Data disposal controls are the measures that ensure that data are securely and permanently erased or destroyed when they are no longer needed or authorized to be retained. Data disposal controls support business strategic objectives by reducing the risk of data breaches, complying with dataprivacy regulations, optimizing the use of storage resources, and enhancing the reputation and trust of the organization1.
A media sanitization policy is a document that defines the roles, responsibilities, procedures, and standards for sanitizing different types of media that contain sensitive or confidential data. Media sanitization is the process of removing or modifying data on a media device to make it unreadable or unrecoverable by any means. Media sanitization can be achieved by various methods, such as overwriting, degaussing, encryption, or physical destruction2.
A media sanitization policy would provide an IS auditor with the greatest assurance that data disposal controls support business strategic objectives because it demonstrates that the organization has a clear and consistent approach to protect its data from unauthorized access or disclosure throughout the data life cycle. Amedia sanitization policy also helps the organization to comply with various data privacy regulations, such as the EU General Data Protection Regulation (GDPR), the US Health Insurance Portability and Accountability Act (HIPAA), or the Payment Card Industry Data Security Standard (PCI DSS), that require proper disposal of personal or sensitive data3.
The other options are not as effective as a media sanitization policy in providing assurance that data disposal controls support business strategic objectives. A media recycling policy is a document that defines the criteria and procedures for reusing media devices that have been sanitized or erased. A media recycling policy can help the organization to save costsand reduce environmental impact, but it does not address how the data are disposed of in the first place4. A media labeling policy is a document that defines the rules and standards for labeling media devices that contain sensitive or confidential data. A media labeling policy can help the organization to identify and classify its data assets, but it does not specify how the data are sanitized or destroyed when they are no longer needed. A media shredding policy is a document that defines the methods and procedures for physically destroying media devices that contain sensitive or confidential data. A media shredding policy can be a part of a media sanitization policy, but it is not sufficient to cover all types of media devices or data disposal scenarios.
References:
* ISACA, CISA Review Manual, 27th Edition, 2019
* ISACA, CISA Review Questions, Answers & Explanations Database - 12 Month Subscription
* Secure Data Disposal and Destruction: 6 Methods to Follow1
* Why (and How to) Dispose of Digital Data2
* What is Data Disposition? The Complete Guide3
* Data Disposition: What is it and why should it be part of your data retention policy?

Risk management techniques should be included in an IS development methodology. An IS development methodology is a set of guidelines, standards, and procedures that provide a structured and consistent approach to developinginformation systems. A good IS development methodology should cover all the phases of the system development life cycle (SDLC), from planning and analysis to design, implementation, testing, and maintenance1.
Risk management techniques are an essential part of an IS development methodology, as they help to identify, assess, prioritize, mitigate, monitor, and communicate the risks that may affect the success of the system development project. Risk management techniques can also help to ensure that the system meets the requirements and expectations of the stakeholders, complies with the relevant laws and regulations, and delivers value to the organization2.
The other options are not as relevant or appropriate as risk management techniques for an IS development methodology. Value-added activity analysis is a technique for evaluating the efficiency and effectiveness of business processes, but it is not specific to IS development3. Access control rules are policies and mechanisms for restricting or granting access to information systems and resources, but they are more related to security management than IS development4. Incident management techniques are methods for handling and resolving incidents that disrupt the normal operation of information systems and services, but they are more related to service management than IS development5.
References:
ISACA, CISA Review Manual, 27th Edition, 2019, p. 1911
ISACA, CISA Review Manual, 27th Edition, 2019, p. 1942
Value-Added Activity Analysis3
Access Control Rules4
Incident Management Techniques5

The primary reason for an IS auditor to conduct post-implementation reviews is to determine whether project objectives in the business case have been achieved. A post-implementation review is an audit activity that evaluates whether a project has delivered its expected outcomes or benefits in accordance with its objectives, scope, budget, and schedule. A business case is a document that defines and justifies the need, value, and feasibility of a project. A post-implementation review can help assess whether project objectives in the business case have been achieved by comparing actual results with planned expectations and identifying any gaps or deviations. The other options are not primary reasons for conducting post-implementation reviews, as they do not measure whether project objectives in the business case have been achieved. Ensuring key stakeholder sign-off has been obtained is a project closure activity that confirms that all project deliverables have been completed and accepted by key stakeholders, but it does not evaluate whether project objectives in the business case have been achieved. Aligning project objectives with business needs is a project initiation activity that ensures that the project is aligned with the organization's strategy, goals, and priorities, but it does not evaluate whether project objectives in the business case have been achieved. Documenting lessons learned to improve future project delivery is a project learning activity that captures and shares the knowledge, experience, and feedback gained from the project, but it does not evaluate whether project objectives in the business case have been achieved. References: CISA Review Manual (Digital Version), Chapter 3, Section 3.3