Decentralization delegates decision-making authority to lower levels, divisions, regions, or operating units.
This usually improves responsiveness and makes better use of local knowledge, but it can also result in less controlled or less consistent decision making. Local managers may make decisions that differ from headquarters' preferences or from other units unless governance, policies, performance measures, and oversight are strong. Option A is incorrect because decentralization usually supports faster response to external change. Option C is incorrect because decentralization often reduces the routine decision burden on higher-level managers. Option D is also incorrect because decentralization can make better use of employees' skills by giving them more authority. Therefore, Option B is correct.

A risk-based internal audit plan must begin with the organization's objectives because risks are meaningful only in relation to objectives. Internal audit needs to understand what the organization is trying to achieve before identifying events that could prevent achievement, delay achievement, or create unacceptable exposure. After objectives are understood, the audit activity can identify risks, assess their likelihood and impact, consider management's risk responses, evaluate existing assurance coverage, and prioritize engagements. Option A is important but should follow the review of objectives. Option B is premature because controls cannot be evaluated effectively until the related objectives and risks are understood. Option C is also premature because risks cannot be prioritized before they are identified and linked to objectives.
Therefore, the correct starting point for risk-based audit planning is Option D.

When multiple end-user applications can update the same database, the major integrity risk is that simultaneous updates may overwrite, conflict with, or corrupt data. Concurrency update controls prevent two users or applications from improperly changing the same record at the same time. These controls support transaction integrity through locking, version control, commit/rollback procedures, and conflict resolution.
Option A applies only to read-only applications and does not address update risk. Option C concerns development platform but does not directly protect database integrity. Option D is incorrect because adopting a hierarchical database model does not solve the control issue and may not suit multiuser processing. Internal auditors reviewing DBMS environments should focus on access controls, update authorization, transaction logging, and concurrency controls. Therefore, Option B is correct.

Reference: IIA Business Knowledge for Internal Auditing, Inventory Valuation section.

A management action plan should include: (1) corrective action, (2) responsible personnel, and (3) implementation timeline. In this case, while the corrective action and due date are included, the responsible personnel is missing, which is critical for accountability.
Option B (status) is tracked later during follow-up. Option C (policy reference) is not mandatory. Option D (risk level) belongs to the observation, not the action plan.
Reference:
IIA Practice Guide - Audit Findings and Recommendations.