The correct option is External certification attainment.

External certification attainment is generally not a main concern for the internal audit team in a mid sized software company. Internal audit provides independent assurance over governance risk and controls and it may review readiness for certifications or assess controls that support compliance, but managing or achieving external certifications is typically owned by management compliance or a dedicated quality function rather than by internal audit.

Cost control and budgeting is not correct because internal audit often evaluates financial controls and budgetary processes to ensure risks are managed and controls are operating as intended. Reviewing cost controls is a common part of financial and operational audits.

Control and process design is not correct because assessing the design of controls and processes is a core activity for internal audit. Auditors test whether controls are suitably designed to mitigate risks and they recommend improvements when gaps are found.

Operational effectiveness and efficiency is not correct because internal audit conducts operational audits to determine whether business processes are efficient effective and aligned with organizational objectives. Improving operational performance is a frequent audit objective.

Full AWS Practitioner Certification Question