One of the benefits of an EDI-EFT system is that it can provide remote access at any time from any place if telecommunications links are available. However, appropriate controls should prevent unauthorized access. A multinational company has an agreement with a value-added network VAN) that provides the encoding and communications transfer for the company's electrons.. data interchange EDI) and electronic funds transfer EFT) transactions. Before transfer of data to the VAN, the company performs online preprocessing of the transactions. The internal auditor is responsible for assessing preprocessing controls. In addition, the agreement between the company and the VAN states that the internal auditor is allowed toe :amine and report on the controls in place at the VAN on an annual basis. The contract specifies that access to the VAN can occur on a surprise basis during the second or third quarter of the company's fiscal year. This p n I was -hosen so it would not interfere with processing during the VAN's peak transaction periods. This provision was riot reviewed with internal auditing. The annual audit plan approved by the board of directors specifies that a full audit would be done during the current year.

A business impact analysis begins by identifying business processes and determining their criticality, dependencies, impacts of disruption, recovery priorities, recovery time objectives, and recovery point objectives. Identifying business processes is a core BIA step because recovery planning cannot be effective until the organization understands which processes are essential and what resources support them. Staffing alternatives, recovery solutions, recovery sites, and alternative sourcing are later continuity and recovery strategy decisions based on BIA results. Internal auditors should evaluate whether the BIA includes all significant processes, considers operational and financial impacts, and is updated when business conditions change. Therefore, Option C is correct.

In an assurance engagement involving smart devices, the first step is to obtain a comprehensive inventory of all devices in use. This ensures that the audit covers all relevant assets and allows the internal auditor to assess risks, controls, and policies effectively.
* (A) Incorrect - Train all employees on bring-your-own-device (BYOD) policies.
* While employee training is important, it is a control measure rather than the first step in an assurance engagement.
* Without an inventory of devices, training effectiveness cannot be assessed.
* (B) Incorrect - Understand what procedures are in place for locking lost devices.
* This is a specific control measure but not the starting point for an engagement.
* The first step should be to identify what devices exist before evaluating security measures.
* (C) Correct - Obtain a list of all smart devices in use.
* The foundation of an assurance engagement is identifying the scope, which includes listing all smart devices in use.
* This allows the auditor to evaluate security risks, compliance, and control measures effectively.
* (D) Incorrect - Test encryption of all smart devices.
* Testing encryption is an audit procedure that should be performed after understanding the inventory and existing controls.
* Without knowing which devices exist, encryption testing would not be effective.
* IIA's Global Internal Audit Standards - Technology Assurance and Cybersecurity Audits
* Outlines steps for conducting technology-related assurance engagements.
* IIA's GTAG (Global Technology Audit Guide) on Auditing Smart Devices
* Recommends obtaining an inventory of devices as the first step in an audit.
* COBIT Framework - IT Asset Management and Control
* Emphasizes identifying assets as the foundation of IT governance and risk management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards: