A physical IT risk involves damage to tangible IT assets or facilities from physical events such as fire, flood, theft, unauthorized entry, power failure, temperature problems, or environmental hazards. An automated fire prevention or suppression system directly mitigates a physical risk by detecting or controlling fire conditions that could damage servers, network equipment, storage media, and facilities. System access restrictions are logical controls. Anti-malware software protects against malicious code, which is a cybersecurity risk. A firewall protects network boundaries and traffic, not physical equipment from environmental harm. Internal audit should evaluate physical controls such as fire detection, suppression, environmental monitoring, locked facilities, power protection, and disaster recovery readiness. Therefore, Option A is correct.