A zero-coupon bond is a type of bond that sells at a discount from its face value and gradually increases in value over time until maturity when the bondholder receives the full face value. Unlike regular bonds, zero- coupon bonds do not pay periodic interest (coupons) but instead accumulate interest over the bond's life.
Let's analyze each option:
Option A: High-yield bonds
Incorrect.
High-yield bonds (junk bonds) offer higher interest rates due to higher risk but pay periodic interest rather than being sold at a discount and growing in value over time.
Option B: Commodity-backed bonds
Incorrect.
Commodity-backed bonds are linked to the price of a commodity (e.g., gold, oil) rather than increasing in value over time from an initial discount.
Option C: Zero coupon bonds
Correct.
These bonds are issued at a discount and increase in value each year as interest accrues.
The investor receives the full face value at maturity, which includes the principal and accumulated interest.
IIA Reference: Internal auditors evaluate investment risks, including bond valuation and discount amortization. (IIA Practice Guide: Auditing Investment and Treasury Functions) Option D: Junk bonds Incorrect.
Junk bonds are simply high-risk, high-yield bonds that pay interest periodically and do not necessarily sell at a deep discount.
Thus, the verified answer is C. Zero coupon bonds.

A focus strategy targets a specific market segment, geographical area, or niche customer base rather than competing in the entire market.
Why Option D (Focus strategy) is Correct:
The car manufacturer introduced a hybrid vehicle specifically for the European market to address increasing emission taxes, meaning they are focusing on a specific region and customer need.
Focus strategy aims at tailoring products to meet the needs of a particular group of consumers (e.g., environmentally conscious European customers).
Why Other Options Are Incorrect:
Option A (Reactive strategy):
Incorrect because while the company is responding to regulatory changes, "reactive strategy" is not a recognized competitive strategy under Porter's model.
Option B (Cost leadership strategy):
Incorrect because cost leadership focuses on minimizing costs and offering the lowest price in the broad market. This scenario does not emphasize cost reduction.
Option C (Differentiation strategy):
Incorrect because differentiation involves offering unique products across a broad market, whereas the hybrid vehicle is targeted specifically for the European market.
IIA Practice Guide - "Auditing Strategic Risk Management": Discusses competitive strategies, including focus strategy.
Porter's Competitive Strategy Model: Defines focus strategy as targeting a niche market.
COSO ERM Framework - "Strategic Decision-Making": Recommends market-specific focus strategies to mitigate regulatory risks.
IIA References:

A right-to-audit clause in a contract allows an organization to review and assess the operations, controls, and security measures of a third-party service provider (such as payroll service providers). Providing "read-only" functionalities supports this clause by enabling internal auditors to access and review relevant data without modifying it.
Read-only access allows auditors to verify transactions, data integrity, and compliance without affecting system operations.
This ensures that internal audit functions can review third-party controls without interference, supporting contractual audit rights.
The IIA's Standard 2070 - External Service Provider Relationships states that organizations should retain the right to audit outsourced functions to ensure compliance with internal control policies.
B). This will enforce robust risk assessment practices # Incorrect. While read-only access can contribute to risk assessment, it does not directly enforce risk management policies.
C). This will address cybersecurity considerations and concerns. # Incorrect. Cybersecurity concerns involve encryption, authentication, and intrusion detection-not just read-only access.
D). This will enhance the third party's ability to apply data analytics # Incorrect. The request is for audit purposes, not to improve the third party's analytics capabilities.
IIA's Global Technology Audit Guide (GTAG) 7: IT Outsourcing recommends a right-to-audit clause in third- party agreements.
IIA Standard 1312 emphasizes that external audits should have transparent access to outsourced functions.
ISACA's COBIT Framework highlights the importance of audit access in managing third-party risks.
Why Option A is Correct?Explanation of the Other Options:IIA References & Best Practices:Thus, the correct answer is A. This will support execution of the right-to-audit clause.

When developing the annual internal audit plan, the CAE must consider input from senior management, the board, and other internal assurance providers to ensure coordination and avoid duplication of efforts. While operational management, external auditors, and the CEO may also provide input, IIA Standards emphasize coordination with internal assurance providers as a mandatory step.
Reference:
IIA Standards - Standard 2050: Coordination and Reliance.

Understanding The IIA's Three Lines Model:
The Three Lines Model defines responsibilities for risk management and control across different organizational functions:
First Line: Operational management (owns and manages risks).
Second Line: Risk and compliance functions (monitors and facilitates risk management).
Third Line: Internal audit (provides independent assurance).
Why Third-Party and Supplier Assessments Are Shared Across All Three Lines:
First Line (Operational Teams & IT Security): Ensures that vendors comply with security standards.
Second Line (Risk & Compliance Teams): Conducts due diligence and ensures compliance with cybersecurity regulations.
Third Line (Internal Audit): Independently evaluates supplier risk management processes.
Why Other Options Are Less Relevant:
B). Recruitment and retention of certified IT talent - Primarily a first-line management responsibility (HR and IT departments).
C). Classification of data and design of access privileges - Typically a first-line IT security function, with oversight from the second line.
D). Creation and maintenance of secure network configurations - Falls under first-line IT operations with oversight but not shared by all three lines.
IIA's Three Lines Model (2020 Update): Emphasizes shared responsibilities in areas like third-party risk.
IIA Practice Guide on Third-Party Risk Management: Internal audit must assess supplier security and compliance.
COSO ERM Framework: Highlights vendor risk management as a cross-functional responsibility.
Relevant IIA References:# Final Answer: Assessments of third parties and suppliers (Option A).