When prioritizing the audit universe, the CAE typically uses a risk-factor approach. This includes a combination of likelihood, impact, control effectiveness, and other relevant criteria. Solely relying on impact (Option C) or likelihood (Option B) is insufficient. Heat maps (Option D) may be tools used within the process, but they are not the actual method of prioritization.

Thus, the correct description is the risk-factor approach (Option A).

Comprehensive and Detailed In-Depth Explanation:

Primary controls in spreadsheet management focus on ensuring data accuracy, integrity, and security.

Option A (Locking formulas and static data) prevents unauthorized changes, ensuring data integrity. This is a direct control over spreadsheet accuracy, making it the correct answer.

Option B (Backup storage) is an IT operational control, not a primary financial reporting control.

Option C (Documentation of spreadsheet use) is important for governance but does not directly prevent errors.

Option D (Version control software) helps manage changes but does not directly ensure financial reporting accuracy.

Thus, locking and protecting spreadsheet formulas is the most critical primary control for accurate financial reporting.

Self-managed teams can improve flexibility, ownership, innovation, and local decision-making. However, when decision-making authority lies within each individual team, there is a risk that teams independently acquire similar tools, build overlapping capabilities, or perform duplicated activities. This can increase costs and reduce consistency. Bureaucracy is less likely because self-managed teams usually reduce formal hierarchy. Decision-making may be faster locally, not slower. Power is also less likely to be overconcentrated because authority is dispersed across teams. Internal audit should evaluate whether decentralized or self-managed structures have sufficient coordination, shared standards, governance, and resource visibility to prevent duplication and inconsistent control practices. Therefore, Option C is correct.

Decentralization delegates decision-making authority to lower levels, divisions, regions, or operating units. This usually improves responsiveness and makes better use of local knowledge, but it can also result in less controlled or less consistent decision making. Local managers may make decisions that differ from headquarters’ preferences or from other units unless governance, policies, performance measures, and oversight are strong. Option A is incorrect because decentralization usually supports faster response to external change. Option C is incorrect because decentralization often reduces the routine decision burden on higher-level managers. Option D is also incorrect because decentralization can make better use of employees’ skills by giving them more authority. Therefore, Option B is correct.

A tape rotation schedule defines how often backup tapes are overwritten or archived, directly impacting data retention periods. This is essential for compliance, disaster recovery, and internal controls over data storage.

Correct Answer (C - The Tape Rotation Schedule Affects How Long Data is Retained)

Organizations use backup rotation schemes such as Grandfather-Father-Son (GFS), Tower of Hanoi, or FIFO (First-In-First-Out) to determine how long backups are kept before being overwritten.

This impacts data retention policies, regulatory compliance, and recovery capabilities.

The IIA’s GTAG 10: Business Continuity Management discusses backup strategies and retention management.

Why Other Options Are Incorrect:

Option A (System backups should always be performed real-time):

Real-time backups (continuous data protection) are useful but not always required. Many businesses use scheduled backups instead.

Option B (Backups should be stored in a secured location onsite for easy access):

Best practice recommends offsite or cloud storage to protect against disasters like fire or cyberattacks.

Option D (Backup media should be restored only in case of hardware or software failure):

Backups may also be restored for audit purposes, compliance checks, or business continuity testing.

GTAG 10: Business Continuity Management – Covers backup strategies, data retention, and disaster recovery.

IIA Practice Guide: IT Controls – Discusses backup policies and risks in data management.

Step-by-Step Explanation:IIA References for Validation:Thus, the tape rotation schedule (C) is correct because it determines how long data is retained.

The IIA Standards emphasize that the internal audit plan must remain dynamic and responsive to changes in risks and priorities. If significant risks are identified after the plan has been approved, the CAE must revise the plan and communicate the interim changes to senior management and the board for review and approval.

Option A ignores emerging risks. Option C delays addressing significant risks. Option D bypasses governance approval and does not respect the board’s oversight role.

A tolerance threshold is a recognized control that allows for efficiency while preventing abuse. By setting a monetary limit, the process permits legitimate small variances (e.g., transport costs) while ensuring significant discrepancies are flagged and cannot be bypassed.

Option A is overly rigid and impractical. Option B is administratively burdensome. Option D lacks control and exposes the process to risk.

A virtual private network is best for employees who need to authenticate and access organizational IT resources from outside the organization. A VPN creates an encrypted tunnel over a public or external network, allowing remote users to connect securely to internal resources. A local area network is limited to a specific physical site, such as an office. A wide area network connects geographically separated locations, but it is not specifically a secure remote-access mechanism for individual users. A metropolitan area network covers a city or metropolitan region. Internal auditors reviewing remote access should evaluate VPN authentication, encryption, logging, endpoint compliance, session timeout, access rights, and monitoring. Therefore, Option D is correct.

A retained earnings policy determines how much of a company’s net income is retained (kept in the business) versus distributed to shareholders as dividends.

(A) Cash.

Incorrect: While retained earnings affect the company’s financial position, they do not directly impact cash flow, as retained earnings can be reinvested in non-cash assets.

(B) Dividends. (Correct Answer)

A retained earnings policy directly influences dividend payouts.

More retained earnings = lower dividends; less retained earnings = higher dividends.

IIA Standard 2110 (Governance) requires oversight of dividend policies as part of corporate governance.

COSO ERM – Risk Response suggests that dividend policies should align with strategic financial goals.

(C) Gross margin.

Incorrect: Gross margin is determined by revenue and cost of goods sold (COGS), not retained earnings.

(D) Net income.

Incorrect: Net income is calculated before retained earnings are determined, so the policy does not influence net income directly.

IIA Standard 2110 – Governance: Covers policies impacting financial distributions.

COSO ERM – Risk Response: Suggests that retained earnings policies influence financial stability and investor decisions.

Analysis of Each Option:IIA References Supporting the Answer:Thus, the correct answer is (B) because a retained earnings policy primarily affects the amount of dividends paid to shareholders.

Cloud-based applications accessible outside the VPN perimeter increase the possibility of data leakage through unapproved or unsecured applications (shadow IT). Even with multi-factor authentication, risks remain around the use of personal devices and uncontrolled storage or sharing.

Option B is incorrect because VPNs are generally secure if configured correctly. Option C is misleading, as remote access controls can be effective in cloud solutions when properly designed. Option D (employees accessing emails after hours) is not a risk related to security but rather a work-life balance issue.

Thus, the key risk is potential leakage of organizational data via unapproved or uncontrolled applications (Option A).

Both hierarchical and open organizational structures require responsibility to be supported by adequate authority. Assigning responsibility without authority creates accountability failure and control weakness. Both structures also recognize that a superior may delegate tasks or authority but cannot delegate ultimate responsibility for results. Statement 1 is more characteristic of open or decentralized structures, not all hierarchical structures. Statement 2 is an outdated and rigid span-of-control rule; appropriate span depends on complexity, employee competence, technology, geography, and control needs. Internal audit should evaluate whether organizational design supports clear accountability, authority, escalation, segregation of duties, and effective oversight. The principles common to both structures are statements 3 and 4. Therefore, Option D is correct.

The acid-test (quick) ratio is a more dependable liquidity indicator than working capital because it excludes inventory, which may not be easily converted to cash in the short term. This ratio measures a company’s ability to pay its short-term liabilities using only its most liquid assets (cash, marketable securities, and accounts receivable).

Formula for the Acid-Test Ratio:Acid-Test Ratio=Current Assets−InventoryCurrent Liabilities\text{Acid-Test Ratio} = \frac{\text{Current Assets} - \text{Inventory}}{\text{Current Liabilities}}Acid-Test Ratio=Current LiabilitiesCurrent Assets−Inventory​

This ratio is more reliable than working capital since it removes inventory, which may be difficult to liquidate quickly in financial distress.

A. Acid-test (quick) ratio (Correct Answer) – This provides a stronger measure of liquidity because it excludes inventory, which might not be quickly converted to cash.

B. Average collection period – This measures the efficiency of accounts receivable collections, but it does not directly measure overall liquidity.

C. Current ratio – While this ratio is commonly used, it includes inventory, which can distort liquidity assessments if inventory is not easily sold.

D. Inventory turnover – This measures how quickly inventory is sold, but it does not directly assess liquidity.

IIA IPPF Standard 2130 – Control emphasizes liquidity monitoring as a key financial control.

COSO ERM Framework – Financial Performance Measures discusses acid-test ratio as a critical liquidity metric.

IFRS 7 – Financial Instruments Disclosures outlines the importance of liquidity risk assessments.

Explanation of Each Option:IIA References:

A declining inventory turnover means that inventory is sitting longer before being sold, while an increasing gross margin rate suggests the company is making higher profits on each sale. This combination is often a sign of inventory overstatement, possibly due to accounting errors or fraud.

Correct Answer (D - The Organization’s Inventory is Overstated)

Inventory turnover ratio = Cost of Goods Sold (COGS) / Average Inventory. A declining inventory turnover indicates higher inventory levels relative to sales.

Gross margin rate = (Revenue - COGS) / Revenue. An increasing gross margin means either higher selling prices or lower COGS.

Overstating inventory artificially reduces COGS, making gross margin appear higher.

The IIA’s GTAG 8: Audit of Inventory Management explains that inflated inventory levels can distort financial reporting and lead to misinterpretations of business performance.

Why Other Options Are Incorrect:

Option A (Operating expenses are increasing):

An increase in operating expenses would not directly explain declining inventory turnover or increasing gross margin.

Gross margin focuses on revenue and COGS, not operating expenses.

Option B (Just-in-Time Inventory):

A just-in-time (JIT) system reduces inventory levels, leading to higher inventory turnover, which contradicts the scenario.

Option C (Inventory Theft):

If theft were occurring, inventory levels would decrease, leading to higher turnover, not declining turnover.

GTAG 8: Audit of Inventory Management – Discusses inventory valuation risks, including overstatement and its impact on financial ratios.

IIA Practice Guide: Assessing Inventory Risks – Covers fraud risks related to inventory manipulation.

Step-by-Step Explanation:IIA References for Validation:Thus, the best explanation for a declining inventory turnover with an increasing gross margin rate is inventory overstatement (D).

A right-to-audit clause is the most important clause when the organization needs access to the third-party provider’s records. Outsourcing does not remove management’s responsibility for payroll accuracy, confidentiality, compliance, tax reporting, and control effectiveness. The organization must retain the contractual ability to inspect records, request evidence, review controls, and obtain assurance reports. A termination clause defines how the contract may end, but it does not guarantee audit access. A confidentiality clause protects sensitive information but does not provide inspection rights. A data security accountability clause is important, but it is narrower than the right to examine records and controls. Internal audit should confirm that audit rights are clear, enforceable, and practical. Therefore, Option B is correct.