Detecting an inventory fraud scheme requires analyzing patterns of inventory adjustments, particularly across different locations. Fraudulent activities often involve unauthorized write-offs, stock transfers, or misstatements of inventory levels.
(A) Analyze invoice payments just under individual authorization limits.
Incorrect: This technique is useful for detecting procurement fraud or invoice splitting, but not directly related to inventory fraud.
(B) Analyze stratification of inventory adjustments by warehouse location. (Correct Answer) Fraudulent inventory write-offs often occur in specific warehouses or locations where controls are weak.
Stratifying inventory adjustments helps identify abnormal patterns, such as excessive losses in one location.
IIA Standard 2120 (Risk Management) recommends data analytics and trend analysis to detect anomalies.
COSO ERM - Control Activities emphasizes monitoring and review of inventory adjustments to prevent fraud.
(C) Analyze inventory invoice amounts and compare with approved contract amounts.
Incorrect: This technique is effective for detecting overbilling or procurement fraud, but not inventory fraud, which involves physical stock manipulation.
(D) Analyze differences discovered during duplicate payment testing.
Incorrect: Duplicate payment testing helps uncover billing fraud, not inventory fraud.
IIA Standard 2120 - Risk Management: Encourages fraud detection through trend analysis and data monitoring.
IIA Practice Guide - Auditing Inventory Management: Suggests stratification of inventory adjustments to identify fraud.
COSO ERM - Control Activities: Recommends monitoring inventory transactions to prevent fraud.
Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because analyzing stratification of inventory adjustments by warehouse location helps detect irregular patterns indicative of fraud.

Malware Defense as a Cybersecurity Monitoring Activity:
Malware defense refers to the use of antivirus software, endpoint detection and response (EDR), behavior analysis, and real-time monitoring to detect and block malicious code before it can be installed on an organization's systems.
It helps prevent infections from viruses, ransomware, spyware, trojans, and worms that can disrupt business operations.
IIA GTAG (Global Technology Audit Guide) on Cybersecurity states that monitoring tools should proactively detect and neutralize threats before they can execute malicious actions.
A). Boundary defense (Incorrect)
Boundary defense includes firewalls, intrusion detection/prevention systems (IDS/IPS), and network segmentation, which control external access but do not directly monitor and remove malware.
Malware can still enter through phishing emails, infected USB drives, or compromised internal systems.
C). Penetration tests (Incorrect)
Penetration tests simulate attacks to identify vulnerabilities, but they do not actively monitor and prevent malware from being installed.
They help improve security but are not a continuous monitoring activity.
D). Wireless access controls (Incorrect)
Wireless security helps prevent unauthorized network access, but it does not specifically monitor and block malware installation.
Malware can still spread via legitimate access points, infected devices, or phishing attacks.
Explanation of Answer Choice B (Correct Answer):Explanation of Incorrect Answers:Conclusion:To deter disruptive codes (malware) from being installed, organizations should implement continuous malware defense (Option B), including antivirus software, endpoint security, and behavioral analytics.
IIA References:
IIA GTAG - Cybersecurity
IIA Standard 2120 - Risk Management

Vertical integration occurs when an organization expands into earlier or later stages of its value chain, such as acquiring suppliers or distributors. A major disadvantage is reduced flexibility to change partners. Once the organization owns or controls a supply or distribution stage, it may be locked into specific technologies, capacity levels, cost structures, or operational relationships. Option B is less convincing because vertical integration often reduces supplier or buyer bargaining power. Option C is not generally true because integration may support differentiation through quality or supply control. Option D is also incorrect because vertical integration may increase control over proprietary knowledge. Internal audit should assess integration risks, including fixed-cost exposure, reduced flexibility, and operational complexity. Therefore, Option A is correct.

When an organization outsources network and data management to a third party, the first step in risk management is to ensure that the contractual agreement includes strong governance provisions, including:
Regular vendor control reports to monitor security and performance.
A right-to-audit clause, allowing the organization to periodically assess compliance and security controls.
Correct Answer (B - Drafting a Strong Contract with Vendor Control Reports & Right-to-Audit Clause) IIA Practice Guide: Auditing Third-Party Risk Management recommends that contracts with vendors include clear security expectations, reporting requirements, and audit rights.
A right-to-audit clause allows internal auditors to verify compliance with security policies.
Vendor control reports (e.g., SOC 2 reports) provide assurance that the vendor meets security and compliance standards.
Why Other Options Are Incorrect:
Option A (Creating a comprehensive reporting system for vendors):
While useful, a reporting system alone is not the first step-it should be included after contractual protections are in place.
Option C (Applying administrative privileges to ensure appropriate access controls):
This applies to internal access management but does not address third-party risk management.
Option D (Creating a cybersecurity committee):
A cybersecurity committee helps manage ongoing risks, but contractual controls are the first step in managing third-party risk.
IIA Practice Guide: Auditing Third-Party Risk Management - Recommends strong contracts with right-to- audit clauses.
GTAG 7: Information Technology Outsourcing - Discusses vendor risk management and contractual safeguards.
Step-by-Step Explanation:IIA References for Validation:Thus, the best first step is drafting a strong contract with vendor control reports and a right-to-audit clause (B).

Reference: IIA Business Knowledge for Internal Auditing, IT Operations section.