Organizations must comply with privacy principles that emphasize data retention limitations. Keeping personal data indefinitely violates privacy laws and regulations such as the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA).
Privacy Regulations Require Data Minimization:
GDPR Article 5(1)(e) states that personal data should only be kept for as long as necessary for the intended purpose.
IIA GTAG 4: Management of IT Auditing also advises against excessive data retention.
Security and Risk Concerns:
Storing data indefinitely increases the risk of data breaches.
IIA Standard 2110 - Governance emphasizes the need for proper information security governance to protect personal data.
Legal and Compliance Issues:
Organizations are required to define retention policies to prevent unauthorized or unnecessary storage of personal data.
A). Customers can access and update personal information when needed. (Incorrect) Reason: Allowing customers to access and update their information aligns with privacy principles such as data accuracy and transparency.
C). Customers reserve the right to reject sharing personal information with third parties. (Incorrect) Reason: This supports data control rights, which is consistent with privacy standards like opt-in and opt-out policies.
D). The organization performs regular maintenance on customers' personal information. (Incorrect) Reason: Regular maintenance (e.g., updates, corrections, deletions) enhances data accuracy and security, aligning with privacy best practices.
IIA Global Technology Audit Guide (GTAG) 4: Management of IT Auditing - Discusses data privacy principles.
IIA Standard 2110 - Governance - Ensures data security and regulatory compliance.
IIA GTAG 8: Auditing Application Controls - Covers data retention policies and privacy compliance.
Privacy Regulations: GDPR (Article 5), CCPA (Section 1798.105) - Require organizations to delete data once it is no longer needed.
Why is Indefinite Retention a Violation?Analysis of Incorrect Answers:IIA References:Thus, the correct answer is B. The organization retains customers' personal information indefinitely.

Under the variable costing method, product costs include only costs that vary with production, such as direct materials, direct labor, and variable manufacturing overhead.
* (1) Direct labor costs. #
* Correct. Direct labor is a variable cost directly tied to production levels, making it a product cost under variable costing.
* (2) Insurance on a factory. #
* Incorrect. Factory insurance is a fixed manufacturing overhead cost, which is not treated as a product cost under variable costing. It is considered a period cost instead.
* (3) Manufacturing supplies. #
* Correct. Manufacturing supplies (e.g., lubricants, small tools) are variable costs that increase with production, making them product costs under variable costing.
* (4) Packaging and shipping costs. #
* Incorrect. Packaging and shipping are selling & distribution costs, which are classified as period costs, not product costs.
* IIA GTAG - "Auditing Cost Accounting Systems"
* IIA Standard 2130 - Control Activities (Cost Management)
* GAAP and IFRS Guidelines on Variable Costing
Analysis of Answer Choices:IIA References:Thus, the correct answer is B (1 and 3 only) because direct labor and manufacturing supplies are considered product costs under the variable costing method.

Efficiency indicators measure how well resources are used to produce outputs. The number of audits completed reflects efficiency because it shows how effectively the internal audit function utilizes available resources to deliver its plan.
Option B (observations) reflects risk exposure, not efficiency. Option C measures effectiveness (impact of audit work), not efficiency. Option D reflects investment in staff development, not operational efficiency.
Reference:
IIA Practice Guide - Measuring Internal Audit Effectiveness and Efficiency.

The most effective way to ensure adherence to updated methodologies is through training that reviews and explains the changes in detail. A recorded training session allows all auditors to learn consistently and revisit the content as needed.
Option A improves accessibility but does not ensure understanding or compliance. Option B documents acknowledgment but does not ensure comprehension. Option D provides awareness but lacks sufficient depth.
Reference:
IIA Practice Guide - Developing Internal Audit Methodologies.

Ransomware is a type of cyberattack where malicious software encrypts an organization's data, making it inaccessible until a ransom is paid to the attacker. This aligns with the question's scenario, where denial-of- service is caused by malicious data encryption.
Let's analyze the options:
* A. Phishing:
* Phishing is a social engineering attack that tricks individuals into providing sensitive information, such as usernames, passwords, or credit card numbers. It does not involve encryption or direct denial-of-service.
* B. Ransomware (# Correct Answer):
* Ransomware encrypts critical data and demands a ransom for its release, effectively causing a denial-of-service scenario since the victim cannot access their own systems.
* Some well-known ransomware attacks include WannaCry and NotPetya.
* C. Hacking:
* Hacking is a broad term for unauthorized access to systems but does not specifically refer to denial-of-service through encryption. Ransomware is a specific type of hacking attack.
* D. Malware:
* Malware (malicious software) is a general category that includes viruses, trojans, worms, spyware, and ransomware. While ransomware is a type of malware, not all malware encrypts data to demand ransom.
* IIA Global Technology Audit Guide (GTAG) - Auditing Cybersecurity Risks - Discusses various cyber threats, including ransomware.
* NIST Cybersecurity Framework (CSF) - Defines ransomware as a major threat that disrupts business continuity.
* COBIT Framework (Control Objectives for Information and Related Technologies) - Addresses risks associated with ransomware and how internal auditors should assess controls.
* ISO/IEC 27001 - Information Security Management Systems (ISMS) - Identifies the importance of cybersecurity measures to prevent ransomware attacks.
IIA References: