN encrypts data and provides secure remote access but does not filter or block data movement between networks.
IIA's Perspective on IT Security Controls:
IIA Standard 2110 - Governance emphasizes strong cybersecurity controls, including firewalls, to protect sensitive data.
IIA GTAG (Global Technology Audit Guide) on Information Security recommends using firewalls as a primary defense mechanism.
NIST Cybersecurity Framework and ISO 27001 Security Standards identify firewalls as critical tools for network security and data protection.
IIA References:
IIA Standard 2110 - Governance and IT Security
IIA GTAG - Information Security Risks
NIST Cybersecurity Framework

Recording Initial Investment in a Partnership:
When forming a partnership, each partner contributes assets, cash, or services to the business.
The initial investment should be recorded at the value agreed upon by the partners, which may differ from fair market value or book value.
This is because partnerships are formed based on mutual agreement, and partners decide how to allocate capital and contributions.
Why Other Options Are Incorrect:
B). At book value:
Book value refers to the value recorded in a partner's individual financial statements. However, in a new partnership, the previous book value is not relevant.
C). At fair value:
While fair value is commonly used in financial reporting, in partnerships, the agreed-upon value is more relevant as partners may negotiate different terms.
D). At the original cost:
The original cost of assets contributed may not reflect their current market or partnership-agreed value, making it an inappropriate basis for initial recording.
IIA's Perspective on Financial Recording:
IIA Standard 1220 - Due Professional Care requires auditors to ensure that financial transactions are recorded in accordance with agreed terms.
COSO Internal Control - Integrated Framework supports the principle that partnership agreements should dictate valuation methods.
GAAP & IFRS Accounting Guidelines recognize that partnership accounting is based on agreed-upon contributions rather than standardized valuation methods.
IIA References:
IIA Standard 1220 - Due Professional Care
COSO Internal Control - Integrated Framework
GAAP & IFRS Partnership Accounting Standards