During the tender process and contracting stage of IT outsourcing, the organization must ensure that vendor selection, service specifications, pricing, service levels, responsibilities, and contractual terms align with organizational strategy. If the outsourcing arrangement is not aligned with business objectives, the selected provider may deliver services that are technically acceptable but strategically unsuitable. Option A relates more to ongoing optimization after outsourcing has been implemented. Option C is an operational delivery risk that appears after service performance begins. Option D may occur during execution or transition, but it is not the central tender and contracting risk. Internal audit should review tender governance, evaluation criteria, contract terms, service-level agreements, exit clauses, and strategic alignment. Therefore, Option B is correct.

Reference: IIA Business Knowledge for Internal Auditing, Organizational Structure Risks section.

When disagreements occur regarding risk management or audit findings, the CAE should first escalate the matter within management levels to attempt resolution. Only if the disagreement remains unresolved after discussion with senior management should the CAE report the matter to the board or audit committee.
Options B and C are premature: the charter does not grant internal audit supremacy over management's decisions, and documenting disagreement in the audit report should occur only after reasonable attempts at resolution. Option A (escalating immediately to the board) should occur only if discussion with management does not resolve the issue.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.

Outsourced processes remain part of the audit universe because the organization retains accountability for risks, compliance, reporting, and service outcomes. The most accurate statement is that key controls are typically more difficult to audit because they are designed and managed externally. Internal audit may need service organization control reports, contractual audit rights, vendor evidence, site visits, management monitoring reports, or third-party assurance. Option A is wrong because outsourcing does not transfer accountability away from the organization. Option B is not generally true; independence is not automatically improved by outsourcing. Option D may be true in some cases, but it is not a general rule. Internal audit should ensure outsourced controls are visible, testable, and contractually enforceable. Therefore, Option C is correct.

* Strong Security Governance Requires Well-Defined Policies:
* Cybersecurity governance is built upon clear, documented, and enforceable security policies that outline expectations, roles, responsibilities, and processes.
* Policies define acceptable behaviors, security controls, incident response, and compliance requirements.
* IIA Standard 2110 - Governance: Requires organizations to establish effective IT security governance, including policies that address cybersecurity risks.
* IIA GTAG (Global Technology Audit Guide) on Information Security Governance:
* Recommends that clear policies should guide security controls, user access, and incident response to address cybersecurity threats.
* A. Inventory of information assets (Incorrect)
* While identifying critical information assets is essential for risk management, it does not constitute security governance on its own.
* Asset inventories support governance but must be reinforced by policies that define how data should be protected.
* B. Limited sharing of data files with external parties (Incorrect)
* Restricting data sharing is a control measure, not a governance principle.
* Policies define when, how, and under what conditions data can be shared securely.
* C. Vulnerability assessment (Incorrect)
* Assessments help identify security gaps but do not establish governance.
* Effective governance ensures that vulnerabilities are identified, prioritized, and remediated in accordance with policies.
Explanation of Answer Choice D (Correct Answer):Explanation of Incorrect Answers:Conclusion:To ensure strong security governance, organizations must have clearly defined security policies (Option D) as a foundation for managing cybersecurity threats.
IIA References:
* IIA Standard 2110 - Governance
* IIA GTAG - Information Security Governance