The chief audit executive may assist the audit committee or board in the external auditor selection process by helping determine or recommend selection criteria. Relevant criteria may include independence, competence, industry experience, audit methodology, regulatory knowledge, staffing, technology capability, fee structure, and communication approach. The CAE should not independently acquire the external audit service because appointment is normally a board or audit committee responsibility. Assessing appraisal and actuarial services is too narrow and not the main selection role. Identifying regulatory requirements may be useful, but it is not as central as establishing selection criteria. Internal audit's role should support governance without taking over the board's responsibility. Therefore, Option C is correct.

No IT control is perfect. Even a well-designed control can fail because of human error, system malfunction, poor configuration, incomplete data, collusion, or management override. Option D reflects this limitation of internal control. Option A is incorrect because IT risks and controls should be assessed based on risk, change, and business criticality, not only every five years. Option B is too narrow because management owns controls, but effective IT control also depends on users, governance, risk management, and oversight. Option C is unrealistic because an organization should implement appropriate controls based on risk and cost-benefit, not all possible controls. Internal audit should evaluate both design effectiveness and operating effectiveness.
Therefore, Option D is correct.

A typical desktop workstation used by employees contains software that enables users to access, process, and manage stored data on the organization's network. This includes operating systems, office applications, business applications, network clients, and access tools. Options A and B describe firewall or gateway functions, not ordinary desktop workstation functions. Option C is incomplete because workstations may process transactions, but the defining feature for most employees is controlled access to network-based resources and stored data. Internal auditors reviewing workstation controls should evaluate endpoint security, patching, access rights, encryption, malware protection, configuration standards, and data loss prevention.
Therefore, Option D best describes a typical employee workstation.

To test the accuracy of information already housed in a database on an un-networked computer, the auditor should select a sample of records and trace them to supporting documentation. This directly verifies whether stored database information is accurate, valid, and supported by source evidence. Submitting test transactions is more appropriate for testing system processing controls rather than validating existing database records. A test program simulating data entry also tests processing logic, not necessarily the accuracy of current data.
Evaluating change management may be relevant to system integrity, but it does not directly prove that the data is accurate. Internal auditors should select the test approach that directly addresses the audit objective.
Since the objective is data accuracy, Option C is correct.

Market price is the most appropriate transfer price when there is a competitive external market for the service.
An external market provides an objective benchmark for what independent parties would pay or charge. This improves fairness, supports performance evaluation, and reduces internal disputes between responsibility centers. If no external market exists, the organization may need to use cost-based, negotiated, or administrative transfer pricing. Option B may affect whether internal transfer is economically beneficial, but it does not make market price the best benchmark by itself. Option C is irrelevant because transfer pricing should not be determined merely by bargaining power. Option D is the opposite of the condition needed for reliable market pricing. Internal auditors should assess whether transfer prices support goal congruence and accurate performance measurement. Therefore, Option A is correct.