A new CEO authorizes a vendor’s access to the organization’s vendor payment and contracting database...

The principal fraud concern is that the vendor could misuse confidential information obtained through database access to gain an unfair commercial advantage. The database contains information concerning competing vendors, contracts, payments, pricing, and services. Using such information for the vendor’s own benefit could represent corruption, misuse of confidential information, conflicts of interest, or other fraudulent conduct. Insufficient employee screening is an information-security concern but does not describe the most direct fraud scenario presented. Read-only access limits modification capability but does not prevent unauthorized use or disclosure of sensitive information. Whether internal audit could have performed the work is not itself evidence of fraud. Internal auditors should focus on how privileged third-party access might be exploited for improper benefit. Therefore, option D represents the fraud risk requiring special consideration.