The acid-test (quick) ratio is a more dependable liquidity indicator than working capital because it excludes inventory, which may not be easily converted to cash in the short term. This ratio measures a company's ability to pay its short-term liabilities using only its most liquid assets (cash, marketable securities, and accounts receivable).
Formula for the Acid-Test Ratio:Acid-Test Ratio=Current Assets#InventoryCurrent Liabilities\text{Acid-Test Ratio} = \frac{\text{Current Assets} - \text{Inventory}}{\text{Current Liabilities}}Acid- Test Ratio=Current LiabilitiesCurrent Assets#Inventory This ratio is more reliable than working capital since it removes inventory, which may be difficult to liquidate quickly in financial distress.
* A. Acid-test (quick) ratio (Correct Answer) - This provides a stronger measure of liquidity because it excludes inventory, which might not be quickly converted to cash.
* B. Average collection period - This measures the efficiency of accounts receivable collections, but it does not directly measure overall liquidity.
* C. Current ratio - While this ratio is commonly used, it includes inventory, which can distort liquidity assessments if inventory is not easily sold.
* D. Inventory turnover - This measures how quickly inventory is sold, but it does not directly assess liquidity.
* IIA IPPF Standard 2130 - Control emphasizes liquidity monitoring as a key financial control.
* COSO ERM Framework - Financial Performance Measures discusses acid-test ratio as a critical liquidity metric.
* IFRS 7 - Financial Instruments Disclosures outlines the importance of liquidity risk assessments.
Explanation of Each Option:IIA References:

Internal failure costs arise from defects or inefficiencies discovered before products or services reach customers. A nonfinancial internal failure quality cost is an operational measure rather than a dollar- denominated loss. Excessive time to convert raw materials into finished goods indicates internal inefficiency, rework, delays, waste, or process quality weakness before delivery to the customer. Decreasing gross profit margin and foregone contribution margin are financial measures. Defective units shipped to customers are external failure costs because the defect reaches the customer and may create returns, warranty claims, complaints, or reputational damage. Internal auditors evaluating quality management should distinguish prevention, appraisal, internal failure, and external failure costs. Therefore, Option D is correct.

The four-level model for reviewing application controls follows a hierarchy:
* Level 1 - Activity: Smallest unit of work within a process.
* Level 2 - Subprocess: A collection of related activities that accomplish a part of the process.
* Level 3 - Major Process: A significant business function consisting of multiple subprocesses.
* Level 4 - Mega Process: The highest level, representing an end-to-end business process, often spanning multiple departments or systems.
* Mega processes encompass entire business functions (e.g., order-to-cash or procure-to-pay cycles).
* They involve multiple major processes and provide a high-level perspective on business operations.
* At level 4, the focus is on strategic alignment of IT application controls with enterprise-wide objectives.
* A. Activity - Too detailed and only represents individual tasks.
* B. Subprocess - A subset of a major process, not a high-level business function.
* C. Major Process - A significant function but not the highest-level view.
* IIA's GTAG on Business Process Controls - Recommends a hierarchical review model to assess IT application controls.
* COBIT 2019 (Governance and Management of IT) - Defines mega processes as enterprise-wide workflows.
* ISO 27001 Annex A.12 (Operational Security) - Highlights process-based security in IT controls.
Why "Mega Process" is the Correct Answer?Why Not the Other Options?IIA References:# Final Answer: D.
Mega process.

A router and a switch serve different functions in a network.
A router is responsible for connecting multiple networks together and directing data packets between them. It determines the best path for data to travel using IP addresses.
A switch, on the other hand, operates within a single network and connects devices like computers, printers, and servers. It uses MAC addresses to forward data within the local network (LAN).
A). A router operates at layer two, while a switch operates at layer three of the OSI model - Incorrect. A switch operates at Layer 2 (Data Link Layer), while a router operates at Layer 3 (Network Layer).
B). A router transmits data through frames, while a switch sends data through packets - Incorrect. Switches use frames at Layer 2, while routers use packets at Layer 3.
C). A router connects networks, while a switch connects devices within a network (Correct Answer) - This correctly differentiates their functions.
D). A router uses a media access control (MAC) address during the transmission of data, while a switch uses an internet protocol (IP) address - Incorrect. A switch uses MAC addresses, and a router uses IP addresses.
IIA GTAG 17 - Auditing IT Governance discusses network security and the role of routers and switches.
COBIT 2019 - DSS01 (Managed Operations) emphasizes secure and efficient network management.
NIST SP 800-53 - Security Controls for IT Systems includes guidelines on network architecture and device functionality.
Explanation of Each Option:IIA References:

An Intranet is a private network that is accessible only to an organization's personnel. It is used for internal communication, data sharing, and collaboration while ensuring security and restricted access.
Let's analyze each option:
Option A: An extranet
Incorrect. An extranet extends an organization's internal network to external parties such as vendors, suppliers, or business partners. Since the organization wants to allow access only to its personnel, an extranet is not the right choice.
Option B: A local area network (LAN)
Incorrect. While a LAN is a network within a limited geographic area (such as an office), it does not necessarily restrict access only to personnel. Additionally, an intranet operates over a LAN but includes access controls and authentication mechanisms.
Option C: An Intranet
Correct. An intranet is specifically designed for internal use, allowing employees to securely share documents, collaborate, and access internal resources. Organizations can implement access control mechanisms to restrict access to authorized personnel only.
IIA Reference: Internal auditors assess IT security to ensure that internal networks (such as intranets) have appropriate access restrictions to protect sensitive data. (IIA GTAG: Auditing IT Networks) Option D: The internet Incorrect. The internet is a public network that does not restrict access. Using the internet for internal communication would expose sensitive data to external threats.
Thus, the verified answer is C. An Intranet.