The phrase "confidentiality of different records within the database" points to authorization and access restrictions. The best control is restricting access permissions when mobile devices are used, because users should only access records required for their role and business purpose. Encryption protects data in transit, but it does not control which database records an authenticated user can view. Remote wiping helps after a device is lost but does not manage record-level confidentiality during normal use. Two-factor authentication strengthens login security, but after authentication, confidentiality still depends on authorization rules.
Internal audit should evaluate least privilege, role-based access, mobile access restrictions, logging, and periodic access reviews. Therefore, Option C is correct.