A core feature of blockchain technology is immutability-once data is recorded, it cannot be altered or deleted. While this supports integrity and transparency, it also creates a conflict with data privacy regulations such as the General Data Protection Regulation (GDPR), which grants individuals the "right to be forgotten." The inability to erase personal data stored on blockchain creates a compliance challenge.
Options A and B are incorrect: phishing is not inherent to blockchain, and transactions are not easily tampered with (immutability actually prevents that). Option C is misleading because regulations address data use but do not "overregulate" blockchain specifically.
Reference:
IIA Global Technology Audit Guide (GTAG): Understanding Blockchain and Related Risks.

An overstatement of ending inventory directly affects assets and income, not liabilities. If ending inventory is overstated, total assets are overstated, cost of goods sold is understated, and net income is overstated.
Retained earnings may also be overstated through the income effect. However, accounts payable, accrued liabilities, debt, and other liabilities are not directly changed by the inventory valuation error. Option D is incorrect because inventory errors affect both the balance sheet and income statement, not only the income statement. Internal auditors reviewing inventory should understand how count errors, valuation errors, and cutoff errors affect financial statements. Since liabilities are not directly affected by overstated ending inventory, Option A is correct.

Treasury stock transactions are equity transactions, not income statement transactions. The organization originally acquired the treasury shares at $10 per share, so the treasury stock cost is $10,000. When it sells
1,000 shares at $15 per share, it receives cash of $15,000 and removes treasury stock at its $10,000 cost. The excess of $5,000 is credited to additional paid-in capital from treasury stock transactions. It is not recorded as a gain because treasury stock transactions do not create income. Option B is incorrect because treasury stock should be credited, not debited, when reissued. Option D is also incorrect. Therefore, Option C is correct.

Effective change management ensures that IT changes (such as software updates, system modifications, or infrastructure upgrades) are well-controlled, minimizing disruptions. Poor change management leads to instability, inefficiencies, and operational risks.
Unplanned Downtime (2) - Indicates that changes are being implemented without proper testing or failover planning, disrupting business operations.
Excessive Troubleshooting (3) - Suggests that changes are causing recurring issues, leading to increased workload for IT support teams.
Unavailability of Critical Services (4) - Highlights that change-related failures are affecting essential business functions, indicating improper risk assessment.
While inadequate control design is a general IT risk, it is not a direct indicator of poor change management.
Instead, it relates more to weaknesses in IT governance and security frameworks.
IIA's GTAG (Global Technology Audit Guide) on Change Management - Identifies unplanned downtime, excessive troubleshooting, and service unavailability as key red flags of poor change management.
COBIT 2019 (Governance and Management of IT) - Emphasizes structured change management to minimize disruptions.
ITIL Change Management Framework - Highlights these issues as symptoms of ineffective change control.
Why 2, 3, and 4 Are Indicators of Poor Change Management?Why Not Option 1 (Inadequate Control Design)?
IIA References:# Final Answer: D. 2, 3, and 4 only.

External auditors may rely on internal audit's work if they evaluate the objectivity, competence, and quality of the internal audit function. If satisfied, they may use internal audit work to support their opinion, reducing duplication.
Option A is incorrect because external auditors do not manage internal audit. Option B is too restrictive, as reliance is allowed under auditing standards. Option D is false because internal audit can share relevant work with external auditors.
Reference:
IIA Standards - Standard 2050: Coordination and Reliance; ISA 610 (Using the Work of Internal Auditors).