Subjective factors are based on judgment or opinion, whereas objective factors rely on measurable data. The quality of staff supervision is a judgment-based assessment, making it subjective.

Options A, C, and D are measurable, quantitative factors and thus objective.

At the end of an accounting period, certain accounts must be closed to prepare financial statements and reset balances for the next period. The accounts that must be closed are temporary accounts, which include all income statement accounts (revenues, expenses, and gains/losses).

Why Option A (Income statement accounts) is Correct:

Income statement accounts (revenues, expenses, gains, and losses) are temporary accounts that track financial performance for a specific period.

At the end of the period, these accounts are closed to the retained earnings account to reset them to zero for the next period.

Why Other Options Are Incorrect:

Option B (Balance sheet accounts):

Incorrect because balance sheet accounts (assets, liabilities, and equity) are permanent accounts that carry their balances forward to the next period.

Option C (Permanent accounts):

Incorrect because permanent accounts include all balance sheet accounts, which are never closed.

Option D (Real accounts):

Incorrect because real accounts refer to balance sheet accounts (assets, liabilities, and equity), which remain open.

IIA GTAG – " Auditing Financial Close Processes " : Discusses the closing of temporary accounts at the period end.

COSO Internal Control – Integrated Framework: Recommends proper financial reporting controls, including account closures.

IFRS & GAAP Accounting Standards: Define temporary and permanent accounts in financial reporting.

IIA References:Thus, the correct answer is A. Income statement accounts.

The first step in audit data analytics is to identify the business question or audit objective, the data required, and the expected result. Analytics should be driven by a risk, control, or business need, not by collecting data first and searching for something interesting. Once the audit question is defined, the auditor can determine data sources, fields, extraction scope, cleansing requirements, tests, and interpretation criteria. Training and resources are important, but they are capability enablers, not the first planning step for a specific audit. Obtaining as much data as possible is inefficient and may create privacy or relevance issues. Management approval is not the starting point for audit analytics. Therefore, Option C is correct.

Fingerprint identification has the lowest risk of inaccurate authentication among the listed options because it uses a biometric characteristic that is difficult to guess, share, or replicate compared with knowledge-based methods. Complex passwords can still be stolen, phished, reused, or written down. Signature verification can be subjective and vulnerable to forgery or poor capture quality. Personal security questions are often weak because answers may be discoverable through social media, public records, or personal knowledge. Biometric controls are not perfect and require proper enrollment, template protection, false acceptance monitoring, and privacy safeguards. However, in comparison with the other options, fingerprint identification provides stronger identity assurance. Therefore, Option A is correct.

Under absorption costing, all manufacturing costs are treated as product costs. This includes direct materials, direct labor, variable manufacturing overhead, and fixed manufacturing overhead. These costs are assigned to inventory and expensed as cost of goods sold when the goods are sold. Selling expenses, however, are not manufacturing costs. They are period costs and are expensed in the period incurred. Option B is incorrect because fixed manufacturing overhead is included in product cost under absorption costing. Options C and D are also product costs because they relate directly to manufacturing. Internal auditors reviewing costing systems should verify that product and period costs are classified properly, because misclassification affects inventory valuation and operating income. Therefore, Option A is correct.

A contract is closed out when all the contractual terms have been fully satisfied, including the completion of deliverables, final payments, and any post-contract evaluations or obligations.

Correct Answer (B - When all contractual obligations have been discharged)

According to contract management principles and IIA standards, a contract is officially closed out once:

All agreed-upon deliverables have been completed.

All payments and financial obligations are settled.

Final performance evaluations or audits are completed.

The contract is formally reviewed and documented for closure.

The IIA’s GTAG 3: Contract Management Framework supports that contract closure occurs after full performance and obligations are met.

Why Other Options Are Incorrect:

Option A (When there ' s a dispute between contracting parties):

Disputes do not necessarily close out a contract; instead, they may lead to mediation, renegotiation, or legal action. The contract remains active until resolved.

The IIA’s Practice Guide: Auditing Contracts recommends dispute resolution mechanisms but does not define them as a reason for contract closure.

Option C (When there is a force majeure event):

A force majeure (unforeseen event like natural disasters or war) may suspend or modify contractual obligations but does not always lead to closure.

The contract may be renegotiated or resumed once conditions allow.

Option D (When the termination clause is enacted):

Termination and closure are not the same. Termination means ending the contract before full obligations are met, whereas closure means fulfilling all obligations.

IIA GTAG 3: Contract Management Framework explains that contract termination can occur under specific clauses, but closure happens only after all duties are fulfilled.

IIA GTAG 3: Contract Management Framework – Covers contract lifecycle, including closeout procedures.

IIA Practice Guide: Auditing Contracts – Details contract auditing, dispute resolution, and obligations fulfillment.

Step-by-Step Explanation:IIA References for Validation:

When an organization allows managers to use their own smartphones at work under a Bring Your Own Device (BYOD) policy, IT security and risk management become critical. The most important policy and procedure to include would be documenting the process for discontinuing use of the devices to ensure data security, compliance, and risk mitigation when employees leave the company or change roles.

Data Security & Compliance: Ensuring that sensitive company data is removed securely when an employee leaves or replaces a device is crucial to prevent unauthorized access.

Access Control & Endpoint Management: The IT department needs a clear policy to revoke access to corporate applications and networks when a device is no longer in use.

Risk Mitigation: Unauthorized access to company systems through lost, stolen, or retired devices can lead to security breaches.

Option B (Required removal of personal pictures and contacts): Personal data does not impact company security and is irrelevant to corporate IT policies.

Option C (Required documentation of expiration of contract with service provider): This is the employee ' s responsibility, not the organization ' s, and does not address security risks.

Option D (Required sign-off on conflict of interest statement): While conflict of interest policies are important, they are unrelated to IT security concerns related to BYOD.

IIA’s GTAG (Global Technology Audit Guide) on Managing and Auditing IT Vulnerabilities emphasizes the importance of BYOD risk management, including clear procedures for device decommissioning.

IIA ' s Business Knowledge for Internal Auditing (CIA Exam Syllabus - Part 3) highlights IT governance frameworks that require policies for data access and security when using personal devices.

Why Option A is Correct:Why Other Options Are Incorrect:IIA References:Thus, the most appropriate answer is A. Required documentation of process for discontinuing use of the devices.

Data analysis in internal auditing allows auditors to assess large volumes of data, identify trends, and uncover anomalies, leading to a more comprehensive understanding of the audit area.

Definition and Role of Data Analysis in Auditing:

Data analytics in internal auditing involves using software and algorithms to analyze vast datasets for fraud detection, risk assessment, and control effectiveness.

The IIA’s GTAG on Continuous Auditing emphasizes that data-driven audits enhance visibility into operations, supporting risk-based auditing.

Why a More Holistic View?

Data analytics allows internal auditors to:

Identify patterns and trends across the entire audit area.

Detect fraud and anomalies more efficiently.

Assess risks across multiple departments simultaneously.

As per IIA Standard 1220 (Due Professional Care), auditors must consider the use of technology-based audit techniques to improve their audit scope.

Why Not Other Options?

A. It easily aligns with existing internal audit competencies to reduce expenses:

While data analytics can reduce costs, its primary benefit is enhanced audit scope and effectiveness, not just cost-cutting.

C. Its outcomes can be easily interpreted into audit conclusions:

Data analytics can enhance audit conclusions, but the interpretation still requires auditor expertise.

D. Its application increases internal auditors ' adherence to the Standards:

While data analytics aligns with IIA Standards, it is not the main reason for its adoption.

IIA GTAG – Continuous Auditing: Implications for Assurance & Monitoring

IIA Standard 1220 – Due Professional Care

IIA Standard 2120 – Risk Management

Step-by-Step Justification:IIA References:Thus, the correct and verified answer is B. It provides a more holistic view of the audited area.

Comprehensive and Detailed In-Depth Explanation:

The development phase of contracting involves drafting, negotiating, and finalizing the contract terms for a business activity. This phase ensures that agreements align with legal and operational requirements before execution.

Option A (Initiation phase) involves identifying needs and planning but does not include drafting contracts.

Option B (Bidding phase) focuses on soliciting and evaluating proposals but does not yet involve contract drafting.

Option D (Management phase) occurs after contracts are finalized and focuses on monitoring performance.

Since the development phase is when contracts are written and finalized, Option C is correct.

Making system changes does not provide assurance that a computer system is operating properly. In fact, changes introduce risk and require control through authorization, testing, approval, and monitoring. A system audit can provide assurance by independently evaluating controls, processing, security, and reliability. Testing policy compliance provides assurance that system practices align with approved requirements. Conducting system monitoring provides ongoing evidence of availability, performance, errors, security events, and operational issues. Internal auditors should distinguish assurance activities from operational activities that may create risk. System changes may improve performance or correct defects, but they do not themselves prove proper operation. Therefore, Option B is correct.

Comprehensive and Detailed In-Depth Explanation:

Computer hardware refers to the physical components of a computer system.

Workstation: A high-performance computer designed for technical or scientific applications.

Modem: A device that modulates and demodulates signals for data transmission over communication lines.

Disk drive: A device that reads and/or writes data to a disk storage medium.

Option D lists only physical components, fitting the definition of computer hardware.

In contrast:

Value-added network (option A): A hosted service offering specialized networking services, not a physical component.

Data warehouse (option B): A system used for reporting and data analysis, representing a data storage concept rather than a physical device.

Firewall (option C): While it can be hardware, it is often implemented as software; thus, the term doesn ' t exclusively denote hardware.

Therefore, option D accurately represents a list of computer hardware components.

Vertical integration occurs when a company expands its operations into a different stage of its supply chain. In this case, the restaurant is moving from relying on third-party delivery services to handling its own delivery operations, which is an example of backward vertical integration (taking control of a process previously handled by an external provider).

(A) Incorrect – Diversification.

Diversification refers to entering a completely different industry or market (e.g., a restaurant launching a grocery store).

In this case, the restaurant is expanding within the same industry by adding delivery services.

(B) Correct – Vertical integration.

Vertical integration happens when a company takes control of another step in its supply chain.

Since the restaurant is now handling its own deliveries instead of outsourcing, this is an example of backward vertical integration.

(C) Incorrect – Risk avoidance.

Risk avoidance means eliminating an activity entirely to prevent exposure to risk (e.g., deciding not to offer delivery at all).

The restaurant is not avoiding risk but taking on additional responsibilities.

(D) Incorrect – Differentiation.

Differentiation is a strategy focused on making a product/service unique to stand out from competitors.

The restaurant is not introducing a unique feature but integrating delivery operations.

IIA’s Global Internal Audit Standards – Business Strategy and Risk Management

Defines vertical integration and its impact on operational control.

COSO’s ERM Framework – Strategic Risk Considerations

Discusses how vertical integration influences business risks and cost control.

Porter’s Competitive Strategies – Vertical Integration Analysis

Explains backward and forward integration in supply chain management.

Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The main purpose of internal control is to provide reasonable assurance that organizational objectives will be achieved. Those objectives generally relate to operations, reporting, compliance, safeguarding of assets, efficiency, effectiveness, and reliability of information. Options A, B, and C are valid control objectives, but each is only one component of the broader internal control purpose. Compliance with policies, safeguarding resources, and reliable information all support objective achievement, but none is complete by itself. Internal control does not provide absolute assurance because limitations exist, including human error, collusion, management override, cost-benefit constraints, and changing conditions. Internal audit evaluates whether controls are suitably designed and operating effectively to reduce risks to acceptable levels. Therefore, the broadest and most accurate answer is Option D: reasonable assurance on achievement of objectives.

External auditors may rely on internal audit’s work if they evaluate the objectivity, competence, and quality of the internal audit function. If satisfied, they may use internal audit work to support their opinion, reducing duplication.

Option A is incorrect because external auditors do not manage internal audit. Option B is too restrictive, as reliance is allowed under auditing standards. Option D is false because internal audit can share relevant work with external auditors.

Understanding the Call Center Performance Issue:

The key performance indicators (KPIs) show a positive trend, meaning the call center appears to be performing well.

However, customer complaints are increasing, indicating that the KPIs are not accurately reflecting service quality.

This suggests that employees may be prioritizing call quantity over call quality, likely due to pressure to meet call quotas.

Why De-Emphasizing Call Quotas is the Best Solution:

Encourages Quality Over Speed: Reducing the emphasis on call volume allows agents to spend more time resolving customer issues effectively.

Improves Customer Satisfaction: Agents can provide more thorough assistance, reducing repeat calls and complaints.

Aligns KPIs with Service Quality: Shifting focus from quantity-based KPIs to quality-based KPIs ensures performance measurements reflect actual customer experience.

Why Other Options Are Incorrect:

A. Review the call center script used by customer service agents to interact with callers, and update the script if necessary – Incorrect.

While updating scripts may help, it does not address the root issue of employees rushing through calls to meet quotas.

C. Retrain call center staff on area processes and common technical issues that they will likely be asked to resolve – Incorrect.

Training is useful, but if agents are pressured to complete calls quickly, training alone will not resolve the issue.

D. Increase the incentive for call center employees to complete calls quickly and raise the number of calls completed daily – Incorrect.

This would worsen the issue by further incentivizing speed over customer satisfaction, leading to more complaints.

IIA’s Perspective on Performance Metrics and Customer Service Quality:

IIA Standard 2120 – Risk Management requires organizations to ensure that performance metrics align with actual business objectives.

IIA GTAG (Global Technology Audit Guide) on Performance Measurement recommends balancing quantitative KPIs (e.g., call volume) with qualitative KPIs (e.g., customer satisfaction scores).

COSO Internal Control Framework supports adjusting performance incentives to ensure alignment with business objectives.

IIA References:

IIA Standard 2120 – Risk Management & KPI Alignment

IIA GTAG – Performance Metrics in Customer Service

COSO Internal Control Framework – Effective KPI Design

Thus, the correct and verified answer is B. De-emphasize the importance of call center employees completing a certain number of calls per hour.