Comprehensive and Detailed In-Depth Explanation:
Allowing external devices to access proprietary systems introduces compliance risks, as these devices may not meet the organization's security, data protection, and regulatory standards.
Option B (Privacy) - Important but does not fully capture the risk of unauthorized access or non-compliance with security protocols.
Option C (Strategic) - Strategic risks relate to business direction, not security concerns with third-party access.
Option D (Physical security) - Physical risks involve device theft, which is secondary to compliance when granting access.
Since compliance violations can lead to regulatory penalties and data breaches, Option A (Compliance) is the correct answer.
Reference: IIA IT Risk & Compliance Frameworks - BYOD Policies

Comprehensive and Detailed In-Depth Explanation:
A Project Management Information System (PMIS) is a centralized tool used throughout a project's planning, execution, and monitoring phases. It helps track schedules, costs, and risks.
Option A (EVM) - Used primarily in monitoring and control phases, not all three.
Option B (Organizational procedures) - Provides guidance but is not actively used in all project phases.
Option C (Performance measurement) - Important in monitoring, but not central to planning or execution.
Since PMIS is used throughout the project lifecycle, Option D is correct.
Reference: IIA Project Management - Tools & Techniques

When a bond is issued at a premium, the issuer receives more cash than the bond's face value. The bond payable is recorded as a liability, and the premium is also recorded as part of the carrying value of the liability. Because bonds are normally long-term financing instruments, the liability is generally classified as non-current unless due within one year. The premium is not revenue because issuing debt does not create operating income. It is not an expense at issuance; interest expense is recognized over time using amortization. Current assets are debited for cash received, but the question asks what entry results from the premium bond issuance. The best listed answer is a credit to non-current liabilities. Therefore, Option A is correct.

Authentication is the process of confirming that a user is who they claim to be. It normally involves identification, such as entering a user ID, and verification or validation through credentials such as passwords, tokens, biometrics, or certificates. Authorization is different. Authorization determines what an authenticated user is allowed to access or perform after identity has been confirmed. Confusing authentication with authorization is a basic access-control weakness. Internal audit should evaluate whether systems properly separate identity proofing, authentication, authorization, privilege management, and logging. Strong authentication alone is insufficient if authorization rules grant excessive access. Since authorization is not part of authentication itself, Option A is correct.

The CAE should first discuss the risk and its implications with the responsible management. This provides management the opportunity to reassess, take corrective action, or explain their position. If the issue remains unresolved and the risk is still deemed excessive, then escalation to senior management or the board may follow.
Option A (designing response) is management's role. Option C (scheduling an audit) may be relevant later, but immediate discussion is the first step. Option D is premature without first engaging management.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.