Section: Volume D
Explanation:
Business alignment require following control activities:
* Defining the business requirements for the management of data by IT.
* Periodically identifying critical data that affect business operations, in alignment with the risk management model and IT service as well as the business continuity plan.
Incorrect Answers:
B: Conducting IT continuity tests on a regular basis or when there are major changes in the IT infrastructure is done for testing IT continuity plan. It does not ensure alignment with business.
D: This is not a valid answer.

Explanation/Reference:
Explanation:
Security log monitoring, Post-implementation reviews of program changes, and Problem management provide indirect information. Security log monitoring provide indirect information about certain controls in the security environment, particularly when used to analyze the source of failed access attempts.
Post-implementation reviews of program changes provide indirect information about the effectiveness of internal controls over the development process.
Problem management provide indirect information about the effectiveness of several different IS processes that may ultimately be determined to be the source of incidents.
Incorrect Answers:
D: Recovery testing is the direct evidence that the redundancy or backup controls work effectively. It doesn't provide any indirect information.

Code review could BEST detect an in-house developer inserting malicious functions into a web-based application, because it is a process that involves examining and verifying the source code of the application for any errors, vulnerabilities, or malicious functions. Code review can help to identify and remove any unauthorized or harmful code that the developer may have inserted, either intentionally or unintentionally, and to ensure that the application meets the quality and security standards and requirements. The other options are not as effective as code review, because:
* Option A: Segregation of duties is a control that involves separating the roles and responsibilities of the developer from those of the tester, the approver, and the deployer, to prevent any conflict of interest or misuse of authority. Segregation of duties can help to reduce the risk of the developer inserting malicious functions into the web-based application, but it does not detect them.
* Option C: Change management is a process that involves controlling and documenting any changes to the web-based application, such as new features, enhancements, or bug fixes, to ensure that they are authorized, tested, and approved. Change management can help to track and monitor the changes that the developer may have made to the web-based application, but it does not detect the malicious functions.
* Option D: Audit modules are components that are embedded in the web-based application to record and report the activities and transactions that occur within the application, such as user login, data input, or data output. Audit modules can help to audit and review the performance and functionality of the web-based application, but they do not detect the malicious functions. References = Risk and Information Systems Control Study Manual, 7th Edition, ISACA, 2020, p. 214.