A computer-assisted technique is the most helpful method for an IS auditor to determine whether duplicate vendor payments exist on a complex system with a high volume of transactions. A computer-assisted technique is a tool or procedure that can be used to perform audit tests or procedures on data stored in electronic form. Examples of computer-assisted techniques include data analysis software, query tools, scripting languages, and specialized audit software. A computer-assisted techniquecan help an IS auditor to identify and extract duplicate payments from a large data set, perform calculations and comparisons, and generate reports and summaries. A computer-assisted technique can also provide more accuracy, efficiency, and coverage than manual methods.
Stratified sampling, statistical sampling, and process walk-through are not as helpful as a computer-assisted technique for this purpose. Stratified sampling is a sampling method that divides the population into subgroups based on certain characteristics and selects samples from each subgroup. Statistical sampling is a sampling method that uses probability theory to determine the sample size and selection criteria. Process walk- through is a review technique that involves following a transaction or process from start to finish and observing the inputs, outputs, controls, and documentation. These methods may be useful for other audit objectives, but they are not as effective as a computer-assisted technique for detecting duplicate payments in a complex and high-volume system. References: ISACA Frameworks: Blueprints for Success, [ISACA Glossary of Terms]

Capacity management tools are primarily used to ensure that available resources are used efficiently and effectively to meet the current and future demands of the business. Capacity management tools can help monitor, analyze and optimize the performance and utilization of IT resources such as CPU, memory, disk, network, etc. The other options are not the primary purpose of capacity management tools, although they may be related or derived from them. References:
* ISACA, CISA Review Manual, 27th Edition,chapter 4, section 4.32
* ISACA, COBIT 2019 Framework: Introduction and Methodology, section 3.2

Implementing an email containerization solution on personal devices is the best recommendation for an IS auditor, because it allows the organization to separate and secure the email data from the rest of the device data. Email containerization creates a virtual environment that encrypts andisolates the email data, preventing unauthorized access, leakage, or loss of sensitive information12. Requiring passwords or antivirus protection on personal devices may not be sufficient or enforceable, while prohibiting employees from storing companyemail onpersonal devices may not be feasible or practical. References: 1: CISA Review Manual (DigitalVersion), Chapter 5, Section 5.4.3 2: CISA Online Review Course, Module 5, Lesson 4

The greatest concern for an IS auditor reviewing contracts for licensed software that executes a critical business process is that software escrow was not negotiated. Software escrow is an arrangement where a third- party holds a copy of the source code and documentation of a licensed software in a secure location. The software escrow agreement specifies the conditions under which the licensee can access the escrowed materials, such as in case of bankruptcy, termination, or breach of contract by the licensor. Software escrow is important for ensuring the continuity and availability of a critical business process that depends on a licensed software. Without software escrow, the licensee may face significant risks and challenges in maintaining, modifying, or recovering the software in case of any disruption or dispute with the licensor. References:
* CISA Review Manual (Digital Version)
* CISA Questions, Answers & Explanations Database