Reference: IIA Business Knowledge for Internal Auditing, Logical Access Controls section.

In an assurance engagement involving smart devices, the first step is to obtain a comprehensive inventory of all devices in use. This ensures that the audit covers all relevant assets and allows the internal auditor to assess risks, controls, and policies effectively.
(A) Incorrect - Train all employees on bring-your-own-device (BYOD) policies.
While employee training is important, it is a control measure rather than the first step in an assurance engagement.
Without an inventory of devices, training effectiveness cannot be assessed.
(B) Incorrect - Understand what procedures are in place for locking lost devices.
This is a specific control measure but not the starting point for an engagement.
The first step should be to identify what devices exist before evaluating security measures.
(C) Correct - Obtain a list of all smart devices in use.
The foundation of an assurance engagement is identifying the scope, which includes listing all smart devices in use.
This allows the auditor to evaluate security risks, compliance, and control measures effectively.
(D) Incorrect - Test encryption of all smart devices.
Testing encryption is an audit procedure that should be performed after understanding the inventory and existing controls.
Without knowing which devices exist, encryption testing would not be effective.
IIA's Global Internal Audit Standards - Technology Assurance and Cybersecurity Audits Outlines steps for conducting technology-related assurance engagements.
IIA's GTAG (Global Technology Audit Guide) on Auditing Smart Devices
Recommends obtaining an inventory of devices as the first step in an audit.
COBIT Framework - IT Asset Management and Control
Emphasizes identifying assets as the foundation of IT governance and risk management.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

The CAE should remain aware of emerging risks through ongoing communication and collaboration with senior management and other stakeholders. Building strong relationships allows the CAE to obtain early insights into new and developing risks.
Option B (building a risk management process) is management's responsibility, not internal audit's. Options C and D involve reviewing processes, but they do not directly expose the CAE to emerging risks in real time.
Reference:
IIA Standards - Standard 2010: Planning; Practice Guide - Developing a Risk-based Internal Audit Plan.

Understanding Data Recovery and Security Risks:
Data must be protected, recoverable, and accessible when needed while maintaining security.
The best practice is to store encrypted backups offsite while keeping encryption keys separate but accessible.
Why Option D is Correct?
Storing encrypted data offsite (a few hours away) ensures protection against disasters (e.g., fire, cyberattacks, physical damage).
Keeping encryption keys at the organization ensures that recovery is quick and controlled without risking unauthorized access.
This aligns with the IIA's IT Audit Practices and ISO 27001 (Information Security Management), which emphasize separate storage of encrypted data and encryption keys for security and recoverability.
IIA Standard 2110 - Governance requires internal auditors to assess whether IT governance ensures the availability and security of critical data.
Why Other Options Are Incorrect?
Option A (Encrypted physical copies and keys stored together at the organization):
If both data and keys are in the same location, a disaster or breach would make recovery impossible.
Option B (Encrypted copies and keys stored in separate locations far away):
While secure, if encryption keys are stored too far, recovery could be delayed, impacting business continuity.
Option C (Encrypted usage reports in a cloud database):
This does not ensure full data recovery; it only provides logs and structure changes, not the actual data.
Storing encrypted data offsite while keeping encryption keys accessible onsite follows best IT security and disaster recovery practices.
IIA Standard 2110 supports evaluating IT governance, including data security and recovery controls.
Final Justification:IIA References:
IPPF Standard 2110 - Governance
ISO 27001 - Information Security Management
NIST SP 800-34 - Contingency Planning Guide for IT Systems
COBIT Framework - Data Security & Recovery Controls

The most recent backup is primarily used to restore lost data in the event of a system failure, data corruption, or cyberattack. If a data center failure occurs, the latest backup is the best source to recover the human resources database and resume operations.
(A) Incorrect - An incorrect program fix was implemented just prior to the database backup.
If an incorrect fix was applied before the backup, restoring the latest backup would still contain the error.
The organization would need to restore an earlier version before the faulty update.
(B) Incorrect - The organization is preparing to train all employees on the new self-service benefits system.
The latest backup is not needed for training; the live system or historical data would be used instead.
(C) Correct - There was a data center failure that requires restoring the system at the backup site.
In the event of a system failure, restoring from the most recent backup minimizes data loss and downtime.
This is the primary reason for maintaining regular backups.
(D) Incorrect - There is a need to access prior year-end training reports for all employees in the human resources database.
Historical records would likely be stored in archived backups or reports, not the latest backup.
The most recent backup contains current data, not old reports.
IIA's GTAG (Global Technology Audit Guide) - IT Disaster Recovery and Backup Strategies Covers the importance of backups in system restoration.
NIST Cybersecurity Framework - Data Recovery and Business Continuity
Recommends frequent backups to protect against system failures.
ISO 22301 - Business Continuity Management
Defines recovery procedures and best practices for backup site restoration.
Analysis of Answer Choices:IIA References and Internal Auditing Standards: