Herzberg ' s Two-Factor Theory of Motivation divides workplace factors into:
Hygiene factors (which prevent dissatisfaction but do not increase satisfaction) - e.g., salary, security, relationships.
Motivators (which drive job satisfaction and performance) - e.g., recognition, achievement, responsibility, and personal growth.
Employees most often mention recognition as a key factor in job satisfaction, as it directly impacts motivation and engagement.
(A) Incorrect - Security.
Job security is a hygiene factor, meaning its absence causes dissatisfaction, but its presence does not create job satisfaction.
(B) Incorrect - Status.
Status is a hygiene factor, not a motivator. It prevents dissatisfaction but does not enhance motivation significantly.
(C) Correct - Recognition.
Recognition is a motivator, meaning it actively increases job satisfaction and is frequently cited by happy employees.
(D) Incorrect - Relationship with coworkers.
Work relationships are hygiene factors. While poor relationships can lead to dissatisfaction, strong relationships alone do not create motivation.
IIA's Global Internal Audit Standards - Human Resources and Organizational Behavior Discusses motivation theories and their impact on employee performance.
Herzberg's Two-Factor Theory of Motivation
Identifies recognition as a primary factor for employee satisfaction.
Analysis of Answer Choices:IIA References and Internal Auditing Standards:

An organizational chart is a visual representation of the company ' s structure, depicting reporting lines and hierarchical relationships. However, it has limitations when assessing the control environment.
Let ' s analyze each option:
A). The organizational chart shows only formal relationships. # (Correct Answer) Correct. The organizational chart illustrates formal authority structures but does not capture informal relationships, influence, or communication patterns that impact decision-making and control effectiveness.
Informal networks, such as cross-functional collaboration and shadow leadership structures, are critical but not reflected in an org chart.
B). The organizational chart shows only the line of authority.
Incorrect. The org chart displays more than just authority lines, including departments, reporting structures, and sometimes functional responsibilities.
C). The organizational chart shows only the senior management positions.
Incorrect. Org charts often include multiple levels of employees, not just senior management. Many detailed org charts cover entire departments, middle management, and functional teams.
D). The organizational chart is irrelevant when testing the control environment.
Incorrect. While it has limitations, the org chart is still useful for understanding reporting lines, segregation of duties, and governance structures when assessing internal controls. It provides insights into accountability and decision-making authority.
IIA Standard 2130 - Control Environment Assessment - Highlights the importance of organizational structure in evaluating internal controls.
COSO Internal Control - Integrated Framework - Discusses how formal and informal structures impact control effectiveness.
IIA Practice Guide - Assessing Organizational Governance - Covers limitations of relying solely on formal organizational structures.
ISO 37000 - Governance of Organizations - Addresses the role of hierarchy and informal influence in corporate governance.
IIA References:Would you like me to verify more que

Comprehensive and Detailed In-Depth Explanation:
In data analytics, data cleaning involves identifying and correcting errors, inconsistencies, and redundancies in the dataset to ensure accuracy and reliability. By eliminating duplicate or irrelevant data, the internal auditor enhances the quality of the dataset, which is crucial for accurate analysis and risk assessment. This process is a preparatory step before analyzing the data to identify high-risk areas. Normalization (option A) refers to organizing data to reduce redundancy but is more specific to database design. Analyzing data (option B) and reviewing data prior to defining the question (option D) are steps that occur before and after data cleaning, respectively.

Understanding a Man-in-the-Middle (MITM) Attack:
A Man-in-the-Middle (MITM) attack occurs when a cybercriminal intercepts, alters, or steals data while it is being transmitted between two parties.
The attacker can modify messages, inject malicious content, or eavesdrop on sensitive communications without the knowledge of the sender or receiver.
How MITM Attacks Work:
Attackers position themselves between two communicating parties (e.g., a user and a banking website) and intercept the data exchange.
This allows them to steal login credentials, financial information, or confidential communications.
Common MITM attack methods include:
Wi-Fi eavesdropping (public network interception).
Session hijacking (stealing active user sessions).
HTTPS spoofing (tricking users into thinking they are on a secure website).
Why Other Options Are Incorrect:
A). The perpetrator is able to delete data on the network without physical access to the device - Incorrect.
This describes a remote cyberattack, such as malware or ransomware, rather than MITM, which focuses on data interception.
B). The perpetrator is able to exploit network activities for unapproved purposes - Incorrect.
This is too broad and could refer to insider threats, malware, or privilege escalation attacks, rather than specifically MITM.
D). The perpetrator is able to disable default security controls and introduce additional vulnerabilities - Incorrect.
This describes a system exploitation attack, such as a rootkit or backdoor installation, not an MITM attack.
IIA's Perspective on Cybersecurity and IT Risk Management:
IIA Standard 2110 - Governance requires organizations to implement cybersecurity controls to mitigate risks like MITM attacks.
IIA GTAG (Global Technology Audit Guide) on Cybersecurity Risks advises organizations to use encryption (e.g., TLS, VPNs) to protect data in transit.
NIST Cybersecurity Framework recommends multi-factor authentication (MFA) and secure protocols to prevent MITM attacks.
IIA References:
IIA Standard 2110 - IT Security and Cyber Risk Governance
IIA GTAG - Cybersecurity Controls and Threat Mitigation
NIST Cybersecurity Framework - Secure Data Transmission
Thus, the correct and verified answer is C. The perpetrator is able to take over control of data communication in transit and replace traffic.

Connectivity to other systems should be established correctly before testing the new application. If interfaces, data flows, network connections, and system dependencies are not ready before testing, the test results may be incomplete or misleading. Testing should evaluate the application in an environment that reflects required integration points. Waiting until implementation is too late because connectivity failures could disrupt production. Waiting until maintenance would mean the issue was not controlled during development. Internal audit should review whether system interfaces were identified, documented, configured, secured, and included in test planning. Correct connectivity before testing supports valid integration testing and reduces implementation risk. Therefore, Option A is correct.