When implementing big data systems, organizations must establish ongoing production monitoring to ensure system performance, efficiency, and reliability.
Why Option A (Key performance indicators) is Correct:
KPIs (Key Performance Indicators) measure the effectiveness and success of big data systems.
KPIs help track system efficiency, data processing speed, accuracy, and resource utilization during production.
Examples of KPIs in big data systems include data ingestion rate, processing time, query performance, system uptime, and error rates.
Why Other Options Are Incorrect:
Option B (Reports of software customization):
Incorrect because software customization reports document system modifications but do not monitor system performance.
Option C (Change and patch management):
Incorrect because change and patch management deals with software updates and security fixes, not ongoing performance monitoring.
Option D (Master data management):
Incorrect because master data management focuses on data governance and consistency, not real-time system performance.
IIA GTAG - "Auditing Big Data Systems": Recommends using KPIs to measure the effectiveness of big data implementation.
COBIT 2019 - APO08 (Manage Performance and Capacity): Emphasizes KPI tracking for IT and data system performance.
NIST Big Data Framework: Highlights the importance of KPIs for monitoring big data system performance.
IIA References:

Comprehensive and Detailed In-Depth Explanation:
Data privacy laws, such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), emphasize restricting access to personally identifiable information (PII) to only those who require it for business purposes.
Option B (Data backup within 24 hours) is an IT best practice but is not a core requirement of privacy laws.
Option C (Approval for system updates) is a change management policy, unrelated to data privacy.
Option D (Insider trading restrictions) falls under corporate governance and securities regulations, not data privacy laws.
Thus, Option A is correct, as it aligns with legal requirements for protecting sensitive personal data.
Reference: IIA Data Privacy Compliance - GDPR & CCPA Standards

Action plans should be agreed upon collaboratively, with both the responsible managers and senior management involved. Involving senior management earlier in the draft report and action plan stage ensures alignment on deadlines and accountability before final issuance.
Option A would reduce input and transparency. Option C creates fragmented reporting. Option D is excessive and bypasses proper reporting procedures.
Reference:
IIA Standards - Standard 2410: Criteria for Communicating; Standard 2440: Disseminating Results.

When internal audit identifies a risk that appears unacceptable, the CAE should first discuss the matter with the responsible management. This ensures management has an opportunity to explain their rationale or adjust actions before escalation.
Option A (direct escalation to senior management) or Option C (to the board) are appropriate only if management refuses to act. Option B (sending a letter with a deadline) is not aligned with IIA guidance.
Reference:
IIA Standards - Standard 2600: Communicating the Acceptance of Risks.