IIA-CIA-Part3 Exam Dumps : Internal Audit Function

Business continuity planning must be driven by business requirements, not IT decisions. The most appropriate recommendation is to ensure that management of business units determines recovery objectives and priorities, since they understand the criticality of operations. IT then implements solutions based on these business requirements.

Option A addresses current targets but does not correct the root cause. Options B and C focus only on IT, which is not responsible for defining business needs.

Understanding BYOD Risks:

A Bring-Your-Own-Device (BYOD) policy allows employees to use personal devices (e.g., laptops, smartphones, tablets) for work.

This increases security risks such as unauthorized access, malware infections, data leakage, and non-compliance with IT security policies.

Why Option C (Detection and Authentication Controls) Is Correct?

Detection and authentication controls ensure that:

Only authorized devices can connect to the organization ' s network.

User authentication mechanisms (such as multi-factor authentication) verify identities before granting access.

Devices with security vulnerabilities are flagged and restricted.

This aligns with IIA Standard 2110 – Governance, which emphasizes IT security controls for risk mitigation.

ISO 27001 and NIST Cybersecurity Framework also recommend device authentication and monitoring for secure network access.

Why Other Options Are Incorrect?

Option A (Limit personal use of employee devices):

Limiting personal use does not fully address network security risks; malware can still infect devices.

Option B (Control access through approvals and reviews):

While access control is important, it does not mitigate the broader risks of compromised devices connecting to the network.

Option D (Software scans and patch reminders):

Patching is important, but it does not prevent unauthorized access or ensure authentication for devices.

Implementing device detection and authentication controls is the most effective way to mitigate security risks in a BYOD environment.

IIA Standard 2110 and ISO 27001 emphasize strong network security measures.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (IT Risk Management & BYOD Security)

ISO 27001 – Information Security Management

NIST Cybersecurity Framework – Access Control & Authentication

Audit observations should include condition, criteria, cause, and effect. In this case, the condition (delay risk), criteria (schedule), and effect (penalties) are already presented. What is missing is the cause—the underlying reason for the project delay. Identifying the cause ensures recommendations address the root of the problem.