The best control to help reduce the risk of fraudulent internal transactions in several business applications is the segregation of duties. Segregation of duties is the principle of dividing the roles and responsibilities of different individuals or groups involved in a business process or an IT service, so that no one person or group has complete control over the entire process or service. Segregation of duties can help to prevent or detect fraud, errors, conflicts of interest, or misuse of resources, by ensuring that there are checks and balances, and that there is adequate oversight and accountability. Segregation of duties can also help to reduce the risk of collusion, compromise, or coercion among the internal staff, by limiting their access and authority to the business applications and data. Periodic user privileges review, log monitoring, and periodic internal audits are also useful controls, but they are not as effective as segregation of duties, as they are reactive and detective measures, rather than proactive and preventive measures. References = CRISC Review Manual, 6th Edition, ISACA, 2015, page 217.

The best way to measure the effectiveness of the subsidiary's IT systems controls is to review metrics and key performance indicators (KPIs), as they provide quantitative and qualitative measures of the performance and outcomes of the IT systems and processes, and how well they meet the predefined standards and expectations. Metrics and KPIs can help to evaluate the efficiency, reliability, security, and quality of the IT systems and controls, and to identify any gaps, weaknesses, or issues that need to be addressed. Metrics and KPIs can also help to compare and benchmark the subsidiary's IT systems and controls with those of the parent organization or other similar entities. The other options are not the best ways to measure the effectiveness of the subsidiary's IT systems controls, although they may be useful or complementary methods.
Implementing IT systems in alignment with business objectives is a good practice, but it does not measure the effectiveness of the IT systems controls, as it focuses on the alignment and integration of the IT systems with the business strategy and goals. Reviewing design documentation of IT systems can provide some information on the specifications and requirements of the IT systems, but it does not measure the effectiveness of the IT systems controls, as it does not reflect the actual implementation and operation of the IT systems. Evaluating compliance with legal and regulatory requirements can ensure that the subsidiary's IT systems and controls meet the minimum standards and obligations of the foreign country, but it does not measure the effectiveness of the IT systems controls, as it does not consider the performance and outcomes of the IT systems and processes. References = Risk and Information Systems Control Study Manual, Chapter 5: Risk and Control Monitoring and Reporting, page 187.

The Recovery Time Objective (RTO) is the maximum acceptable length of time that a system can be down after a failure or disaster. Determining the RTO involves assessing the cost of downtime and its impact on business operations to ensure that recovery strategies are cost-effective and aligned with business needs.
Reference:ISACA CRISC Review Manual, 7th Edition, Chapter 3: Risk Response and Reporting, Section:
Business Continuity and Disaster Recovery.

An IT policy is a document that defines the rules, standards, and procedures for the use, management, and security of IT resources within an organization. An IT policy should be aligned to the business requirements, which are the needs, expectations, and objectives of the business stakeholders, such as customers, employees, managers, partners, regulators, etc. An IT policy that is aligned to the business requirements can help support the business strategy, improve the business performance, and enhance the business value. A key performance indicator (KPI) is a metric that measures the achievement of a specific goal or objective. A KPI should be relevant, measurable, achievable, realistic, and time-bound. The best KPI for determining how well an IT policy is aligned to the business requirements is the number of exceptions to the policy. An exception to the policy is a deviation or violation of the policy rules, standards, or procedures, which may be intentional or unintentional, authorized or unauthorized, justified or unjustified. The number of exceptions to the policy can indicate how well the policy is understood, communicated, implemented, and enforced within the organization. The number of exceptions to the policy can also indicate how well the policy reflects the current and future business needs and expectations, and how flexible and adaptable the policy is to the changing business environment. A low number of exceptions to the policy can suggest that the policy is well aligned to the business requirements, while a high number of exceptions to the policy can suggest that the policy is misaligned or outdated, and may need to be reviewed or revised. References = Key Performance Indicator (KPI): Definition, Types, and Examples, Business KPIs: 5 important characteristics to be effective, What is a KPI? How To Choose the Best KPIs for Your Business - HubSpot Blog.

The most important factor to identify when developing top-down risk scenarios is B. Business objectives12 Top-down risk scenarios are based on the organization's strategic goals, objectives, and key performance indicators (KPIs), and they aim to identify the potential events or situations that could prevent or hinder the achievement of those goals and objectives12 By identifying the business objectives, the risk practitioner can align the risk scenarios with the organization's mission, vision, and values, and ensure that the risk scenarios are relevant, realistic, and meaningful for the senior management and other stakeholders12 The other factors are not as important as the business objectives when developing top-down risk scenarios, because they are either more relevant for bottom-up risk scenarios (A and D), or they are derived from the business objectives and the risk scenarios 12