According to the ISACA CISA documentation, one of the requirements for internal audit quality assurance (QA) and continuous improvement processes is to have an external assessment at least once every five years by a qualified, independent reviewer or review team from outside the organization1. This is to ensure that the internal audit activity conforms to the International Standards for the Professional Practice of Internal Auditing (the Standards) and the Code of Ethics, and to identify opportunities for improvement2. Therefore, the lack of periodic engagement with external assessors would present the greatest concern during a review of internal audit QA and continuous improvement processes.

A vendor requires privileged access to a key business application. The best recommendation to reduce the risk of data leakage is to implement real-time activity monitoring for privileged roles. This is because real-time activity monitoring can provide visibility and accountability for the actions performed by the vendor with privileged access, such as creating, modifying, deleting, or copying data. Real-time activity monitoring can also enable timely detection and response to any unauthorized or suspicious activities that may indicate data leakage. Including the right-to-audit in the vendor contract is a good practice, but it may not be sufficient to prevent or detect data leakage in a timely manner, as audits are usually performed periodically or on-demand.
Performing a review of privileged roles and responsibilities is also a good practice, but it may not address the specific risk of data leakage by the vendor with privileged access. Requiring the vendor to implement job rotation for privileged roles may reduce the risk of collusion or fraud, but it may not prevent or detect data leakage by any individual with privileged access. References: CISA Review Manual (Digital Version),
[ISACA Privacy Principles and Program Management Guide]

Digital watermarks are hidden marks or codes that can be embedded into digital files, such as images, videos, audio, or documents. They can be used to identify the source, owner, or authorized user of the data, as well as to track any unauthorized copying or distribution of the data. Digital watermarks can help prevent data leakage by deterring potential leakers from sharing sensitive data or by providing evidence of data leakage if it occurs.
The other options are not as effective as digital watermarks in preventing data leakage. Ensuring that paper documents are disposed securely can reduce the risk of physical data leakage, but it does not address the digital data leakage that is more prevalent in today's environment. Implementing an intrusion detection system (IDS) can help detect and respond to cyberattacks that may cause data leakage, but it does not prevent data leakage from insiders or authorized users who have legitimate access to the data. Verifying that application logs capture any changes made can help audit and investigate data leakage incidents, but it does not prevent them from happening in the first place.
References:
* What is Data Leakage?
* What is Digital Watermarking?

An acceptable use policy (AUP) is a preventive control that sets out rules and guidelines for using an organization's IT resources, including networks, devices, and software1. It defines acceptable and prohibited behaviors, aiming to protect assets, ensure security, and maintain a productive work environment1. By agreeing to and documenting an AUP for the equipment, both organizations can prevent potential misuse of IT resources2345.
References:
ISO 27001 Acceptable Use Policy Beginner's Guide - High Table
Acceptable Use Policy for Information Technology Resources
Acceptable Use Policies for Workplace Technology | Verizon
IT Governance: Your Must-Have Policies - How-To Geek
Acceptable use policy template - Workable

Segregation of duties (SOD) is a core internal control and an essential component of an effective risk management strategy. SOD emphasizes sharing the responsibilities of key business processesby distributing the discrete functions of these processes to multiple people and departments, helping to reduce the risk of possible errors and fraud1.
SOD is especially important in IT security, where granting excessive system access to one person or group can lead to harmful consequences, such as data breaches, identity theft, or bypassing security controls2. SOD breaks IT-related tasks into four separate function categories: authorization, custody, recordkeeping, and reconciliation1. Ideally, no one person or department holds responsibility in multiple categories.
In a role-based environment, where access privileges are granted based on predefined roles, it is important to ensure that the roles are designed and assigned in a way that supports SOD. For example, the person who develops an application should not also be the one who tests it, deploys it, or maintains it.
Therefore, an application developer should not be assigned the roles of IT operator, system administration, or database administration, as these roles may conflict with their development role and create opportunities for misuse or abuse of the system. The only role that may be assigned to an application developer without violating SOD is emergency support, which is a temporary role that allows the developer to access the system in case of a critical issue that requires immediate resolution3. However, even this role should be granted with caution and monitored closely to ensure compliance with SOD policies.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, page 2824
ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription, QID 1066692 Hyperproof Blog, Segregation of Duties: What it is and Why it's Important1 Advisera Blog, Segregation of duties in your ISMS according to ISO 27001 A.6.1.23