Liquidity refers to an organization's ability to meet short-term obligations as they come due. The current ratio is a standard liquidity measure calculated as current assets divided by current liabilities. It helps indicate whether the organization has sufficient short-term resources to cover short-term debts. Earnings per share measures profitability attributable to shareholders, not liquidity. Asset turnover measures efficiency in using assets to generate sales. Net income measures profitability but does not necessarily show whether cash or current assets are available to meet immediate obligations. Internal auditors reviewing liquidity should consider current ratio, quick ratio, working capital, cash conversion cycle, receivable collection, inventory movement, and short-term borrowing. Therefore, Option D is correct.

In a declining industry, demand is shrinking, growth opportunities are limited, and organizations usually face margin pressure, excess capacity, and intensified competition for remaining customers. The most appropriate strategy is cost control. Management should protect cash flow, eliminate inefficiencies, reduce discretionary spending, rationalize capacity, and focus on profitable customer segments. Heavy investment in marketing or research and development may not be justified unless the organization has a clear niche or renewal strategy.
Shifting toward mass production is also inappropriate because declining demand makes large-scale production risky and may create excess inventory. Internal audit should evaluate whether management's strategy matches industry conditions and whether cost controls preserve value without weakening critical controls. Therefore, Option C is correct.

Strategic Initiatives and Their Drivers:
Organizations create and prioritize new strategic initiatives based on internal and external factors that affect their success.
Threats and opportunities, identified through strategic planning and risk assessment, are the primary drivers for launching new initiatives.
This aligns with the SWOT (Strengths, Weaknesses, Opportunities, Threats) analysis framework, which helps organizations identify external risks and growth opportunities.
Why Threats and Opportunities Drive Strategic Initiatives:
Opportunities: Organizations may invest in new products, markets, or technologies to capitalize on emerging trends and gain a competitive edge.
Threats: External challenges such as regulatory changes, market competition, and economic downturns necessitate proactive strategies to mitigate potential risks.
Why Other Options Are Incorrect:
A). Risk tolerance:
While risk tolerance defines an organization's willingness to accept risk, it is not the primary driver for creating new initiatives.
B). Performance:
Performance evaluation helps measure the success of initiatives, but it does not directly drive new strategies.
D). Governance:
Governance ensures oversight and compliance but does not initiate strategic changes unless influenced by external threats and opportunities.
IIA's Perspective on Strategic Planning and Risk Management:
IIA Standard 2010 - Planning states that internal auditors must assess how organizations identify and respond to threats and opportunities when developing strategic initiatives.
COSO Enterprise Risk Management (ERM) Framework highlights that strategic planning should integrate risk management, ensuring that organizations adapt to evolving external conditions.
IIA References:
IIA Standard 2010 - Planning
COSO Enterprise Risk Management (ERM) Framework
SWOT Analysis in Strategic Decision-Making
Thus, the correct and verified answer is C. Threats and opportunities.

Reference: IIA Business Knowledge for Internal Auditing, Data Analytics Types section.

The issue described suggests a systemic authorization flaw, where users gain unrestricted access once logged in. This points to an improperly configured authorization system, which should enforce role-based or least- privilege access to restrict users based on their job responsibilities.
(A) Incorrect - The authentication process relies on a simple password only, which is a weak method of authorization.
While weak authentication is a security risk, the issue described relates to excessive access permissions, not weak login credentials.
(B) Correct - The system authorization of the user does not correctly reflect the access rights intended.
The problem is that users have access to all functionality, which indicates an authorization issue, not an authentication flaw.
Proper role-based access controls (RBAC) should limit user permissions based on job functions.
(C) Incorrect - There was no periodic review to validate access rights.
While periodic reviews are important for detecting unauthorized access, the issue here is a system-level authorization design flaw rather than a failure in periodic reviews.
(D) Incorrect - The application owner apparently did not approve the access request during the provisioning process.
Even if an access request was approved incorrectly, the broader issue remains that all users have unrestricted access, which suggests a system misconfiguration rather than a single provisioning error.
IIA's GTAG (Global Technology Audit Guide) - Access Control and Authorization Emphasizes the need for role-based access control (RBAC) to prevent unauthorized access.
COBIT Framework - IT Security Governance
Discusses proper authorization mechanisms to align system access with business needs.
NIST Cybersecurity Framework - Access Management Controls
Recommends restricting access rights based on the principle of least privilege (PoLP).
Analysis of Answer Choices:IIA References and Internal Auditing Standards: