When an organization outsources IT services, risks can be categorized as:
Risks specific to the organization - Risks that arise internally within the company.
Risks specific to the service provider - Risks that are under the control of the third-party provider.
Shared risks - Risks that require joint management by both the organization and the service provider.
Let's analyze the answer choices:
Option A: Unexpected increases in outsourcing costs.
Incorrect. While cost increases can be a risk, they are often a shared risk because the organization and the provider negotiate pricing terms.
Option B: Loss of data privacy.
Incorrect. Data privacy concerns are shared between the organization (which must ensure compliance with regulations like GDPR or CCPA) and the service provider (which must implement proper security controls).
Option C: Inadequate staffing.
Correct. The service provider is responsible for maintaining adequate staffing levels to deliver the contracted services effectively. If they fail to do so, service quality can deteriorate, posing risks to the organization.
IIA Reference: Internal auditors should assess vendor risk management, including the provider's staffing capabilities. (IIA GTAG: Auditing IT Outsourcing) Option D: Violation of contractual terms.
Incorrect. While the service provider may be responsible for upholding contract terms, the organization is also responsible for contract enforcement. This makes it a shared risk rather than one specific to the provider.

The intent of quality control is to ensure that goods and services conform to the design specifications. Whether the focus is on feed forward, feedback, or concurrent control, the emphasis is on ensuring product or service conformity.

During an audit of business continuity plans, the internal auditor's role is to evaluate whether the plans are adequate, current, tested, approved, and aligned with business requirements. Preparing the business impact analysis, identifying key response personnel, and prioritizing required recovery resources are management responsibilities. Internal audit may review those activities, test their adequacy, and determine whether they support recovery objectives, but auditors should not assume ownership of management's continuity planning process. Performing management's work would impair objectivity, especially if internal audit later had to provide assurance over that same work. Therefore, Statement 1 is appropriate because it reflects an assurance role. Statements 2, 3, and 4 describe management design and implementation responsibilities. The correct answer is Option A: 1 only.