IIA IIA-CIA-Part3 Online Access

A relevant cost is a future cost that differs among decision alternatives. It matters because it can influence the decision being made. Costs that are the same under all alternatives are irrelevant because they do not change the outcome. Past costs are sunk costs and should not affect current decisions because they cannot be changed, even if they differ historically. For example, in a make-or-buy decision, avoidable future production costs are relevant, while already-incurred equipment costs are usually not. Internal auditors reviewing management decisions should determine whether analyses improperly include sunk costs or exclude avoidable future costs. Option A is incorrect because a future cost that is the same among alternatives is irrelevant. Options C and D are incorrect because past costs are not relevant to future decisions. Therefore, Option B is correct.

The auditor should first determine whether there is a documented business need for the vendor employees’ remote access. Access should be granted only when justified by a legitimate operational requirement and supported by authorization. Once the business need is confirmed, the auditor can assess whether access is appropriately limited, monitored, and revoked when no longer needed. Read-only access may still be excessive if no business need exists. Immediately identifying who should remove access is premature without determining whether access is valid. Device management is important but secondary to confirming need and authorization. Internal auditors reviewing third-party access should evaluate business justification, approval, least privilege, authentication, monitoring, and periodic recertification. Therefore, Option A is correct.

Understanding BYOD Risks:

A Bring-Your-Own-Device (BYOD) policy allows employees to use personal devices (e.g., laptops, smartphones, tablets) for work.

This increases security risks such as unauthorized access, malware infections, data leakage, and non-compliance with IT security policies.

Why Option C (Detection and Authentication Controls) Is Correct?

Detection and authentication controls ensure that:

Only authorized devices can connect to the organization ' s network.

User authentication mechanisms (such as multi-factor authentication) verify identities before granting access.

Devices with security vulnerabilities are flagged and restricted.

This aligns with IIA Standard 2110 – Governance, which emphasizes IT security controls for risk mitigation.

ISO 27001 and NIST Cybersecurity Framework also recommend device authentication and monitoring for secure network access.

Why Other Options Are Incorrect?

Option A (Limit personal use of employee devices):

Limiting personal use does not fully address network security risks; malware can still infect devices.

Option B (Control access through approvals and reviews):

While access control is important, it does not mitigate the broader risks of compromised devices connecting to the network.

Option D (Software scans and patch reminders):

Patching is important, but it does not prevent unauthorized access or ensure authentication for devices.

Implementing device detection and authentication controls is the most effective way to mitigate security risks in a BYOD environment.

IIA Standard 2110 and ISO 27001 emphasize strong network security measures.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (IT Risk Management & BYOD Security)

ISO 27001 – Information Security Management

NIST Cybersecurity Framework – Access Control & Authentication