Electronic Data Interchange (EDI) refers to the computer-to-computer exchange of business documents (such as purchase orders, invoices, and shipping notices) in a standard electronic format between business partners.

Correct Answer (D - Use of Electronic Data Interchange)

EDI enables real-time, automated business transactions between companies, reducing errors and increasing efficiency.

The IIA GTAG 8: Audit of Inventory Management highlights EDI as a critical system for supply chain and procurement operations.

Why Other Options Are Incorrect:

Option A (Use of a Central Processing Unit - CPU):

A CPU is a hardware component, not a method for exchanging business documents.

Option B (Use of a Database Management System - DBMS):

A DBMS stores and manages data but does not facilitate external document exchange between trading partners.

Option C (Use of a Local Area Network - LAN):

A LAN connects computers within an organization but does not enable document exchange between separate businesses.

IIA GTAG 8: Audit of Inventory Management – Discusses EDI as an essential tool for automating business transactions.

IIA Practice Guide: Auditing IT Controls – Recommends EDI for secure and efficient document exchange.

Step-by-Step Explanation:IIA References for Validation:Thus, D is the correct answer because EDI is the best system for automated, computer-to-computer business document exchange.

Understanding the Contracting Process PhasesThe contracting process generally follows these phases:

Initiation Phase: Identifies the need for a contract and sets initial objectives.

Bidding Phase: Potential vendors or partners submit proposals, and negotiations begin.

Development Phase: Contracts are drafted, negotiated, and finalized before execution.

Management Phase: The contract is executed, monitored, and evaluated for compliance.

Why Option C is Correct?

The development phase is where contracts are formally drafted based on agreements made during bidding and negotiation.

This phase includes legal review, compliance verification, and risk assessment, ensuring the contract aligns with business objectives and legal requirements.

IIA Standard 2110 – Governance requires auditors to assess how contract risks are managed, ensuring formal contract development processes.

Why Other Options Are Incorrect?

Option A (Initiation phase):

This phase defines the business need but does not involve drafting contracts.

Option B (Bidding phase):

In this phase, businesses solicit proposals, but contracts are not fully drafted until vendor selection.

Option D (Management phase):

The management phase involves executing and monitoring the contract, not drafting it.

Contracts are drafted during the development phase after vendor selection and before execution.

IIA Standard 2110 supports governance over contract risk and formal agreement processes.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (Contract Risk & Compliance)

COSO ERM – Risk Management in Contracting

Understanding the Three Lines of Defense Model:

First Line of Defense (Operational Management): Performs daily IT security tasks, such as blocking unauthorized traffic and encrypting data.

Second Line of Defense (Risk Management & Compliance): Monitors and reviews security controls, including disaster recovery testing and risk management activities.

Third Line of Defense (Internal Audit): Provides an independent assessment of IT security controls.

Why Option C (Review Disaster Recovery Test Results) Is Correct?

The second line of defense is responsible for monitoring and evaluating IT risk management processes, including disaster recovery and business continuity planning.

Reviewing disaster recovery test results ensures that the organization is prepared for IT disruptions and meets compliance requirements.

IIA Standard 2110 – Governance requires auditors to evaluate whether IT risk management activities (such as disaster recovery) are being effectively monitored.

Why Other Options Are Incorrect?

Option A (Block unauthorized traffic):

This is a first-line defense task, typically handled by IT security teams (e.g., firewall and intrusion detection system monitoring).

Option B (Encrypt data):

Encryption is part of daily IT security operations and is handled by the first line of defense.

Option D (Provide an independent assessment of IT security):

Independent assessments are the responsibility of internal audit (third line of defense), not the second line.

The second line of defense focuses on monitoring IT risk, making disaster recovery test review a key responsibility.

IIA Standard 2110 and the Three Lines of Defense Model confirm this role.

Final Justification:IIA References:

IPPF Standard 2110 – Governance (IT Risk Management)

IIA Three Lines of Defense Model

COBIT Framework – IT Governance & Risk Management